What We Examine
When It Matters
- →Business email compromise and invoice redirection fraud
- →Disputes about whether an email was sent, received or altered
- →Staff moving company data to personal cloud storage
- →Unauthorised access to an email or cloud account
- →Disclosure obligations covering mailboxes and shared drives
- →Family law and employment matters relying on emails
Is This Email Genuine?
A printed or forwarded email proves very little. The original message, with full headers, records which servers handled it and whether it passed authentication checks. We examine the original and report whether it is consistent with being genuine, and where it is not.
Reviewing an analysis prepared by police or another expert? See disclosure and case review.
Business Email Compromise
In a business email compromise, someone gains access to a mailbox or impersonates a supplier, then sends altered bank details or payment requests. We investigate how it happened and what the attacker did, so you can support recovery efforts, insurance claims and any dispute over who bears the loss.
- →Whose mailbox was compromised: yours, the supplier's or neither
- →When access began, and from which locations and devices
- →Hidden forwarding and inbox rules the attacker set up
- →Which messages were read, sent, altered or deleted
- →A written report suitable for insurers, banks, police and court
Related Guides
Common Questions
Do you need the account password?+
For most collections the account owner or administrator grants access. We do not access accounts without lawful authority.
Can you tell if an email was faked?+
Often, from the original message and its headers. A screenshot or PDF alone is rarely enough to decide either way.
How quickly should we act on a business email compromise?+
Immediately. Some audit logs are only kept for a limited period, so preserve them before they roll over.