Business email compromise
£640K recovered
A supplier invoice was intercepted and re-issued with altered bank details.
- Client
- Spanish construction group
- Location
- Madrid, Spain
- Case duration
- 5 weeks
- Lead agent
- Elena Marchetti
Full client summary
The attacker maintained mailbox access for six weeks before striking. We secured the mail environment, traced the funds to two accounts in a neighbouring jurisdiction, and recovered the bulk through a rapid freeze request.
Case timeline
- 1
Intake & evidence
Mailbox audit logs preserved and the intrusion window established.
- 2
Tracing
Both receiving accounts identified within 24 hours of the report.
- 3
Freeze & claim
Freeze order obtained before the second withdrawal cleared.
- 4
Recovery
Funds returned and email controls hardened.
Outcome
£640K recovered
Amount involved: £640K · Closed in 5 weeks · 2024
Verification & compliance
Standards our case work is held to
AML / KYC compliant
Anti-money-laundering procedures on every file
GDPR data handling
EU-standard confidentiality and data protection
ISO 27001 aligned
Information-security controls for case evidence
Certified fraud examiners
Accredited investigators leading each case
Registered in Austria
Vienna-based office, established 2021
Encrypted intake
All submissions transmitted over secure channels