IT Forensics · Private Individuals

How can a private IT forensic report following online fraud help my solicitor, my bank or the police?

Following an online fraud – such as through fake shops, classified adverts, romance scams or purported crypto platforms – victims must provide evidence of the sequence of events to their bank, the police and their solicitor. A private expert report organises communications, payments and technical evidence in a verifiable format.

Enquire without obligation

Why this question is important for private individuals

Following a digital fraud incident, financial loss, time pressure and technical uncertainty all come into play. A well-structured investigation can help to organise the available evidence and distinguish between assumptions and events that can actually be substantiated.

Technical background

Fraudsters frequently change accounts, domains and phone numbers. To recover funds and report the matter to the police, the exact details are crucial: recipient accounts, wallet addresses, transaction IDs, domains and contact details. These are often scattered across chats, emails, browsers and banking apps.

Relevant evidence and data sources

• Communication with the perpetrators (Messenger, email, platform messages)
• Payment receipts, transaction IDs, wallet addresses and blockchain transactions
• Domains and websites visited (browsing history, archived copies)
• Installed apps (e.g. fake trading apps, remote maintenance)

Borders

• The recovery of funds is not a digital forensics service.
• Identifying the perpetrators requires requests for information from the authorities.

Possible results

• Overview of all payment methods and perpetrator identifiers
• Documented timeline
• Appendices relating to the complaint and legal proceedings

Why LanCologne?

In cases of digital fraud, it is not just the fact that money is missing that matters. To establish the facts, it must be clarified which technical sequence of events can actually be verified: Was a phishing page opened?

Here’s how we do it

• Documentation of the process and the existing records.
• Securing devices and accounts using hash values.
• A summary of all identifiers in a single overview.
• Expert report setting out the methodology, findings and limitations.

Not every fraudulent payment means that the device has been hacked

Phishing, social engineering, stolen login credentials, compromised sessions and an actual device infection are technically distinct scenarios. We examine these possibilities separately and only explain the sequence of events as a finding that is supported by the available data.

Rapid damage control is a priority

If unauthorised transactions or account misuse are still taking place, the bank, payment service provider, card and affected accounts should be secured without delay. A forensic investigation will be planned around this; it must not artificially prolong any further damage that could be avoided.

Why LanCologne following a digital scam?

LanCologne does not attempt to spin a financial loss into the most dramatic account of an attack possible. We reconstruct the technically verifiable steps, document original sources and the limitations of witness statements, and present the findings in such a way that they remain understandable to the client whilst remaining technically comprehensible to lawyers, banks, insurance companies or investigating authorities.

Depending on the circumstances, different criminal law provisions may be relevant. Section 263 of the German Criminal Code (StGB) concerns fraud, and Section 263a of the StGB concerns computer fraud. Section 263a covers, amongst other things, financial losses resulting from the manipulation of a data-processing operation, for example through the unauthorised use of data. Which provision applies in a specific case is a legal question and is not decided by the IT forensic expert.

In the case of compromised accounts, Sections 202a et seq. of the German Criminal Code (StGB) may also be relevant. In the case of manipulated digital evidence, Section 269 of the StGB – which deals with the forgery of evidence-relevant data – may be particularly relevant, provided the legal requirements are met. However, the technical finding that a file or message has been altered does not automatically establish all the elements of the offence or the identity of the perpetrator.

For those affected, the priority following an ongoing fraud is to minimise the damage. The police and the BSI recommend taking swift protective measures in the event of hacked accounts or phishing, whilst at the same time documenting relevant digital evidence. A forensic investigation must not delay the necessary blocking of accounts, cards or payment methods.

In cases of disputed payments, issues relating to civil law and payment services law may also be relevant. Whether a payment was authorised, whether duties of care were breached or whether there is a claim for a refund must be assessed from a legal perspective. LanCologne can investigate the technical facts and chronology of events in this regard, but it does not replace legal advice and does not determine whether a refund is due.

A privately commissioned IT forensic report can document technical details in a way that is understandable to lawyers, banks, insurance companies or investigating authorities. It does not replace the investigative powers of the authorities, nor does it replace a court’s assessment of the evidence.

Frequently Asked Questions

Related topics

• How can I safeguard my digital evidence following a crypto or investment scam?
• How can I digitally document a fake online shop scam for the police, my bank or a solicitor?
• How can I have an online banking fraud case investigated using IT forensics?
• IT Forensics for Private Individuals

LanCologne – IT Forensics for Private Individuals

Do you have a digital enquiry? LanCologne can assist you with an objective, unbiased IT forensic investigation.

Get in touch now