A fraud investigation is a planned, confidential inquiry to find out what happened, who was involved and how much was lost, using evidence that will stand up if challenged. It starts with a tip or an alert, moves through securing evidence and interviews, and ends in a report to those charged with governance. The two big risks are tipping off the suspect and spoiling the evidence.
Last reviewed: 17 October 2026. Facts checked. We opened ACFE's "Occupational Fraud 2026: A Report to the Nations" page and its key-findings press release, and SEBI's investor caution page on Ponzi schemes. We tried ACFE's Fraud Examiners Manual page and it returned a 404, so we did not read the manual. The investigation steps below are general practice, not quoted from ACFE or any regulator. We did not open the Banning of Unregulated Deposit Schemes Act, 2019, because the official copies we tried failed to load, so we state none of its terms.
What the data say about how fraud comes to light
ACFE's 2026 report says tips were once again the most frequent detection method, at 43% of cases, and more than half of those tips came from employees. It also says 84% of perpetrators showed at least one behavioural red flag before they were caught, and that the median scheme lasted 12 months before detection. It describes occupational fraud as fraud committed by a person against the organisation for which they work.
These findings explain why a working reporting channel matters. See our whistleblower policy guide and the whistleblower mechanism review template.
The steps
| Step | What happens |
|---|---|
| 1. Receive and log | Record the tip or alert, who gave it and when. Keep the source confidential |
| 2. Triage | Decide whether it is credible and serious. Decide who must be told |
| 3. Plan | Set the aim, scope, team, budget, and what laws or policies apply |
| 4. Secure evidence | Stop evidence being lost or changed, before the suspect knows |
| 5. Analyse | Review records, data and transactions to test the allegation |
| 6. Interview | Speak to witnesses first and the suspect last |
| 7. Conclude | Weigh the evidence and state what is and is not proven |
| 8. Report | Give a written report to the right people |
| 9. Act and learn | Discipline, recovery, legal steps and control fixes |
Who runs it matters. A conflict-free person should lead, and anyone who may be implicated must stay out. Take legal advice early.
Handling evidence
Poor handling can make good evidence unusable. These habits help:
- Secure first. Preserve email, files, system logs and devices before staff are told.
- Copy, do not change. Work from copies. Keep originals untouched.
- Log everything. Record what was collected, from where, by whom, when and how.
- Keep a chain of custody. Note each person who held the item and when it moved.
- Protect the data. Limit access. Store it safely and note who looked at it.
- Mind privacy. Personal data in emails and devices has legal limits. Get advice on what you may review.
- Write it up on the day. Notes made at the time carry more weight than memory.
Digital evidence needs extra care. Do not browse a suspect's laptop on the live system. Ask a specialist to make a forensic image.
Interviews
- Interview witnesses before the suspect.
- Prepare questions from documents.
- Have a second person present and take notes.
- Be fair. Allow the person to explain.
- Do not threaten or promise.
The report
A usable report states:
- Why the inquiry started and its scope
- What was done, and what was not
- Facts found, each tied to evidence
- Amounts involved, with the basis
- Who was involved, as far as the evidence shows
- Control weaknesses that allowed it
- Recommended actions
Keep opinion apart from fact. Our forensic audit explainer covers the wider process.
Reporting duties
Which law applies depends on the company and the fraud. For statutory auditors of companies, reporting of suspected fraud to the Central Government runs through Section 143(12) and Form ADT-4. We cover this in our ADT-4 deep dive. We did not re-check the thresholds for this post, so use that article and the current rules. Other regulators may also need to be told. Take legal advice on who, how and when.
Ponzi schemes and common red flags
SEBI describes a Ponzi scheme as a fraudulent investment scheme promising high rates of return, which pays early investors from the money of newer investors rather than from real earnings, and which typically collapses when new money slows. SEBI's warning signs include:
- High returns with little or no risk
- Overly consistent returns, whatever the market does
- Unregistered investments
- Unlicensed sellers
- Non-transparent disclosure, including errors in account statements
- Difficulty receiving payments, with promoters offering higher returns to keep you invested
For an auditor or investigator, these translate to questions. Where do the returns come from? Is the seller registered? Do the books match the statements? Do payouts track new deposits? We give no case facts here because we have not verified any.
To test for odd numbers in ledgers, our Benford's law checker is a free first screen. It does not prove fraud.
Frequently Asked Questions
What is the first step in a fraud investigation?
Log the tip, keep the source confidential and decide who needs to know. Then secure the evidence before the suspect is alerted.
Who should lead the investigation?
Someone independent of the area and not implicated. Many companies involve internal audit, legal and, where needed, outside specialists.
Should we confront the suspect early?
No. Interview witnesses first and the suspect last, after you hold the evidence.
What is a chain of custody?
A record of who held each item of evidence and when, so nobody can say it was changed.
What are the signs of a Ponzi scheme?
Per SEBI: guaranteed high returns, unusually steady returns, unregistered products or sellers, unclear disclosure and trouble withdrawing money.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error