The first 72 hours after you suspect fraud: what to do and what not to do

The days immediately after a fraud is suspected decide most of what follows. Evidence is either preserved or lost. The subject is either unaware or alerted. The investigation is either privileged or discoverable. Recovery is either possible or the money is gone. Here is the sequence that protects your position.

Hour zero: stop, do not confront

The instinct is to call the person in and ask. Do not. A confrontation before evidence is secured gives them the weekend to delete, transfer and coordinate. It also risks a defamation or unfair dismissal claim if the suspicion turns out to be wrong. Suspicion is a reason to investigate, not a finding.

Limit who knows

Decide, in writing, who is in the circle: usually the chair or a nominated director, the general counsel or external lawyer, and the investigator. Everyone else, including the subject's manager, stays out until there is a reason to bring them in. Leaks from well meaning colleagues end more investigations than clever suspects do.

Decide on privilege before anyone writes anything down

If litigation, a regulatory report or a termination is realistic, have your lawyers commission the investigation so that legal professional privilege can attach to the work. This is a decision for the first day, because privilege cannot be added later to documents already created. It affects who instructs the investigator, who receives the report, and how interviews are recorded.

Preserve, lawfully

• Suspend deletion on the subject's company email and file storage through your IT provider, without alerting them.
• Secure company devices under company policy when they are next returned or serviced; do not seize personal devices.
• Export access logs, approval workflows and payment records for the relevant period.
• Obtain bank statements and payment gateway records the company is entitled to.
• Note who has admin rights to the systems in question and whether the subject is one of them. If so, change that quietly.

Everything above is within the company's own authority under its policies. Anything that involves a personal account, a private device or a third party's records needs consent or a court order. An investigator who offers a shortcut around that is offering you a problem.

Frame the allegation

Write one paragraph: what is suspected, over what period, the estimated amount, and what evidence prompted the suspicion. The investigation plan hangs off that paragraph. If the allegation cannot be written down clearly, the matter is not ready to investigate; it is ready for a preliminary look at the records.

Check the whistleblower position

If the information came from an employee, contractor, supplier or their family, the Corporations Act whistleblower protections almost certainly apply. Their identity is protected, detriment against them is an offence, and the company must handle the disclosure properly. Get that right on day one; regulators are unforgiving about it.

Think about recovery early

If money has left, where did it go and is it still reachable? Freezing orders are available quickly where the evidence supports them, but only if you know which accounts and assets to target. Early tracing, even preliminary, keeps that option alive.

What not to do

• Do not send the subject a "please explain" email.
• Do not discuss it in a group chat, a board WhatsApp or an all staff meeting.
• Do not let anyone search the subject's desk, personal phone or personal email.
• Do not accept a resignation as the end of the matter; the money and the obligations remain.
• Do not report to a regulator before you know what you are reporting, unless a statutory deadline forces it. Your lawyers will tell you.

Valitros runs corporate investigations from the first hour, directly or through your lawyers, with preservation, tracing and fieldwork in Australia and overseas. See the service or book a confidential call.