Cross-Border Fraud Investigation: How It Works, Step by Step

What a cross-border fraud investigation is — and when you need one

A cross-border fraud investigation establishes what happened, who is responsible, and where misappropriated value has gone when the conduct spans more than one country. Unlike a domestic inquiry, it must reconcile different legal systems, evidence rules, data-privacy regimes, and banking-secrecy laws simultaneously — while the assets at risk are typically moving faster than any single legal process can follow.

The trigger is usually a moment of exposure: a deal that went sideways, an executive whose representations no longer hold, a wire that vanished into a foreign account, or a counterparty who has stopped responding. For counsel, insurers, private-equity deal teams, family offices, and international principals, the question is rarely abstract. It is concrete: are we being defrauded, by whom, and can we recover — and the honest answer to the last part depends heavily on which legal remedies are still available by the time the question is asked. These matters cluster where international capital concentrates — a reason due diligence in Miami and South Florida so often carries a cross-border dimension.

Cross-border fraud investigation services exist precisely because the answers live in places a claimant cannot easily reach — foreign corporate registries, opaque ownership structures, correspondent-banking chains, and jurisdictions where a US subpoena carries no weight. The investigation's job is to convert that fog into an evidentiary record that survives scrutiny in litigation or arbitration — corporate intelligence applied under pressure and across borders.

How a cross-border fraud investigation works, step by step

Every matter is different, but the order of work rarely is. These are the five stages a disciplined engagement moves through; the sections that follow explain each one, and the stages overlap rather than wait for one another.

• Stage 1, the first hours: preserve and freeze. The victim's bank is asked to recall the payment, a complaint goes to the FBI's Internet Crime Complaint Center (IC3), and every instruction, email header and account detail is preserved exactly as received. Nothing is said to the suspected party.
• Stage 2: map the jurisdictions. Where did the money go, where do the people sit, and where are the records held? The answer decides which courts, registries and legal tools are in play, and in what order.
• Stage 3: trace value and ownership. Funds are followed through accounts, shell companies and conversions into property, securities or crypto-assets, and, where the records allow, the people who actually control each receiving entity are identified and screened against sanctions lists.
• Stage 4: obtain evidence abroad. Counsel uses the routes that fit the matter: Section 1782 for records held in the United States, letters of request under the Hague Evidence Convention, letters rogatory where no convention applies, and disclosure orders in common-law courts. Mutual legal assistance treaties are for governments, not victims.
• Stage 5: build the record and act. Findings are documented to an evidentiary standard and handed to counsel for freezing orders, civil claims, a criminal referral or a negotiated settlement.

The first hours: why speed decides recovery

Recovery is decided earlier than most claimants expect. The FBI's 2025 Internet Crime Report records 1,008,597 complaints and $20.877 billion in reported losses; business email compromise alone accounted for $3.05 billion across 24,768 complaints. The IC3's Recovery Asset Team, which since 2018 has worked with banks through what it calls the Financial Fraud Kill Chain, initiated 3,900 Kill Chain incidents in 2025 and froze $679.0 million, a 58% success rate on the money it chased.

The cross-border share is smaller. Of those 3,900 incidents, 326 ran through the international process, coordinated with FinCEN's Rapid Response Team and the FBI's legal attaché offices abroad, and froze $172.0 million. The IC3's guidance is direct: if you discover a fraudulent transfer, "time is of the essence". Contact your financial institution, request a recall of the funds, and file a complaint at ic3.gov with the full transaction details.

For the investigation, this means tracing and freezing are not consecutive steps. Even a partial first trace tells the bank and counsel where to aim, and every hour the funds sit still is an hour in which a freeze can still land. What can be done once that window has closed is set out in the legal remedies that recover the money.

Why the exposure is large, and why it hides

The economic stakes are well documented. The Association of Certified Fraud Examiners' Occupational Fraud 2026: A Report to the Nations, drawn from 2,402 cases of occupational fraud in 143 countries and territories, reports that the fraud examiners surveyed estimate organizations lose 5% of revenue to fraud each year; the typical case lasted 12 months before it was detected, at a median loss of $104,000. Losses grow with time: frauds caught within the first six months had a median loss of $40,000, while the 5% that lasted longer than five years caused a median loss of $1.115 million.

The structural enablers are documented too. The World Bank and UNODC Stolen Asset Recovery Initiative's study The Puppet Masters (2011) set out how companies, trusts and nominees are used to hide who controls stolen assets, and the OECD's Behind the Corporate Veil (2001) and the Financial Action Task Force's Recommendation 24 on the transparency of legal persons make the same point. That is the terrain a cross-border fraud investigation is built to navigate — the same terrain that makes proactive due diligence for foreign investors entering the U.S. market the cheaper defense against ever needing one.

Getting evidence abroad: the legal routes and how long they take

The first hard problem is jurisdiction. Evidence, defendants and assets frequently sit in different countries, each with its own rules about what can be obtained, how and by whom. A document freely discoverable in US civil litigation may be protected by banking secrecy in one jurisdiction and by data-protection law in another. A claimant cannot simply demand records abroad; access runs through statutes, treaties, courts and local procedure.

Sequencing matters as much as the choice of route. The wrong order — tipping off a defendant before assets are frozen, or pursuing slow formal channels while funds dissipate — can render an otherwise strong case worthless, so the jurisdictions are mapped early and the evidence strategy is aligned with where the evidence and assets actually sit. The routes counsel most often combine are below. Which of them is open in a given matter is a question for counsel in each jurisdiction; this summary is informational, not legal advice.

• Section 1782 (28 U.S.C. § 1782). A US district court may order a person who "resides or is found" in its district to give testimony or produce documents "for use in a proceeding in a foreign or international tribunal". Dollar payments between two foreign parties often leave records with a US correspondent bank, which makes this one of the most useful routes to where the money went. Since ZF Automotive US, Inc. v. Luxshare, Ltd. (2022) it does not reach private commercial arbitration.
• The Hague Evidence Convention (1970). In civil or commercial matters, a court in one contracting state sends a Letter of Request to the competent authority of another to obtain evidence. Article 23 lets a state decline requests issued "for the purpose of obtaining pre-trial discovery of documents", and many states have made that declaration, so requests have to be narrow and specific.
• Letters rogatory. Where no convention applies, a court's request travels through diplomatic channels. The US State Department warns that execution "may take a year or more".
• Mutual legal assistance treaties (MLATs). Government-to-government requests, mainly in criminal matters, run in the United States by the Justice Department's Office of International Affairs. A victim can refer conduct to prosecutors and support the case; it cannot make or direct the request.
• Common-law disclosure orders. Courts in England and Wales, and many that follow their practice, can order a bank or other party caught up in a wrong to disclose where funds went (Norwich Pharmacal and Bankers Trust orders), often before the wrongdoer knows a claim is coming.

Asset tracing across borders

Asset tracing is the analytical core of most fraud-recovery efforts. It reconstructs the path of money or value from the point of loss through the layers designed to obscure it, building a documented chain that connects the fraud to assets a court can ultimately reach — a process we walk through phase by phase in an anonymized cross-border asset trace. What an asset investigation can lawfully establish in the first place is set out in what an asset investigation is. Once a claim is filed, that chain becomes one input into a wider litigation support effort — quantifying the loss and defending the method under cross-examination.

The work blends forensic accounting with open-source and public-records intelligence: bank-flow reconstruction from available statements and correspondent records, corporate-registry analysis across jurisdictions, land and vessel registries, litigation and insolvency filings, and analysis of how proceeds were converted into real estate, securities, crypto-assets, or further corporate entities. Each layer the fraudster builds to break the trail is a layer the investigation must rebuild.

Two principles govern the discipline. First, follow value, not just cash — proceeds are routinely converted into property, equity stakes, or digital assets that retain a traceable lineage. Second, preserve the evidentiary chain at every step, because tracing that cannot be authenticated later is intelligence, not proof. Where appropriate, findings are translated into the freezing orders and disclosure applications that actually secure recovery.

One check belongs inside the trace rather than after it: sanctions. If the money reaches property in which a blocked person has an interest — someone on OFAC's Specially Designated Nationals List, or an entity owned 50% or more by blocked persons under OFAC's 50 Percent Rule — a US person holding it must block it and report it to the Treasury's Office of Foreign Assets Control within 10 business days. OFAC's program regulations also make any attachment, judgment or lien against blocked property null and void unless OFAC licenses it. A trace that ends at a sanctioned owner changes the recovery plan, so ownership is screened as each layer is identified.

Beneficial-ownership and shell-company analysis

Concealment of true ownership is the connective tissue of cross-border fraud. Shell companies, nominee directors, layered holding structures, and trusts are used to separate the people who control assets from the names that appear on paper. Penetrating that layer — establishing who really owns and controls an entity — is often the single most decisive output of an investigation.

The analysis draws on corporate registries, beneficial-ownership disclosures where they exist, leaked and licensed corporate databases, regulatory filings, court records, and human-source inquiry, cross-referenced to expose the connections among entities, directors, and addresses that signatories try to keep apart. Recurring registered agents, shared nominees, and circular ownership are familiar tells.

The registries themselves are less open than claimants assume, and the US one has narrowed sharply. FinCEN's March 2025 interim final rule removed beneficial-ownership reporting for US companies and US persons, and its final rule, announced on 11 August and effective 14 August 2026, made that permanent; only companies formed abroad and registered to do business in a US state still report, and what they file is not public. Access is limited to authorized government users and, with the company's consent, financial institutions.

In the European Union, the Court of Justice struck down unrestricted public access to member states' ownership registers in November 2022, and the 2024 anti-money-laundering directive (Directive (EU) 2024/1640) makes access turn on a legitimate interest. Where a registry can be read, it supplies leads to be corroborated, not conclusions to be accepted; the US position is set out in the Corporate Transparency Act in 2026.

Signs that a fraud has crossed a border

Most cross-border frauds are first noticed as an ordinary anomaly; the border shows up later. Some signals point outward from the start: payment instructions changed to an account in a country where the counterparty has no operations; a supplier or customer whose registered office, bank and directors sit in three different jurisdictions; nominee directors, or a registered-agent address shared with many unrelated companies; round-sum transfers that leave and come back through an offshore entity; and a counterparty that resists any request to show who owns it.

None of these proves fraud. Each is a reason to look before more money moves, and to preserve what is already on file. How individual warning signs are surfaced and resolved before a transaction closes is covered in red flags in due diligence.

Working with local counsel and on-the-ground sources

No firm credibly investigates the entire world from a single office, and claims to do so should invite scrutiny. Effective cross-border work runs through vetted local counsel and trusted in-country resources who understand the courts, registries, language, and culture of each relevant jurisdiction — and who can act lawfully within them.

Local counsel do more than file documents. They advise on which legal tools are realistic in their courts, how quickly a freezing order can be obtained, whether a judgment can be enforced, and where local privacy or blocking statutes constrain evidence-gathering. In-country inquiry — conducted lawfully and ethically — surfaces context that no database holds.

The investigator's role is to direct and integrate this network: setting the strategy, maintaining evidentiary discipline across borders, and keeping every action in every jurisdiction lawful and defensible back home. Coordination, not raw footprint, is what separates a coherent investigation from a collection of disconnected reports.

Evidence standards that survive litigation

An investigation's value is ultimately tested in a forum — a court, an arbitral tribunal, an insurer's claims committee, or a settlement negotiation. Findings that cannot withstand that scrutiny do not support recovery, however compelling they appear in a memo. Evidentiary rigor must therefore be built in from the first day, not retrofitted at the end.

That means maintaining chain of custody for documents and data; collecting electronic evidence in a forensically sound, defensible manner; documenting sources and methods so conclusions can be independently verified; and ensuring every step complies with the data-protection and privacy laws of each jurisdiction touched. Evidence obtained unlawfully abroad can be excluded — and can expose the claimant to liability — so legality is not optional.

This is where forensic-accounting depth and fraud-examination method matter. The ACFE's Certified Fraud Examiner methodology and forensic-accounting technique are what quantify a loss, reconstruct transactions and present findings in a form attorneys can put before a tribunal. At Fortaris the fraud-examination method is anchored by Jon Chmura, the firm's ACFE Certified Fraud Examiner. The deliverable is a clean, attributable evidentiary record — the foundation on which every later legal step rests.

Recovery pathways and how engagements unfold

Investigation is the means; recovery, prosecution or a defensible decision is the end. Once the facts and the asset picture are established, several pathways open, often pursued together: freezing orders and proprietary claims against traced assets, enforcement of a judgment where the assets actually sit, a criminal referral supported by a well-documented file, and settlement once a claimant can show where the assets are and who controls them. How each works, and where each stops, is covered in the legal remedies that recover the money.

A disciplined engagement typically moves in phases: scoping and rapid triage to preserve options and prevent dissipation; intelligence and tracing to map entities, ownership, and asset flows; evidence consolidation to litigation standard; and strategy execution alongside counsel toward freezing, recovery, or settlement. Throughout, the principal receives clear, senior-level assessment rather than raw data dumps.

At Fortaris Capital Advisors, this work sits within our International / Cross-Border Due Diligence practice. Cross-border, border-state and Latin-American matters are a specialty of Managing Director Jay Donly, whose federal investigative service includes the DHS Office of Inspector General, US Treasury and INS. Engagements are partner-led and discreet. Fortaris holds Michigan Private Investigator License #3701207862 and works nationwide through vetted licensed specialists, and abroad through local counsel and in-country resources. The aim is simple: give counsel, insurers and international principals a defensible record they can act on. This article is informational and is not legal advice.