2Learning ObjectivesDiscuss theft investigation methods and how they are used to investigate suspected fraud.Understand how to coordinate an investigation, using a vulnerability chart.Describe the nature of surveillance and covert operations.Understand the effectiveness of invigilation to investigate fraud.
3Learning ObjectivesExplain how to obtain physical evidence and how it can be used in a fraud investigation.Understand how to seize and analyze electronic information from cell phones, hard drives, , and other sources.Use trash and other social engineering methods to investigate fraud.
4Fraud Investigation Methods Theft Investigative MethodsSurveillance and covert operationsInvigilationSeizing and searching computersPhysical evidenceConcealment Investigative MethodsDocument examinationAuditsElectronic searchesPhysical asset countsConversion investigative MethodsSearching public recordsOnline resourcesThe net worth methodInquiry Investigative MethodsInterviews and interrogationHonesty testing
5Theft Act Investigative Methods Methods that directly investigate the fraud actExamples:Surveillance and covert operationsInvigilationObtaining physical evidenceGathering electronic evidence
6Theft Act Investigative Methods The three types of surveillance:stationary or fixed pointRecord events occurring at a sceneLog includes time, place, and eventsmoving or tailingFollowing the suspectShould only be done by professionalselectronic surveillanceVideo camera
7Theft Act Investigative Methods Invigilation Involves close supervision of suspects during an examination period Strict temporary controls are implemented so that committing fraud is almost impossible
8Theft Act Investigative Methods Physical EvidenceInvolves analyzing objects such as:inventory, assets, and broken lockssubstances such as grease and fluidstraces such as paints and stainsimpressions such as cutting marks, tire tracks, and fingerprints or searching computers
9Theft Act Investigative Methods Steps to Gather Electronic EvidenceSecure the device and perform initial tasksClone the device and calculate a CRC checksumSearch the device manuallySearch the device using automated proceduresvice and perform initial tasks
10Theft Act Investigative Methods Systems Many copies may exist (sender, receiver, server) Includes text messaging in certain countries Web-based (Hotmail, GMail, Yahoo! Mail) is more difficult to search