Forensic reconstruction of a Business Email Compromise incident where AI-generated messaging, voice, or impersonation played a part, with remediation recommendations.
A payment has gone to the wrong account, or a mailbox is showing signs of compromise, and the messaging involved reads more convincingly than the business email compromise attempts of a few years ago. Large language models have made fluent, context-aware phishing and impersonation emails routine, and a forensic response now has to account for that as a factor, not just look for the traditional tells.
A forensic report reconstructing what happened: how access was obtained or what messaging was used, what controls were exploited or absent, whether the messaging or any associated audio shows indicators consistent with AI generation, and where the funds or data went where that can be traced. The report closes with specific, actionable remediation steps, not a generic security checklist.
Email header, forwarding-rule and mailbox audit
Timeline reconstruction of the compromise, from initial access to discovery
Linguistic analysis of suspicious messages for indicators consistent with AI-generated content
Financial-flow tracing where payments were misdirected, cross-referenced with our Fraud & Asset Intelligence capability where the matter extends into recovery
Chain-of-custody documentation for every artefact handled, to our published evidential standard
Digital forensics conducted to ACPO Principles for Digital Evidence, combined with AI-content analysis on any suspect messaging or audio. Findings on AI involvement are worded as consistent with, not proof of, AI generation.
Contact your bank and report the fraud immediately; time matters for any prospect of recovering misdirected funds. This engagement runs in parallel, to establish how the compromise happened and close the gap.
Where recovery becomes relevant, this sits alongside our Fraud & Asset Intelligence capability, in particular Asset Recovery Intelligence and Cryptocurrency Tracing & Recovery Intelligence where funds were converted.
Attribution is often possible to a degree, infrastructure, patterns, and prior-use indicators, but we report our confidence level explicitly rather than asserting an identity the evidence does not fully support.
Every enquiry is reviewed by an analyst and routed to a scoping call, a fixed fee is confirmed in writing before any work begins.