Joe Hancock
Partner (Non Lawyer), Cyber Risk and Complex Investigations, Mishcon de Reya
Right I think that’s a stable set of numbers so why don’t we kick off. Hello everyone and welcome to the latest in our Diligence 2030 webinar series where we are trying to provide insights and practical tips based on our real experiences across Mishcon de Reya on a whole range of things that we do. If you have any questions if you put them into the chat function at the bottom, there’s a Q&A box down there, please do ask and we will try our very best to either pick them up at the end um or if you, if we don’t get a chance and you do put them in with your name, we’ll try to try to reach out to you to answer them directly. There will be a recording of the session for everyone that signed up and we will send that out directly and if you click on the resources button just at the bottom you can see the various speaker bios and you are able to contact any of the speakers directly if you’d like to follow up or ask them a question. Great. So today we are going to be delving into the world of financial investigations and their pivotal role in combatting fraud and cybercrime. I’m Joe Hancock, I have the privilege to run the cyber risk and complex investigations practice here at Mishcon and I am joined by a fantastic panel. We’re going to talk about things in an era where digital transactions are ubiquitous, financial systems intricately woven on a kind of truly global scale, it’s hard to get away from you know, whether it be crypto currency moving from one part of the world to another or the millions of kind of fiat transactions that happen every day and we want to talk really about how investigation could focus on those financial aspects. In our experience many investigations be it in the cyber world or traditional, focus on the other and then kind of ignore where the money has gone. So we are going to talk through some of the tools, techniques, legal frameworks and all those kind of things. So just a quick intro to all the panel members in turn, so um, I’ll go on the order based on my screen so Mark shall I start with you and then we’ll come to Freyda and Catherine.
Mark Tibbs
Partner, Complex Investigations, Mishcon de Reya
Okay, my name is Mark Tibbs, I’m a partner in our complex investigations team so I help our clients doing things like asset tracing, background due diligence into individuals and corporates. Anything where we are looking to find out more and reduce our, our ignorance about a topic really is where I fit in.
Joe Hancock
Partner (Non Lawyer), Cyber Risk and Complex Investigations, Mishcon de Reya
Fantastic thanks Mark. Freyda do you want to go next?
Freyda Thompson
Forensic Accountant, Mishcon de Reya
Yeah, I’m Freyda, I am forensic accountant at Mishcon and sit in the cyber team. I essentially work alongside the legal team to help out with all things numerical in disputes and investigations.
Joe Hancock
Partner (Non Lawyer), Cyber Risk and Complex Investigations, Mishcon de Reya
Fantastic, thank you and last but very not least, Catherine?
Catherine Rogerson
Managing Associate, Dispute Resolution, Mishcon de Reya
Hi, I’m Catherine, sorry excuse my very croaky voice today, I’m a managing associate in the fraud department and the things I normally get involved in are high value complex cross border disputes with a focus on fraud and asset tracing.
Joe Hancock
Partner (Non Lawyer), Cyber Risk and Complex Investigations, Mishcon de Reya
Fantastic and thank you so much for taking the time for all of you to chat with us today. So first of all we are going to talk through three kind of different sections. Talk about innovation and finance investigations and you can see Mark’s pre-empted my next question, we are going to talk through a particular issue we’ve dealt with recently and then we’ll cover some of the kind of legal opportunities and talk about asset tracing and recovery as Catherine mentioned. So Mark perhaps you could set the scene, can you talk us through a recent cybercrime investigation and how financial investigations helped as part of that matter. I can see you’ve got a, a diagram up.
Mark Tibbs
Partner, Complex Investigations, Mishcon de Reya
Helpfully prepared for me earlier. So yes, so this was a case, it’s actually a relatively simple fraud that we dealt with, an insider fraud at an organisation but it shows you know, there’s quite a lot of complex steps to get to just before we even got to the um, the financial investigation. So, so I’ll just run through it sort of step by step and then I’ll talk a little bit about how the financial investigation subsequent to this helped up um, helped us with the investigation. So basically there was an insider at an organisation who was able to steal client or customer data from his employer. He then used a sort of web application to share that with a fraudster. At the same time that fraudster was then, you know they were co-conspirators, they were working, the fraudster was using false identities to set up bank accounts in various different institutions. They then rang up a third party organisation that was responsible for some payments using the information they’d gleaned from the victim organisation, they were able to pass security questions, change an email on the account um, change, subsequently change the log in, sorry the bank details and get the payments redirected to bank accounts that were under their control that they’d set up using false IDs. So that was it in a nutshell, it took a long time to get there, that was, that was the course of the investigation but it was at that final stage where we’d identified the fraudster bank accounts that led us to really getting towards the end of our you know, in fact it had become a prosecution and that, that’s because you know, we’ll talk about some of the legal aspects of what we did to get inside those bank accounts and see what was going on but essentially we were, we were finding co-conspirators, we were able to trace the flow of funds um and we were able to also find out details about lifestyle and potentially the people that were actually under the control of those bank accounts. So that was how the, the sort of, the financial aspects of that. They were pivotal and we wouldn’t have been able to do it without that financial investigation phase.
Joe Hancock
Partner (Non Lawyer), Cyber Risk and Complex Investigations, Mishcon de Reya
Fantastic. Thanks Mark. And Catherine just coming to you, so um, what kind of investigatory techniques financial or otherwise have you seen employed in your recent cases?
Catherine Rogerson
Managing Associate, Dispute Resolution, Mishcon de Reya
Yeah so I mean going to the beginning of, of Mark’s slide there so fraud investigations usually begin with suspicions and red flags and, and what the client usually knows or suspects is just the tip of the iceberg so we are almost always on the back foot and um civil fraud poses quite unique challenges in, in many respects so assets and information are squirreled away using really sophisticated means of concealment and so we want to work to identify as quickly as possible who’s involved and where the information and assets are held. But saying this, every fraudulent transaction and matter however sophisticated leaves behind a digital footprint and this is often invisible to the untrained eye and I am very much including myself in that and so we use investigators to identify and analyse these digital trails um and the things that have been most effective in some of the fraud cases that I’ve worked on is the application of digital forensics. So that’s included you know, the recovery of deleted files, the analysis of metadata of kind of financial um, receipts and transactions, iband swifts and what it has enabled us to do is to reconstruct the timeline of fraudulent activities with you know, quite astonishing accuracy and like I said earlier, we’re kind of almost always on the back foot so it’s a really invaluable resource and um in a situation where so much of our case theory is down to inference, to be able to show when something was created, when it was last edited, who the file author was and the software um used to create it is, is really gold dust in a fraud case. Um, crypto as well, particularly tracing skills are vital for kind of revealing the identity of wrongdoers and establishing the, the location of stolen and crypto currency and I know you, you touched on that as well Mark don’t you?
Mark Tibbs
Partner, Complex Investigations, Mishcon de Reya
Yeah our team get involved in um, crypto tracing and so we have a capability which allows us to yeah, work typically with fraud lawyers isn’t it in cases where we’re looking to understand how um stolen funds have made their way through the system to off ramps so to things like crypto currency exchanges where we can then apply legal orders to get disclosure for example to understand who customers are um, can take our investigations one step further.
Joe Hancock
Partner (Non Lawyer), Cyber Risk and Complex Investigations, Mishcon de Reya
And um Freyda just coming to you quickly so I assume this is all completely innovative, every new piece of software and tool we see completely lives up to its promise would that be fair to say or do you have a different view?
Freyda Thompson
Forensic Accountant, Mishcon de Reya
Um…
Joe Hancock
Partner (Non Lawyer), Cyber Risk and Complex Investigations, Mishcon de Reya
That’s a loaded question.
Freyda Thompson
Forensic Accountant, Mishcon de Reya
…there is a bit of an expectation gap I guess between available technologies and what you can usefully and reliably use it for. Um, we are certainly not at the stage where you can input financial at one end, some AI wizardry or something and out spits the result at the other end. I mean there is a lot available that can be done to speed up um particular bank statement analysis, there’s no need for someone to sit there highlighting paper copies or painstakingly reviewing every transactions. There are available tools that can help summarise data, can identify patterns and trends but ultimately it needs a human, human to sit there and review what that analysis shows um in terms of like what you are trying to achieve. For example if there is anomalies in the data does that mean there’s funds flowing to someone that you are unaware of or of funds being spent on assets that you hadn’t previously been made aware of. Um, in particular something like a flow of funds or a tracing exercise there’s a lot of judgements that need to be exercised when conducting that and if you are unable to explain how you arrived at your conclusion that’s not going to be particularly helpful in an investigation, if you’ve overly relied on technology to get to that um place um particularly if you end up in Court you need to be able to explain evidentially how you’ve arrived um at a conclusion.
Joe Hancock
Partner (Non Lawyer), Cyber Risk and Complex Investigations, Mishcon de Reya
That’s really useful. I, I must admit I do worry myself that we obviously you know, we’ve seen kind of Gen AI used and challenged in Court based to kind of generate effectively you know, fake precedents or elucidated precedents at some point I think yeah, the rise of tools where there’s a button that says, ‘just show me what happened’ does kind of terrify me slightly without that kind of human in the loop. It’s good to know you’ll be around. Um, so just moving on to other more legal opportunities around financial investigations then, so um, I’ll stick with you Freyda, what are the kind of benefits of combining that kind of legal and financial approach so having you work like closely with people like Catherine or our kind of wider lawyers, how does that work?
Freyda Thompson
Forensic Accountant, Mishcon de Reya
Um yes I mean this is a relatively new approach for me having sort of gone in-house at Mishcon um and I really enjoy the sort of seamless process of the investigation and we all quite literally sit near each other, there’s a sort of tight line between the forensic accounting teams and the legal teams and the ability to collaborate easily on a daily basis and riff off each other um, it’s quite different from sort of the traditional siloed approach where a team goes off, does their own thing and eventually you all group together um like I said we are able to almost on a daily basis we can discuss the ongoing process of an investigation. Particularly for me I think I find the ability of the legal team to be on tap for those five minute chats, what does this mean in a set of accounts, what does this show in a bank statement rather than having sort of a big complex reporting exercise. I think that really kind of adds some benefits in an investigation and sort of ables us to sort of quickly deal with sort of avenues for enquiry.
Mark Tibbs
Partner, Complex Investigations, Mishcon de Reya
It reduces that friction doesn’t it, it’s the same as, as our team, you know the wider team working with the lawyers, it’s just the ability for that intelligence cycle to work more, more smoothly so when you’re, you know, when you’re giving direction, when our lawyers are giving us direction about the legal strategy we are able to work on that really quickly and just, and just complete that circle.
Joe Hancock
Partner (Non Lawyer), Cyber Risk and Complex Investigations, Mishcon de Reya
That makes sense. I must admit you know, I think all investigators especially fraud investigators we have an idea that we’re quite numerate but I think compared to someone who’s a forensic accountant, we’re very definitely not and I always value that kind of being able to say, hey Freyda I’ve got this company, what’s this mean?’ Which is always…
Catherine Rogerson
Managing Associate, Dispute Resolution, Mishcon de Reya
I’m guilty of that as well.
Joe Hancock
Partner (Non Lawyer), Cyber Risk and Complex Investigations, Mishcon de Reya
It’s very useful, no there’s definitely and again something which, which AI definitely can’t tell us yet or maybe at all. We touched on kind of um, legal access to data earlier so perhaps Catherine could you talk about some of the legal techniques that are useful to get that financial data because I know that my work and Freyda’s work definitely relies on the data coming in in the first place.
Catherine Rogerson
Managing Associate, Dispute Resolution, Mishcon de Reya
Sure. Exactly and at the outset of a global fraud case there’s a lot of email traffic between the fraud team and the cyber teams and it’s a really kind of iterative process um so because of the nature of frauds um we often look to obtain a pre-emptive or early relief where possible and, and really try and harness some of the most powerful tools at the Court’s disposal such as search orders which allow us to conduct um a search of the defendant’s premises um and/or forensically image their digital devices or um freezing orders often when there is a risk of the defendant dissipating their assets in the face of a legal claim. But another very useful tool for evidence gathering is third party disclosure orders and they are used to compel parties that are not otherwise involved in the litigation to disclose relevant documents and information and they are often made actually in the context of or ancillary to freezing orders and they are key in fraud claims because they help the claimant identify the current location of the proceeds of fraud and the identity of the defendant and they can help establish the value of the assets against any, which any judgment can be enforced and, and really help the client know whether they want to throw good money after bad. But there are…
Mark Tibbs
Partner, Complex Investigations, Mishcon de Reya
I, sorry…
Catherine Rogerson
Managing Associate, Dispute Resolution, Mishcon de Reya
Sorry Mark.
Mark Tibbs
Partner, Complex Investigations, Mishcon de Reya
I was going to say I get very excited about disclosure orders because it’s the, it’s the secrets isn’t it basically, you know, we can, we can find out information from public sources and that takes us so far but it’s unlocking those closed doors that gives us access to information you know, it can be, it can be financial, it can be technical, it can be whatever but um it can, it really propels an investigation forward.
Catherine Rogerson
Managing Associate, Dispute Resolution, Mishcon de Reya
Exactly and that’s an umbrella term but for example um, Norwich Pharmacal Orders and they are used frequently where when the claimant doesn’t know the identity of the wrongdoer but is aware of a third party that might so they are available before the beginning of the proceedings and so they allow the claimant the opportunity to gather all of the relevant information and it helps them decide on what claims should be made, where they should be launched um so it is really useful um to, to kind of get that information that would otherwise remain confidential. There are other… sorry.
Mark Tibbs
Partner, Complex Investigations, Mishcon de Reya
You were probably going to talk about it, I was just going to say it’s not just in this country as well, we’ve also had success with um disclosure orders in other countries, particularly the US.
Catherine Rogerson
Managing Associate, Dispute Resolution, Mishcon de Reya
Yeah absolutely. Do you, do you want to talk about a 1782?
Mark Tibbs
Partner, Complex Investigations, Mishcon de Reya
Uh yeah, I mean, you know the legal aspects I won’t be able to touch on but the, but the outputs of a 1782 certainly I can do because that’s when we start to get re-involved in, in a matter and so again it’s you know, disclosure of, of uh financial information. The really powerful thing about that I’ve seen in the past being used for a section 1782 is the um, the ability to go after correspondent banking institutions that sort of sit between transactions so we actually look at intra, intra-banking transactions and in various cases I’ve, we’ve used that to the benefit of you know, working out who’s been paying who and where and, and being able to yeah again, it’s the same thing, identifying co-conspirators, identifying assets etcetera but extremely powerful.
Catherine Rogerson
Managing Associate, Dispute Resolution, Mishcon de Reya
I’m glad you get as excited as we do about them, they are very, very useful and um yeah they enable a party or a potential party to proceedings taking place outside of the US to obtain US based evidence to support their case so they are super useful um and there are lots of specific disclosure orders that we can use, there are banker’s trust orders and they are quite similar to Norwich pharmacals but are a little bit different in, in kind of the grounds that you would, the grounds on which you would apply for one um but there are lots of things that we can use to kind of unlock that financial information and kind of get the claim off the ground.
Joe Hancock
Partner (Non Lawyer), Cyber Risk and Complex Investigations, Mishcon de Reya
Shall we talk about the end of the claim and move to kind of asset recovery um and again just on disclosure orders I always think that they are an under used tool in the law enforcement context you’d pop down to Court and get a production order kind of almost by default and again the bar seems to be higher, they are definitely not used as they should be but let’s talk about kind of the asset recovery process. It is often complex, it’s where we want to be you know because that’s the bit at the end where you, you get to make genuine recoveries for your client. Um, so I mean following the money is often key to finding those assets, I mean what kind of key factors kind of make that possible? Mark if perhaps you could just comment for one minute?
Mark Tibbs
Partner, Complex Investigations, Mishcon de Reya
So we, we, our team regularly get involved in investigations which involve asset tracing usually for the purpose of the litigation but you know as an example, I mean this is semi, semi financial information around sort of property, property asset but we’d be looking at you know, trawling through company structures and offshore jurisdictions. Um, one case we’re looking at at the moment, that is the case where the complex structures have been set up um so that and that can lead us to looking at things like public financial documentation which might give us clues to where assets sit and usually at that point you know I’d be doing my very best with my accounting, my very poor accounting hat on and then I’d be talking to Freyda pretty quickly to get the clues and it is amazing what can be you know, what I found can actually gleaned from a set of even just public accountant you know in terms of sort of looking back over time, understanding the health of the company, understanding the notes to the, to the financial accounts which might just give us clues as to the next um, the next step of the investigation which is typically you know, trying to actually identify and prove the beneficial ownership of that.
Joe Hancock
Partner (Non Lawyer), Cyber Risk and Complex Investigations, Mishcon de Reya
And if I just jump around a little bit you know Freyda we’ve kind of said we lean on you often to take that kind of very numerical view, what, what does that kind of, that, what’s that process and structure look like for you as part of the kind of asset recovery process when we turn up with this big bunch of finance statements going, hey show me who owns it?
Freyda Thompson
Forensic Accountant, Mishcon de Reya
Yeah, yeah, I think my role as being able to tell the story behind the numbers um what we’ve mentioned earlier, we can go from those five minute ad hoc queries, what does this mean in a set of accounts to a kind of more involved sort of flow of funds, tracing exercise um but as Mark was saying, even um where at the stage like at a start of investigation all you have is publicly available information there is a lot that can be gleaned from that um, you can be looking at trends over time as Mark mentioned the notes, the accounts you can be looking at things that payments connected parties, director loans, subsidiaries and holding company’s, assets um that were on the balance sheet now are no longer there, unusual trends and revenue expenditure and there was one matter that I dealt with one of the legal teams when they were concerned about cash potentially flowing out of a business um and from a review of just the publicly available accounts was able to identify 7 million in hold um which we were then able to show went on and disallowed expenditure and that allowed the legal team to obtain an injunction against the company so even from that kind of like brief review of publicly available information there is a lot that can be shown and demonstrated.
Mark Tibbs
Partner, Complex Investigations, Mishcon de Reya
It definitely shouldn’t be overlooked should it.
Joe Hancock
Partner (Non Lawyer), Cyber Risk and Complex Investigations, Mishcon de Reya
I never want you to look at my finances. Catherine just coming to you, so how does that kind of help the legal process, I mean Freyda just touched on a bit of it there but more broadly how does that numerical view of things help? Does it help?
Catherine Rogerson
Managing Associate, Dispute Resolution, Mishcon de Reya
Yeah. Yeah of course, it’s essential in helping us to establish our case and it really is an indispensable part of asset recovery um it’s yeah, it’s critical for building the case um against the wrong doer um and also it really helps us fairly quickly establish whether a fraud’s taken place that usually has and then they really help us to begin to kind of unpick and unearth data information that indicates the nature of the fraud um, you know it helps us look for anomalies in banking records, identifies emissions, data that’s been deliberately concealed it’s um, and it’s a complex and constant interplay I think between the evidence that we get from financial investigations and the strategy that we kind of take going, kind of in a legal sense um and it works really well actually and it is completely hand in hand yeah.
Joe Hancock
Partner (Non Lawyer), Cyber Risk and Complex Investigations, Mishcon de Reya
Brilliant so we’ve just got a couple of question from the audience but if there are any others please feel free to send them through, we’ll just do a quick Q&A now before we wrap up. So um, first question here, we talked about US data and section 1782s, why is kind of US data useful, what’s kind of in it? Perhaps Mark if you could um or Catherine talk about the um correspondent banking and the dollar transaction side of things perhaps?
Mark Tibbs
Partner, Complex Investigations, Mishcon de Reya
Yeah sure so um it’s useful because when a transaction, a sort of overseas transaction is happening between two bank accounts in different countries often they will need to go through, the infra… the banking infrastructure often it will exist in the US so and actually typically it is in various parts of the US like um New York in particular where there is a huge banking industry. So um, being able to access and so there are records of that that exist um, that are obtainable, that are disclosable um if you’ve got the right, you know if you’ve got the right case to put forward for the Court um and yeah that can include yeah, basically details of each transaction um through messaging platforms like Swift for example um but yeah a rich source essentially of information about transactions, about the counter parties, about the sums you know, about everything you can think that is involved in a transaction um but I mean sort of more generally, it’s not really part of the question, but more generally disclosure is useful because it can not only target financial information, it can target other information so you know, records round the customers, if it’s online infrastructure you are targeting, IP log ins for example to help you, you know, again identify suspects. We’ve had that in the past where that’s happened so just, just extremely powerful kind of tools that are um, yeah are at our disposal, well not at our disposal but available to us.
Joe Hancock
Partner (Non Lawyer), Cyber Risk and Complex Investigations, Mishcon de Reya
Catherine, Freyda any thoughts?
Catherine Rogerson
Managing Associate, Dispute Resolution, Mishcon de Reya
I agree with that, it’s a really useful, really useful tool and we use it often.
Joe Hancock
Partner (Non Lawyer), Cyber Risk and Complex Investigations, Mishcon de Reya
Fantastic, great well that very nicely brings us perfectly on time to the end of our session. These are deliberately super fast and to the point so thank you very much everyone for attending, fantastic to see so many of you. Again if you have any questions please feel free to send them through, if you click the resources button at the bottom you can contact any of us directly and we’ll be hosting our next webinar in the Diligence 2030 series probably I suspect it might be towards the end of August, maybe September once everyone’s had a summer holiday. So again, thank you very much and look forward to hearing from you soon and thank you very much to all the panellists.
Mark Tibbs
Partner, Complex Investigations, Mishcon de Reya
Thanks folks.
Mishcon de Reya