Criminal background checks

The definition and perception of what goes into a criminal background check varies. For a private investigator it is important to serve the needs of a client by doing a thorough search so that he or she receives the complete information that they need. Be aware that within the investigative industry we have the knowledge that a one click “FBI Background Check” does not exist, and it might be necessary to describe the methods to discover the criminal history of a subject.

The video below describes the basic mechanics that a client might want to know about including starting with a “chain of residence.”


AFX Search, Palm Beach FL private investigator.

Surveillance for divorce and infidelity cases

Private investigators are often called upon to document cheating in a relationship. Whether in a divorce case or checking on a relationship partner it is important that the investigator go beyond simply observing that the subject is having an affair. Collecting supporting information and pursuing the related activity is even more valuable to the client.

In most cases the client already knows that the subject is having an affair. Finding out the extent of all hidden activities is really what the investigation should be about. The real value of a professional investigator is digging deeper to find all the risks the subject is creating for the client, and helping them out of jeopardy.

The following video describes some of the elements a professional investigator should consider when operating a cheating case.


Importance of verifying timing devices in a private investigation.

Investigations of people or events span many locations and time periods. When a private investigator works a case, his observations and efforts connect the movements and surroundings of the subject. To provide relative timelines the dates and time of each event is reported. It is critical to synchronize the timing of devices used to record these events.

Most of the time the clocks built into different devices are not exactly in sync, which can have consequences when the results are used later. The credibility of the accuracy of the report is at risk when they appear to be in conflict, even by a few minutes. The following video describes some scenarios where a private investigator can run into, and how to ensure exact results.


E-discovery of voice and phone records

Discussion on ESI typically will focus of e-discovery of data such as letters, emails, financial records, and scanned documents. An extraordinary opportunity for discovery of potentially valuable information from voice and audio recordings is frequently overlooked. The exchange of information in voice or audio format has migrated almost exclusively to software based platforms. Because of this, files containing audio and voice are created in regular FAT or NTFS formats, even if only for a temporary mechanism to transport the audio to its destination. Many IT managers are unaware that these audio files exist.  A skilled e-discovery expert can use this knowledge to develop intel from a case.

A simple example can be demonstrated by understanding the modern phone and voice mail systems. When a call comes into a corporate enterprise phone system, the routing and call management is handled by computer. Most firms now have raw data lines running into the organization handling all types of bandwidth volume. In many cases the data allowance is shared between data and voice, with the company handling the setup of phone numbers and call flow. One or more phone servers are set up to manage this phone traffic in the same way a file server manages data traffic. As the call is routed to the selected extension or DID number, the phone server routes the connection to the appropriate wall jack as programmed in the system. The server maintains records of how the calls were routed, transferred, or terminated. This data by itself may prove valuable.

Where it gets more interesting is when a voice mail or message is created. If the call is routed to voice mail  the message is stored as an audio file on the server in much the same way as any other data file on a PC. It may be in a distinct .WAV or .MP4 file or part of a zipped archive containing multiple audio records. The sound file will often contain the date, time, caller ID, length, and selected extension within the metadata. What makes this mechanism even better for an investigator is that the records are often more durable than expected. When a system user deletes a voice mail message the process does not vacate the audio. Instead the system simply removes the registration of that sound file from being indexed by the users voice mail account. This is why many phone systems have the ability to recover deleted messages. Eventually the system may overwrite the sound files if the space is needed for more records but most enterprise systems have plenty of storage capacity. Even older voice messages which would have been overwritten can be discovered. At regular intervals the phone server is backed up to tape in the same way that date file servers are. The backed up version of a phone server would have a snapshot of the audio files as they existed on that date. Since backup tapes are usually not immediately reused and are stored in inventory there may be up to a years worth of old audio files stored somewhere if the investigator is diligent.

Many phone systems also allow for users to use the system to transmit voice messages internally to each other using their phone extensions. These messages are stored the same way and may contain candid communications which are perceived to be less documented than email. Most users believe that when an audio voice message is “deleted” by hitting a button on the phone set that it is gone forever. For this reason there may be information on audio which is more sensitive than that in written or email format.

This knowledge can be applied to voice and audio files created on many platforms.

  • Virtual IVR systems (OneBox, RingCentral, 8×8, etc.) – Cloud based systems record the audio off-site, so careful crafting of discovery will be needed to obtain these records.
  • VOIP – Businesses are migrating from copper wires at a high rate. Over 80% of new business lines installed use VOIP services such as Skype, Vonage or Ooma for some communications. The voice files for these can be accessed by a user login, or recovered from the provider.
  • GoToWebinar – Webinars, podcasts, or other presentations may contain information on training policies, what information was distributed to employees, and what opinions are held by a company. Each presentation creates an audio file. Employees and executives are more outspoken when conducting internal meetings and presentations. Conference call platforms also create an audio file.
  • Voice memos; enterprise and mobile – Executive users may use their mobile device to record memos, ideas, and notices to be transcribed later. These are captured when the device is synced.
  • Auto-attendants – Telephony has gone from a proprietary hardware system to software based IVR. We have all heard the ubiquitous notice “This call may be monitored for quality assurance.” Incoming calls to some departments such as billing or customer service might create an audio record of the entire call. Even older hardware such as Dialogic cards store audio messages on disk.

When examining available audio, consider three additional additions to the investigation:

  1. Background audio – be attentive to sounds in the background of audio files for additional details. Was the caller in a vehicle? Are there other parties present? Did another call ring in to the call waiting?
  2. Meta data – Be sure to extract any meta date from audio files as well as data files. Sound files need to have more robust meta info since there is no space for text on the visible file as in an email or PDF file.
  3. Old greeting messages – A person may have various versions of greeting messages for their extension. Some attempts at recording the message may have been interrupted by a co-worker talking to them, or some other interruption. The “deleted” recording may contain background info.

The opponent is expecting discovery of written materials and electronic records. Worded documents are created with more diligence with the expectation that the record is durable. Individuals are less cautious in verbal communications, even when the discussion is by phone or electronically. The durability of audio communications may not be visible to the eye. The value to an investigator is created by the capitalizing on the subject not expecting voice comms to be archived. If the legal team ensures that audio files are part of the ESI discovery, and there is an expert investigative resource to extract all of the files from servers, backup tapes, and other electronic media.

Investigating fraudulent fake reviews

Consumer reviews of commercial businesses have become an asset or liability for an enterprise. Websites such as Yelp, TripAdvisor, and even Facebook are sources of tellworldcontent where potential future clients and customers research information prior to deciding to do business with your firm. Attracting new clients is the lifeblood of a company, and positive reviews are crucial to maintaining a healthy bottom line.

There may always be a few clients in any business which cannot be pleased even with the best intentions and efforts of the merchant. These may simply need to be absorbed among the high volume of positive reviews from the vast majority of clients which a well-run and successful business cultivates. As competitors become more desperate that your successful company is retaining all of the customer in a market, they are resorting to posting fake negative reviews against your firm. This damages the extraordinary reputation which you worked hard for, and improperly benefits a company which has not rightfully earned the customers business. It also harms the innocent consumer in that they will be more likely to be exposed to less admirable business practices of the competitor. The consumer is also more likely to pay higher prices to a less efficient company. Fake reviews are real and significant threats to the viability of the business.

When a highly rated company needs to fight back against fake reviews, a skilled professional investigator can assist with discovering the source of the fraudulent activity. An investigation of review fraud can result in the fraudulent posts and reviews being removed, the perpetrator being publicly identified, and even paying restitution. A competitor acting in bad faith will also cease these actions when caught. Fake reviews are a form of fraud against a business, the same is paying with a bad check or embezzlement.


These reviews may be written by employees of a competitor, an owner, or even an individual with a personal grudge against you or your firm. The origin may even be from long in the past. A professional private investigator skilled in discovering review fraud knows the methods to reveal this otherwise hard to prove activity. A licensed private investigator has access to records which are not available to an individual. In addition, there are techniques to obtain information directly from the fraudster through covert direct contact. Experienced investigators know where the hidden records connecting the fake review to a specific person are stored. Even older records have an archived or backup file with the contact information. The extracted records from websites, ISP, cell providers, and app accounts combine to a trail of evidence to the culprit.

controlroomA review fraud investigation can identify the name and location of the individual who placed the record online along with corresponding contact information. The exact date and time of the post may be available to tie the location to a specific event. Undoing the fraudulent negative reviews comes next, and there is a fast growing area of legal practice dedicated to obtaining compensation from competitors or clients who fraudulently damage a business. The logic is the same as if the person damaged property.

If a business owner came to their company and discovered the front window broken, they would not hesitate to investigate who caused the damage and make sure the party responsible was punished, and made restitution. Combating review fraud is no different. In fact, the financial damage to a company from fake reviews may be more severe, even if it is spread out over time.


Hiding a large check from judgment creditors

A judgment debtor who comes into a large payment may look for ways to keep this asset from being visible to creditors. Let’s examine three methods, and also how a professional investigator can discover each of them.

1. Cashiers check shuffle. The subject takes the check, which is made out to him, directly to the financial institution from where it is drawn. He instructs the teller to convert it to a cashiers check under the pretense that he wants to verify the validity of the check and available balance. The cashier creates a cashiers check or teller check in the same amount, made out to the subject.

shelldollarThe subject can now use the cashiers check like a virtual savings account. Each time he needs to make a “withdrawal,” he can visit any branch of the bank, and get cash plus a new cashiers check for the remaining balance. If the check is $15,000 he can ask for $500 in cash, and a new $14,500 cashiers check. He can even get multiple cashiers checks made out to new payees in order to send payment to third parties. None of this activity appears on any financial statement, bank account records for the subject, or tax return.

The subject can continue this shuffling of reducing the cashiers checks until the sum is depleted with no paper trail connected to any account or social security number. There is a slight risk of a bank employee submitting a Suspicious Activity Report (SAR) if there are frequent visits to the same branch, and the subject is remembered. However, this record is only submitted to the US Treasury Department and is not discoverable by the private sector.

Uncovering the method: A private investigator should look at the source of funds for all transactions and payments benefiting the subject debtor. Payments for cell phone bills, utilities, and even loan payments should be examined to see what account they come from. Any payments made came from checks broken off from the original cashiers check, they can be traced back to the teller instrument.

“Withdrawals” for spending cash can be discovered through surveillance. The subject will have to physically visit locations of the issuing financial institution to break down the check and get cash. This creates a record at the bank level which can be subpoenaed after the activity is observed. In many cases surveillance is recommended when a subject appears to be using more cash than he should have available. Bank or ATM visits are usually observed which turn into revealing the source of cash.

2. Third party conversion. In this method the subject endorses the check instrument directly to a trusted third party. Since there is no payment from any account held by the debtor, a simple account search by a private investigator would not reveal any transfer. The asset conversion went directly from the payee to the third party, skipping over the debtor. The third party can dole out funds to the debtor on request.

Uncovering the method: It is usually simple to determine the 5 or 6 most trusted colleagues of a subject. Close friends business associates, relatives, and spouses are the most common. A private investigator makes a direct contact with the most probable subjects and directly asks if they have received any payments from the debtor. These parties are usually unsophisticated to fraud and will either reveal the payment (with some excuse for why it was made) or hedge their answer in a way that an investigator will recognize as deceptive. In some cases the third party is not even aware that the payment is improper, and will have been told by the debtor some story as to why it is being made.

In any case it will likely result in the third party wanting to distance them self from the fraud and will prevent any other colleagues from replacing the first “trustee.”

3. Casino Royale. As legalized gambling is more ubiquitous, debtors no longer have to travel to Las Vegas or Atlantic City to access casino financial systems. A third party check made out to the subject may be able to be used to purchase casino chips or to guarantee a marker. Not all casinos do this but there are mechanisms to make this happen. As long as the amount does not pokerchipsexceed $10,000, there is no need for an 8300 form.

The subject an retain the chips and return to the casino to cash in amounts for expenditures as needed.

Uncovering the method: Start with casino loyalty accounts. Even though the subject is concealing assets, it might be tempting to get more comps from their casino card. Trash pulls can help with this method. A recent high dollar transaction can initiate marketing from the casino. After that an investigator can resort to the surveillance method from the Cashiers Check Shuffle.

4. Debt Shadow. We came across this scenario a few years back. A subject had received payment of $8000+ from a client at about the same time he was being divorced. In order to shield the money from the divorce settlement, he created a new out of state corporation and endorsed the check to that corporate bank account. He could have simply withdrawn fund from that moneyshadowaccount but to further distort his financial picture for the divorce, he obtained a personal loan secured by the funds in the corporate account. This way his personal net worth was reduced by the loan amount, and he did not report the asset on the PFS.

Uncovering the fraud: This one was more complicated than it was sophisticated. A checklist for a private investigator should always include reviewing credit applications for any loans, leases, or lending activity within the past 12 months. The application itself had the “Secured Account” box checked off on the form. Even if that was not the case, an inquiry to how the loan was underwritten, and also the source of payments would have discovered the scam.

Conclusion: The movement of money always leaves a permanent record of the activity. It is the role of a private investigator to know how to discover each of the subtle signs of asset motion. In all of these methods, it is also important for the private investigator to be aware of what payments should be expected to the subject. Reviewing a prior history of vendor payments, commissions, contractual due dates, and historical bonus’ will make it obvious when a payment does not show up when it should have, or in the same amount is has previously. A professional private investigator skilled in asset recovery can discover any asset, any time given the proper investigative resources.

Asset Recovery – Dangers of delaying civil action until criminal cases are completed

Asset Recovery – Top 10 Reasons to Initiate Civil Action Against Fraudsters Before Criminal Prosecutions are Completed

In many instances the civil asset recovery cases we work on have fraud associated with them which is being prosecuted by the courtroom1public sector. For some victims it is tempting to wait for completion of the criminal case against their creditors in the hopes that the sentence will include restitution. In theory this would meet their need for recovery without the expense of a private civil case and investigation. However, the needs of victims are best met by being specifically represented through a private investigation and receiving professional legal advice.

1. Plea bargain. Criminal cases are most often settled with a plea bargain. In a plea agreement the elements of prison time, sentencing guidelines, and government fines are considered along with any restitution. Due to requirements of the legal system to meet certain guidelines, the government attorneys may need to bargain away restitution first in order to uphold sentencing guidelines.

2. Statute of limitations. A criminal prosecution can take several years, which may extend the tolling of time past the statute of limitations for initiation a civil case for all of the losses.

3. Third party liability. The criminal prosecution only deals with the activities of the subjects charged with crimes. nomoneySuccessful asset recovery in fraud or Ponzi scheme cases extend liability to 3rd party enablers such as financial institutions, sales people, accountants, title agencies, and professional advisers. The activities and assets of these parties are not investigated in a criminal case against the direct defendants. Ponzi schemer Scott Rothstein’s victims sued TD bank for $67 million after in investigation showed that their internal policies allowed the fraud to extend and damage victims. A private investigation and civil lawsuit discovered this new asset source.

4. Spoliation of evidence. In the time it takes to prosecute a criminal case, important evidence which can be valuable to asset recovery can dissolve. Records, documents, witness memory, and even the assets themselves can disappear. Also, during a criminal case third parties are careful not to dispose of or destroy documents. Once the criminal case is over there is no need for these to be retained. Third parties and even the fraudsters themselves are less likely to move assets during a trial since they are under additional scrutiny. Once the trial is completed with a verdict or plea, assets and records are often moved immediately. In one case, a bank executive committed fraud and then filed bankruptcy. It was discovered that he had hidden hundreds of thousands in assets by purchasing antique furniture and decorating homes of himself, friends, and relative with it. The furniture appeared to be normal to the untrained eye and was overlooked as being of value. When the fraudster was released from prison he simply began selling pieces for thousands at a time to support his lifestyle. The scheme was uncovered later but it was after the statute of limitation ran out for victims. The man went back to jail for bankruptcy fraud but most of the asset value was gone by then.

5. Expanded recovery. When a defendant pleads to a lesser charge, it can remove avenues of additional recovery such as treble damages, or multipliers due to victimizing senior citizens. Once a fraudster knows they are already going to prison, they may not fight to reduce their time by a few months or even a year if they can limit the restitution amount. This gives them more capital to access upon completion of their sentence.

6. Scope of investigation. In a criminal prosecution the depth of investigation can be cut off in a plea agreement. If a defendant pleads guilty the entire criminal investigation may never finish. Asset concealment discovered by private investigators may turn out to be an additional crime committed by the fraudsters, which can be an additional prosecution for the government, leading to additional asset recovery.

7. Private investigation. The criminal investigation only focuses on the criminal law violations and activity. It does not specifically look at the financial activity directly, only as it relates to crimes. A professional private investigation has the latitude to look at activity beyond just the criminal to locate assets and other parties with liability. The investigation may also suggest new legal theories of asset discovery for attorneys, such as constructive trusts or fraudulent transfers. Investigations often turn up previous similar crimes perpetrated by the defendants.

8. Plea types. A successful case disposition against the defendant may have no benefit to victims. A guilty plea can be entered under the Alford doctrine (or Kennedy plea). In this scenario the fraudster says the he or she did NOT commit the crime, but acknowledges that the government may be able to prove they did. It is used specifically to avoid civil liability for criminal actions. Even a plea of nolo contendre can be neutral to civil asset recovery. The defendant is not saying that they committed a crime or not, just that they are not fight prosecution. They are free to fight civil recovery at a later date. An Alford or nolo contendre may not always offer estoppel against future civil claims, but it does end the criminal investigation. The disadvantage for victims is that they now have to start over with their asset recovery case, without the benefit of an investigation which has been in process during the criminal trial.

radar19. Scope of crimes. There are many instances where a private investigation discovers that the scope of crimes is greater than the original indictment. Charges can be upgraded or refiled based on new evidence developed, or when the scale of financial losses is found to be greater. A private investigation of fraud can reveal this since the district attorneys case can be limited by budget, time or other case load. This is common even prior to arrest. We have seen many fraud cases presented to law enforcement where the original arrest was not made due to the perception that the events were a civil matter. Once a private investigation revealed that crimes were committed, and represented to the government the criminal prosecution began.

10. Restitution. An agreement to provide restitution in a plea agreement or even in sentencing from a guilty verdict may not be as valuable to victims as believed. A restitution agreement may cap the amount lower than what could be claimed in a civil case, and it them limits victims from pursuing higher amounts. The prosecution may set the amount based on visible factors such as ability to repay, and perceived losses. A more complete private investigation can reveal that there is more available for recovery than the government discovered in an initial investigation. Criminals are known to manipulate the picture available to criminal prosecutors, who may not have accounting and financial experts as resources.

Bonus #1. Support criminal case. A concurrent civil investigation can suggest discovery in the criminal case. Records, testimony, depositions, and affidavits can be taken in a criminal case and potentially used in the civil asset recovery. The private investigation can uncover details for the criminal case which can be pursued in the criminal trial. Some of this evidence may not be available for discovery unless initially sought during criminal trial. For example, a banker can object to providing an affidavit of activity in a civil case, but may be compelled to do so in a criminal trail against a client.

Bonus #2. Related crimes. Supporting crimes can provide sources of asset recovery for victims. If a fraudster files bankruptcy, any assets hidden from the trustee exposes the claimant to charges of bankruptcy fraud. If this charge is included in a plea agreement, it makes it more difficult to pursue those assets. The same holds true for tax evasion. Rolling these charges into a final plea insulates a defendant against prosecution for prior actions.

The prosecutors office represents the state or federal government, to enforce laws. It does not specifically represent the victims of a crime. While their efforts are responsive to victims, their efforts can be limited due to the priorities of prosecuting and obtaining sentencing percentages. Private investigators and an expert legal team represents the victims directly, protecting their rights and supporting the specific outcome of recovering assets. Many times prosecutors will press harder for deeper convictions when they see victims fighting back.

A restitution ruling is not a new asset for the victim. It is simply another form of a debt owed. As a victim, you already have a penniesdebt owed. The government does not represent a better method of recovery. It may be a potential “collection” method only. Asset recovery is separate from collections. Collection efforts are a form of begging a debtor to voluntarily give up some of their money. Fraudulent debtors already have proven that they do not do this.

Asset recovery professionals do not look to beg money from a debtor. They look at the cash as already belonging to their client, the creditors. It is simply just temporarily located in the hands of the debtor. Asset recovery is actively seizing that money back. Asset recovery specialist is a repo man for victims money.

In addition to getting the victims money back, this serves the purpose of taking power from the fraudsters. It removes their ability to fund their criminal defense, and takes away startup capital to start a new scheme later when the dust is settled on their  case. Fighting to get all of the assets back may actually prevent future victims of the fraudster.

It is easy to think of just writing off the losses and not fighting back. The fraudster is counting on that to keep their criminal punishment to a minimum, and retaining as much cash as they can. The third parties who enabled the fraud are counting on the losing parties to be victims again, so that they can live to scam again.

In fact, fraudsters survive because they count on victims to be passive and not take the extra effort of initial due diligence and investment monitoring. Waiving the asset recovery investigation is just the extension of this philosophy which empowers the fraudster, and lets their third party colleagues get off Scott free.

Some investors in the infamous Bernie Madoff case elected to allow the bankruptcy case to complete before going after third parties. In one instance there was a $2 million claim against a “feeder fund” financial institution which was dismissed with prejudice because it had gone beyond the allowable time for arbitration through FINRA.

It is prudent to be cautious with future expenditures on fraud claims. However, remember that investigators and attorneys are not equal to the people who took your money. The are licensed, dedicated advocates who work for you, not just money shufflers make money from nothing. Investigative expense may be tax deductible and victims may be able to claim investigative expenses as additional damages from the fraud.