Fraud Indicators Are Not Evidence: How Investigators Turn Red Flags into Defensible Findings
A fraud indicator can identify where risk may exist. It cannot, by itself, establish what happened, who was responsible or whether conduct was dishonest. The professional task begins after detection: developing hypotheses, testing alternative explanations, corroborating information and reaching a finding no stronger than the evidence permits.
Key Points
- A fraud indicator is a reason for attention, not proof of fraud.
- Detection systems identify anomalies, patterns and relationships; investigators must determine what those observations mean in context.
- Strong investigations move through a disciplined progression: Indicator → Hypothesis → Enquiry → Corroboration → Evidence → Assessment → Finding.
- Corroboration should add genuinely independent evidential value. Multiple sources repeating the same underlying allegation do not necessarily constitute independent corroboration.
- Investigators should distinguish observable facts from inference, analytical judgement and assumption.
- Competing explanations matter. An investigation designed only to prove the original allegation is vulnerable to confirmation bias.
- AI and advanced analytics can improve the speed and scale of detection, but sophistication of detection does not transform an algorithmic output into evidence of culpability.
- A defensible investigation should explain not only what supports its conclusion, but what alternative explanations were considered and why they were accepted or rejected.
 |
| Featured visual. Fraud indicators are not evidence: suspicious activity may identify where an investigation should begin, but defensible findings require enquiry, corroboration, evidence and reasoned assessment. |
Introduction
A payment just below an approval threshold. A newly opened account receiving multiple transfers. An employee who consistently avoids taking leave. An invoice that does not match its supporting documentation. A customer whose transaction behaviour suddenly changes. An investment promising unusually high returns. Each may be a legitimate fraud indicator. None, by itself, proves fraud.
That distinction is fundamental to effective fraud investigation. Modern organisations can detect anomalies at extraordinary scale through rules-based monitoring, data matching, behavioural analytics, transaction monitoring, network analysis, machine learning and artificial intelligence. The expansion of detection capability is important, but it also creates an investigative risk: the greater the apparent sophistication of the system generating a signal, the easier it can become to give the signal more evidential weight than it deserves.
Detection and proof answer different questions. An alert may establish that activity differs from a rule, baseline, peer group or expected pattern. An investigative finding requires considerably more. The investigator may need to establish context, chronology, relationships, source reliability, control of accounts or devices, representations made, movement of funds, competing explanations and, depending on the allegation, evidence relevant to knowledge, intention or dishonesty.
The Public Sector Fraud Authority's Standard for Fraud Detection Practitioners places detection within a wider counter-fraud response and describes the discipline as using systems, strategies, data techniques and analysis to identify fraud. The complementary Government Counter Fraud Profession Standard for Fraud Intelligence Practitioners addresses the evaluation and development of information, intelligence analysis, dissemination and the movement of intelligence towards investigation. Together, these functions reinforce an important investigative distinction: identifying activity that warrants attention is not the same as establishing what that activity means.
The same distinction is important in scam advertising network analysis. A suspicious advert may justify preservation, enrichment and connection to wider infrastructure, but the advert itself should not automatically be treated as proof of the complete fraud proposition. The same principle applies more broadly to alerts, behavioural anomalies, network associations and other red flags: they may provide a reason to investigate, but their significance must still be tested.
The principle is straightforward: suspicion determines where an investigator should look. Evidence determines what an investigator can responsibly conclude.
The Evidential Gap Between an Indicator and a Finding
A fraud indicator is a fact, behaviour, transaction, relationship or anomaly associated with an elevated possibility of fraud. It can arise from transaction data, complaints, whistleblowing, intelligence, document examination, audit findings, customer behaviour, network analysis or automated detection. In transaction monitoring, this distinction becomes particularly important because an automated alert identifies activity for attention but does not establish what that activity means, a distinction examined further in The Alert Is Not the Investigation.
In financial activity, indicators might include rapid movement of funds through multiple accounts, transactions inconsistent with known customer behaviour, repeated payments immediately below authorisation thresholds, unexplained changes in beneficiaries, multiple accounts sharing identifiers or sudden high-value activity. Procurement indicators might include duplicate invoices, unexplained supplier changes, unusual contract amendments or repeated awards involving connected businesses. Internal-fraud indicators may include attempts to bypass controls, unexplained system access or resistance to segregation of duties.
Describing these observations as indicators is deliberate. An indicator raises a question; it does not answer it.
Consider repeated payments immediately below an approval threshold. Deliberate invoice splitting is one possible explanation, but so are contractual payment arrangements, automated billing rules, legitimate purchasing patterns, system configuration or coincidence. The investigator's task is therefore not simply to recognise the pattern but to determine which explanation is supported when the surrounding evidence is examined.
The same principle applies to technology-generated alerts. A new device, unusual geographic location, high-value transfers and a newly created beneficiary may collectively justify urgent examination of an account. They do not independently establish that an account has been taken over or that the customer is participating in fraud. The customer may be travelling, may have replaced a device, may be buying property or may be transferring funds between accounts under their control.
This is why a red flag is best understood as a hypothesis generator. As examined previously in From Fraud Alert to Investigative Intelligence, the investigative value of an alert lies not simply in what caused it to fire, but in whether it can be developed through context, enquiry and corroboration into intelligence capable of supporting a defensible decision.
The danger begins when investigators or decision-makers jump directly from observation to conclusion: an anomaly becomes proof, a risk score becomes attribution, or an association becomes evidence of knowing participation.
From Indicator to Investigative Hypothesis
A disciplined investigation converts suspicious information into a proposition capable of being tested rather than allowing the indicator itself to become the conclusion. The initial signal may identify a transaction, behaviour, relationship or inconsistency requiring explanation, but it rarely establishes why the activity occurred. An investigative hypothesis gives that uncertainty structure by stating an explanation that subsequent enquiries can support, weaken or refute. It should therefore be sufficiently specific to guide enquiry while remaining capable of changing as new information emerges. The purpose is not to construct the most incriminating explanation available, but to identify propositions that can be tested against evidence.
Suppose repeated supplier payments appear immediately below a threshold requiring additional approval. One reasonable hypothesis is that the payments were deliberately structured to circumvent financial controls, particularly if their timing, values or approval history suggest intentional fragmentation. That explanation should generate specific enquiries into invoices, contracts, payment instructions, approval records, communications and the chronology of the transactions. Professional scepticism, however, should operate in more than one direction: legitimate contractual arrangements, automated billing processes, system configuration, administrative error or other credible circumstances might produce a similar pattern. The investigative task is therefore to identify what evidence would materially distinguish deliberate circumvention from those competing explanations.
The stronger question is not “What evidence proves my allegation?” but “What explanation best accounts for the available evidence, and what enquiry would materially distinguish between the credible alternatives?” The difference is more than linguistic because each formulation creates a different investigative posture. The first encourages the investigator to search for information consistent with a conclusion already assumed, while the second requires evidence to discriminate between competing propositions. That distinction also makes refutation analytically valuable: information that weakens the original hypothesis is not wasted investigative effort but evidence capable of improving the accuracy of the assessment. An allegation should therefore provide the starting proposition for enquiry, not silently become its premise.
The Crown Prosecution Service's guidance on digital material and reasonable lines of enquiry provides a useful professional principle even beyond digital investigations: investigative activity should have an identifiable foundation rather than rest on conjecture or speculation. A reasonable line of enquiry should address something material to the case and have a defensible relationship to the proposition being examined. Investigators should therefore be able to explain not only what information they are seeking, but what investigative question that information is intended to answer. This becomes particularly important where large volumes of financial, communications, device or open-source data are available, because technical accessibility can encourage collection without analytical purpose. The ability to obtain more information should not be confused with a reason for obtaining it.
The principle becomes particularly important in APP fraud investigation, where apparently successful authentication may establish that a payment passed specified controls without resolving the wider questions of deception, customer understanding, payment intent or the circumstances in which the transaction was authorised. Similarly, the distinction between authentication and attribution matters when examining account takeover because evidence that a device, credential or authentication method was successfully used does not necessarily establish who exercised effective control at the relevant time. In both situations, the technical event is evidence of something, but the investigator must define precisely what it establishes before drawing a broader conclusion from it. Further enquiries may be required to reconstruct chronology, device control, communications, behavioural change and other evidence capable of distinguishing between competing explanations. The investigative hypothesis determines which of those enquiries are material rather than allowing every available data point to acquire equal significance.
More data is therefore not automatically better investigation. An enquiry should have a defined analytical purpose: to establish a material fact, test an inference, corroborate information, challenge an assumption or discriminate between credible explanations. Evidence that does not change the interpretation of any material proposition may add volume without adding meaningful investigative value. Conversely, a relatively small piece of independent information may substantially change the assessment if it confirms or refutes a critical element of the hypothesis. Investigative quality should therefore be judged less by how much information has been accumulated than by how effectively the enquiries reduce material uncertainty.
Corroboration: More Information Is Not Necessarily More Evidence
Corroboration is one of the most important steps between suspicion and a defensible investigative finding, but it should not be confused with accumulating information that points in the same direction. Additional records, reports or analytical outputs may increase the apparent volume of support for a proposition without materially increasing confidence that the proposition is correct. The investigator therefore needs to consider not only whether another source supports the hypothesis, but where that information originated, how reliable it is and whether it adds genuinely independent evidential value. Corroboration becomes stronger when different sources establish different material aspects of the proposition or independently support the same fact without deriving from a common origin. The analytical task is consequently to understand the provenance and contribution of each source rather than count how many sources appear to agree.
Suppose a whistleblower alleges that an employee is diverting company payments to a business controlled by a relative. The allegation is information and provides a legitimate basis for preliminary enquiry, but it may be entirely accurate, partially accurate, mistaken or deliberately misleading. Investigators should therefore separate the propositions contained within the allegation and identify what evidence could independently test them. Corporate records might assist in establishing ownership or control of the recipient business, while payment records could establish whether company funds actually reached it and approval records could identify who authorised the transactions. The allegation becomes evidentially stronger not because it has been repeated, but because material elements of it have been independently tested.
Relevant enquiries might include company-ownership records, payment information, procurement documentation, approval records, communications, system logs, interviews and bank information obtained through appropriate legal processes. Open-source intelligence can also contribute where publicly available information assists in identifying relationships, corporate interests, addresses, digital infrastructure or other independently verifiable facts. Different sources may answer different investigative questions: corporate information may establish a formal relationship, transaction records may establish movement of value, communications may illuminate knowledge or purpose, and system logs may assist with attribution or chronology. Their evidential value should therefore be assessed according to what each source actually establishes rather than whether it appears generally consistent with the allegation. A collection of mutually consistent information is most useful when investigators can explain how its constituent parts contribute independently to the developing hypothesis.
The Government Counter Fraud Profession's Fraud Intelligence Practitioner Standard places importance on recording, evaluating, developing and analysing fraud information. That discipline matters because apparent corroboration can be misleading where several sources derive from the same underlying information. Three reports may appear to provide three independent accounts, yet all may ultimately repeat the same allegation, reproduce information from the same database or rely on a common unidentified source. Treating them as separate corroboration can create false confidence by multiplying the appearance of evidential support without increasing its independence. Investigators should therefore trace provenance far enough to determine whether apparently separate sources genuinely add new information.
Corroboration should also be capable of weakening or refuting an investigative hypothesis rather than operating only as a search for supporting material. A company record might confirm the alleged family relationship while transaction evidence shows that the payment was contractually justified and consistent with comparable suppliers, materially changing the significance of the original allegation. Equally, an interview may appear to support a hypothesis until contemporaneous records contradict a material part of the account. Evidence that challenges the original proposition is therefore not a failure of corroboration; it is part of the process through which the reliability of that proposition is tested. A defensible investigation should be able to explain both the information that strengthened its assessment and the information that weakened, qualified or redirected it.
Volume is therefore not the same as corroboration. Ten indicators derived from the same underlying transaction, identifier, allegation or dataset do not automatically provide ten independent reasons for believing a proposition. Investigators should ask what each additional source establishes, whether it is genuinely independent, how reliable it is, whether its provenance can be understood and whether it materially changes the evidential assessment. This is particularly important in data-led investigations, where multiple systems may generate different alerts from overlapping information and create an impression of independent confirmation. The strength of corroboration lies not in the number of signals pointing towards a conclusion, but in the quality, independence and relevance of the evidence capable of testing it.
Evidence, Inference and Assumption
A defensible investigation requires a clear separation between what the evidence establishes, what can reasonably be inferred from it and what remains assumption. These categories can easily become blurred because investigators rarely work with evidence that explains itself; transactions, relationships, communications and technical records usually require interpretation before they acquire investigative meaning. The risk arises when that interpretation is presented as though it were an observed fact, allowing an inference to acquire evidential weight it has not independently earned. Investigative reports should therefore make the reasoning between evidence and conclusion visible rather than compressing the two into a single proposition. This distinction is central to determining how far the available evidence can responsibly support a finding.
Consider an investigation that establishes that £48,500 was transferred from Company A to Company B, that Company B is controlled by the procurement manager's brother and that the procurement manager approved the transaction. Those propositions may be established through transaction records, corporate information and approval data, and together they may reasonably support an inference that the relationship is relevant to the payment. They do not, however, establish by themselves that the procurement manager fraudulently diverted £48,500 or that the payment lacked a legitimate commercial purpose. The evidential significance of the relationship depends on what further enquiry establishes about the transaction, the parties and the surrounding circumstances. A potentially important connection has been identified, but the explanation for that connection remains an investigative question.
The next enquiries should therefore test the competing explanations rather than simply accumulate additional suspicious facts. Investigators might establish whether the relationship was declared, whether goods or services were actually supplied, whether the price was commercially reasonable, who selected the supplier and whether the manager was required to disclose the connection. Communications may help determine whether the relationship influenced the procurement decision, while comparable transactions can show whether the payment departed materially from legitimate organisational practice. The manager's explanation should also be tested against independently available records rather than accepted or rejected merely because the underlying transaction appears suspicious. Each enquiry should narrow the gap between what is known and what is being inferred.
This distinction becomes particularly important in data-led and network investigations. A shared address may establish an association, a common device may establish a technical connection and a transfer may establish movement of value, but none of those observations necessarily explains the relationship represented by the data. Investigators may still need to establish who controlled the device, why the parties shared an address, what economic purpose explained the transfer and whether the relevant actors knew of or participated in the activity under investigation. Multiple connections can strengthen an investigative hypothesis, but network density should not be mistaken for evidential weight where the meaning of those connections remains unresolved. The analytical question is therefore not simply whether two entities are connected, but what the available evidence establishes about the nature, timing and significance of that connection.
The investigator should continually ask: What does this evidence establish—and what am I adding through inference? That question does not prohibit analytical judgement; investigation necessarily requires reasoned inference from incomplete and sometimes fragmented information. Its purpose is to make the reasoning visible so that another practitioner can distinguish established fact from interpretation, identify the assumptions on which the assessment depends and determine whether the conclusion goes further than the evidence permits. A defensible report should therefore explain not only the conclusion reached, but the evidential steps through which it was reached and any material uncertainty that remains. The strength of an investigative conclusion depends not on eliminating inference, but on ensuring that inference is identifiable, reasoned and proportionate to its evidential foundation.
These distinctions become clearer when applied to documented cases. Published enforcement and prosecution outcomes can show how suspicious transactions, relationships or representations acquire greater evidential significance when tested against independent records, financial evidence, communications and other corroborating material. They also demonstrate why an apparently compelling indicator should not be required to prove an allegation on its own. The analytical value of a case study lies in examining how different evidence sources answer different investigative questions and progressively strengthen, weaken or reframe the original hypothesis. The following cases therefore illustrate the movement from suspicion towards findings capable of being explained and defended, rather than suggesting that any individual red flag is inherently determinative.
Case Evidence: When Independent Records Change the Investigation
Bounce Back Loan Fraud: Testing Representations Against Records
In March 2025, the Crown Prosecution Service reported the sentencing of Craig Gibson, who had fraudulently obtained two COVID-19 Bounce Back Loans worth more than £95,000. At the detection stage, information contained in loan applications, declared turnover or the subsequent movement of funds could have generated suspicion, but none of those observations needed to carry the evidential conclusion alone. The investigation could instead test the representations underlying the applications against information capable of independently establishing whether those representations were consistent with reality. HMRC records showed that Gibson's company was not trading during the relevant period, providing an external evidential basis against which information supporting the loan applications could be assessed. The CPS also reported that much of the money from one loan was transferred to Gibson's personal account and subsequently used for third-party payments or cash withdrawals.
The investigative significance lies in the progression from identifying potentially suspicious circumstances to testing specific propositions against independent evidence. Rather than treating unusual financial behaviour as proof of fraud, investigators could compare representations about the business with records concerning its actual trading position and examine what happened to the funds after they were obtained. Those evidence sources answered different questions: HMRC information assisted in testing the factual basis underlying the application, while transaction evidence helped establish the subsequent movement and use of the loan proceeds. Considered together, they provided a stronger evidential picture than either an anomalous application or unusual transaction pattern could have provided in isolation. A discrepancy becomes materially stronger when an investigator can establish what should have been true and compare it with reliable evidence of what was actually true.
Investment Fraud: Professional Appearance Is Not Evidence of Legitimacy
The same evidential principle operates where the initial information appears reassuring rather than suspicious. The Financial Conduct Authority's prosecution of Raymondip Bedi and Patrick Mavanga concerned a £1.5 million cryptocurrency investment fraud affecting at least 65 investors, in which consumers were cold-called and directed to a professional-looking website offering high returns from fake crypto investments. Cold calling, promises of high returns and cryptocurrency investment propositions can provide reasons for heightened scrutiny, but those characteristics do not establish fraud by themselves. Equally, a polished website can create an appearance of legitimacy without establishing that the underlying business, investment or representations are genuine. The investigative problem is therefore symmetrical: suspicious appearance is not proof of fraud, just as professional appearance is not proof of legitimacy.
The investigation had to move beyond presentation to evidence of what the participants had actually done. Bedi pleaded guilty to offences including conspiracy to defraud and money laundering, while Mavanga pleaded guilty to conspiracy to defraud and possession of false identification documents; the FCA also reported that Mavanga was subsequently convicted of perverting the course of justice after deleting phone-call recordings. Those outcomes demonstrate why investigators should distinguish the characteristics that attract attention from the evidence ultimately capable of supporting findings about conduct. A website, investment proposition or communication may form part of the evidential picture, but its significance depends on how it connects with representations, financial activity, documentation, communications and other evidence developed during the investigation. Presentation creates an impression; investigation establishes what sits behind it.
Confirmation Bias: When the Investigator Becomes Part of the Risk
Fraud investigations often begin with an allegation, alert or intelligence report that already frames particular conduct as suspicious. That starting point is unavoidable, because investigators need an initial proposition to determine what should be examined and which enquiries may be relevant. The risk arises when the initial proposition stops functioning as a hypothesis and begins to control how subsequent information is interpreted. Evidence consistent with the allegation may then receive greater weight, while contradictory information is discounted, ambiguous behaviour is interpreted adversely and alternative explanations receive insufficient attention. Confirmation bias therefore becomes an investigative risk when the enquiry is organised around proving the original suspicion rather than determining which explanation is best supported by the available evidence.
The problem can become more pronounced once a person, account, company or transaction has been categorised as suspicious. Subsequent information may be interpreted through that label, even where the same information could support more than one explanation. An investigator might pursue communications that appear incriminating while giving less attention to records capable of providing legitimate context, or interpret an inconsistency as deception without first examining whether error, misunderstanding or incomplete information provides a credible explanation. This does not mean that incriminating evidence should be discounted or that every alternative explanation deserves equal weight. It means that evidential weight should arise from the quality and relevance of the information rather than from its consistency with the investigator's starting theory.
The solution is not to eliminate investigative hypotheses, because disciplined investigation depends on them. A hypothesis gives structure to enquiry by identifying a proposition that can be tested, corroborated, weakened or refuted as additional information becomes available. The critical distinction is between using a hypothesis to organise investigation and allowing it to predetermine the outcome. Investigators should therefore remain capable of revising or abandoning their original explanation when the evidence develops in a different direction. A hypothesis that cannot realistically be disproved has ceased to function as a meaningful investigative proposition.
Two questions provide a useful challenge to the developing assessment: if my current theory is wrong, what would I expect the evidence to look like, and what information would cause me to change my assessment? The first requires the investigator to consider what evidence might reasonably exist under a competing explanation rather than examining the case only through the suspected wrongdoing. The second tests whether the investigative hypothesis remains genuinely open to refutation. If no realistically obtainable information could cause the assessment to change, the investigation risks moving from testing a proposition to protecting a conclusion. These questions are particularly valuable before significant escalation, adverse findings or final disposition because they expose assumptions that may otherwise remain hidden within the investigative reasoning.
Alternative explanations should therefore be identified and tested where they are credible, material and capable of affecting the investigative conclusion. This does not require investigators to manufacture implausible innocent explanations for every suspicious fact, nor does it require equally weighting explanations that are poorly supported by the evidence. Professional scepticism should operate in both directions: suspicious conduct should be tested rather than presumed fraudulent, while explanations offered for that conduct should themselves be examined against independent information where possible. The final assessment should explain which material alternatives were considered, what enquiries were undertaken to distinguish between them and why particular explanations were accepted, rejected or remained unresolved. A defensible investigation is strengthened not because it considered every imaginable explanation, but because it tested the credible alternatives capable of changing its conclusion.
AI, Analytics and the Automation of Suspicion
Artificial intelligence and advanced analytics make the distinction between indicator and evidence even more important. Fraud-detection systems can identify anomalies, behavioural changes, unusual relationships, transaction patterns, clusters and correlations across datasets too large for conventional manual review, while the PSFA's Fraud Detection Practitioner Standard places systems, data techniques and analysis within modern fraud-detection capability. As explored in Fraud Analytics Explained, these techniques can improve the identification and prioritisation of suspicious patterns, reveal relationships an investigator might otherwise never encounter and detect behavioural changes quickly enough to support preventative action. Their investigative value lies in increasing the organisation's capacity to identify activity requiring attention, not in resolving automatically what that activity means. The more sophisticated the analytical output appears, the more important it becomes to avoid confusing confidence in detection with confidence in an evidential conclusion.
That distinction becomes operationally important when an analytical system assigns a transaction a very high fraud-risk score. The score may justify urgent intervention, prioritisation or investigation, depending on the operating context, but its numerical precision does not itself establish fraud. Investigators should understand, as far as reasonably possible, what information contributed to the output, whether the underlying data is reliable, what behaviour the system was designed to detect and whether known limitations apply. They should also consider whether legitimate activity could produce a similar pattern and what additional information would materially distinguish between competing explanations. Analytical sophistication can strengthen detection without, by itself, establishing evidential sufficiency.
This principle becomes even more important with network analytics. A model may identify that one account sits close to accounts previously associated with fraud. The connection could be highly significant, but its meaning depends on what the edge actually represents: shared device use, common beneficiary information, an address, telephone number, IP infrastructure, funds flow or another relationship. In suspected laundering activity, link analysis in money-laundering investigations can extend that enquiry by revealing relationships across accounts, people, companies, beneficiaries and other infrastructure, while leaving the significance of those connections to be tested through corroboration, refutation and alternative explanation.
The same evidential discipline becomes even more important with network analytics. A model may identify that one account sits close to accounts previously associated with fraud, and that connection may be highly significant. Its meaning, however, depends on what the edge actually represents: shared device use, common beneficiary information, an address, telephone number, IP infrastructure, funds flow or another relationship. In suspected laundering activity, link analysis in money-laundering investigations can extend that enquiry by revealing relationships across accounts, people, companies, beneficiaries and other infrastructure, while leaving the significance of those connections to be tested through corroboration, refutation and alternative explanation. Proximity is not automatically participation, because identifying a relationship does not by itself establish common control, knowledge, coordination or criminal purpose.
Similarly, a synthetic identity may contain multiple apparently credible attributes. As examined in Synthetic Identity Fraud, successful verification of individual attributes does not necessarily establish that those attributes belong to one genuine person. The investigative task is to test coherence, control, history and relationships rather than allowing the accumulation of plausible indicators to substitute for identity attribution. The same reasoning applies when multiple analytical outputs appear mutually reinforcing: investigators should determine whether they provide genuinely independent information or merely express different consequences of the same underlying data. Ten indicators derived from one compromised identifier do not necessarily provide ten independent pieces of corroboration.
Technology therefore changes the scale and speed at which suspicion can be generated, but it does not abolish the need to determine what the underlying information means. Automated systems can identify patterns across millions of transactions, prioritise cases, surface relationships and expose behaviour that would be difficult for an investigator to discover manually. Those capabilities can materially improve detection, yet the resulting output still needs to be translated into an investigative proposition capable of being tested against context, chronology, provenance, alternative explanations and independent evidence. Where the system cannot explain why activity was selected, investigators should understand the relevant inputs and limitations sufficiently to avoid treating an unexplained score as an evidential conclusion. Automation can prioritise suspicion, but it cannot automatically establish culpability.
Why the Distinction Matters Legally
The distinction between suspicious behaviour and evidence becomes particularly important when an investigation may contribute to a legal, regulatory, disciplinary or other formal decision. An indicator can identify conduct requiring examination, but it does not necessarily establish the elements that the relevant decision-maker must determine. Investigators therefore need to understand what propositions are material to the particular process and what evidence is capable of supporting or challenging them. The same transaction may be relevant to several different enquiries while carrying different significance in each. Evidential sufficiency must therefore be assessed against the question actually being decided rather than against the apparent seriousness of the original suspicion.
Under the Fraud Act 2006, fraud may be committed through false representation, failure to disclose information where there is a legal duty to disclose, or abuse of position. The statutory framework requires more than identifying an unusual transaction or suspicious pattern because the relevant offences include requirements concerning dishonesty and intention to make a gain, cause a loss or expose another to a risk of loss. A transaction-monitoring alert, unexplained payment or behavioural anomaly may provide an important investigative starting point without establishing those elements. The investigation must therefore move from identifying suspicious conduct to determining what the available evidence establishes about the relevant representation, duty, position, knowledge, belief, intention and surrounding circumstances. The precise enquiries required will depend on the suspected conduct and the legal proposition being examined.
An alert may, for example, identify the transaction around which an investigation develops, while leaving fundamental questions of attribution and intent unresolved. Transaction records may establish that money moved, system records may establish that particular credentials were used and corporate records may identify relationships between relevant parties. Those facts can carry substantial evidential weight without necessarily establishing who exercised effective control, what a person knew, why the transaction occurred or whether the conduct was dishonest. Investigators should therefore resist collapsing the existence of the transaction, the attribution of responsibility and the assessment of state of mind into a single conclusion. Each proposition should be supported to the extent required by the evidence available and the decision for which the investigation is being conducted.
Not every organisational fraud investigation, however, is conducted to determine whether a criminal offence can be proved. Employment, regulatory, civil, disciplinary, intelligence and internal-control processes may apply different legal or organisational frameworks, evidential thresholds and decision criteria. Conduct that cannot support a criminal conclusion may nevertheless reveal a policy breach, control weakness, regulatory concern or intelligence value, while information sufficient for an internal decision may not be sufficient for criminal proceedings. Investigators should therefore avoid importing a criminal standard into a process where it does not apply, just as they should avoid lowering the evidential requirements of a decision merely because the underlying behaviour appears suspicious. The applicable framework should determine what must be established and how far the available evidence permits the decision-maker to go.
The central principle is that the finding must match both the evidence and the decision being made. Investigators should be able to explain what has been established, what remains inference, which material elements have or have not been supported and what uncertainty remains unresolved. Where the evidence supports only a limited conclusion, the finding should remain limited rather than filling evidential gaps with the strength of the original suspicion. Conversely, an investigation that does not establish fraud may still produce important intelligence about vulnerabilities, relationships or control weaknesses without representing those observations as proof of criminal conduct. A defensible finding is therefore not simply one supported by substantial information; it is one calibrated to the evidential requirements of the particular decision it is intended to inform.
When an Indicator Should Not Become a Full Investigation
Investigative discipline includes knowing when escalation is justified and when proportionate enquiry supports a different disposition. Fraud functions operate with finite investigative capacity, and treating every alert, anomaly or intelligence report as requiring a full investigation can consume resources without materially improving understanding of risk. Some indicators can be resolved through preliminary enquiries, while others may reflect legitimate activity, administrative error, duplicated information, matters already investigated or intelligence that cannot presently be developed through proportionate investigative steps. The relevant question is therefore not whether an indicator appears suspicious enough to deserve attention, but whether further investigation is reasonably capable of establishing something material to the allegation, risk or decision being considered. A decision not to escalate should consequently reflect an assessment of the available information rather than the absence of an immediately obvious case theory.
Triage should examine the indicator in context, including the potential harm, credibility and reliability of the information, available corroboration, vulnerability, value at risk, recurrence, network significance and any applicable legal or regulatory obligations. Investigators should also consider whether further enquiries are likely to produce information capable of materially strengthening, weakening or reframing the investigative hypothesis. Network significance can be particularly important because an apparently low-value event may acquire greater intelligence value when connected to recurring beneficiaries, shared infrastructure, related accounts or a wider pattern of activity. Conversely, an indicator that remains weak after proportionate enrichment, reveals no material relationships or higher-harm context and is adequately explained by credible alternative circumstances may properly be deprioritised. Proportionality therefore requires more than ranking alerts by their initial apparent severity; it requires an assessment of what additional investigative effort is reasonably likely to establish.
Closing an alert after proportionate enquiry is not necessarily a failure of detection, just as retaining information for intelligence purposes without opening a full investigation is not necessarily inaction. A matter may be closed, monitored, retained as intelligence, referred, escalated or reopened later if new information materially changes the assessment. What matters is that the disposition can be reconstructed: what was known, what enquiries were undertaken, what explanations were considered, what remained uncertain and why the selected outcome was proportionate to the information available at the time. This also preserves the ability to reconsider apparently minor activity when later intelligence reveals recurrence, common infrastructure or relationships that were not previously visible. The important distinction is therefore between reasoned disposition and unexamined dismissal.
From Defensible Findings to Organisational Intelligence
A well-conducted investigation should produce more than a decision about a single allegation. Investigative findings can reveal new fraud typologies, control weaknesses, emerging behavioural patterns, previously unknown relationships, vulnerabilities in customer journeys and weaknesses in verification processes. They can also show which indicators were genuinely predictive, which appeared significant but proved weak, and which information was most useful in distinguishing suspicious activity from legitimate behaviour. That learning has value beyond the individual case because it can improve how future activity is detected, prioritised and investigated. The investigative outcome therefore becomes an intelligence input rather than merely a case closure.
This creates a wider intelligence cycle:
Detection → Investigation → Finding → Learning → Improved Detection
The value of this cycle depends on whether investigative learning is actually converted into changes in detection and control design. A defensible finding may identify a previously unknown beneficiary, device identifier, address, intermediary, document template or laundering route that subsequently becomes relevant to other alerts or investigations. Apparently unrelated cases may then become connected through infrastructure or behavioural patterns that were invisible when each case was considered independently. Conversely, an investigation may establish that an indicator previously regarded as suspicious frequently occurs in legitimate activity, reducing its value as a discriminator of fraud. In both circumstances, the investigation produces intelligence capable of changing how the organisation interprets future signals.
The feedback process should therefore include both positive and negative investigative learning. Confirmed or strongly supported findings can expose relationships, behaviours and control weaknesses that justify new detection logic, investigative enrichment or closer monitoring, while refuted hypotheses and false positives can reveal where existing controls are poorly calibrated. For example, repeated investigations may establish that a detection rule generates substantial demand because legitimate customer behaviour has changed rather than because fraud prevalence has increased. That finding can support recalibration, reduce unnecessary investigative workload and concentrate resources on signals carrying greater investigative value. Equally, a low-value indicator that repeatedly appears alongside independently established fraud may warrant reconsideration when its significance becomes visible across multiple cases.
This feedback also requires discipline because an investigative finding should not automatically be converted into a new rule or typology. Practitioners should ask whether the observed behaviour is sufficiently distinctive, whether the finding is supported across independent cases, what legitimate activity might produce the same signal and what false-positive burden a new control could create. The objective is not simply to detect more of the behaviour observed in previous investigations, but to convert investigative learning into detection logic that remains capable of distinguishing meaningful risk from background activity. Where that conversion is poorly calibrated, yesterday's investigative insight can become tomorrow's excessive alert volume. Typology conversion should therefore preserve the evidential context that made the original behaviour significant.
The strongest counter-fraud systems consequently do not treat investigation as the final destination of an alert. Findings should feed back into fraud intelligence, detection, risk assessment, prevention, investigative prioritisation and control design, while subsequent outcomes should test whether those changes actually improve performance. This creates a learning system in which detection generates investigative questions, investigation produces findings, findings generate intelligence and intelligence improves the next generation of detection. It also means that a closed case can retain organisational value long after its immediate disposition has been completed. That is where fraud investigation and fraud intelligence meet: not simply in identifying suspicious activity, but in converting defensible investigative learning into better decisions about what the organisation should detect, investigate and challenge next.
Practitioner Guide
When a fraud indicator is identified, the first task is to establish precisely what has been observed. Investigators should separate the observable fact from the interpretation attached to it. A payment immediately below an approval threshold may be a fact recorded in transaction data; an inference that the payment was deliberately structured to avoid scrutiny is a different proposition. Keeping observation and interpretation separate prevents suspicion from acquiring evidential weight before the underlying explanation has been tested.
The next step is to develop a testable investigative hypothesis. Rather than asking only whether an indicator looks suspicious, the investigator should identify the explanation that might account for it and determine what information would support or weaken that explanation. A sudden change in transaction behaviour, for example, might be consistent with fraud, but it could also reflect a legitimate change in circumstances. The investigative question becomes not “Is this suspicious?” but “What explanation best accounts for the activity, and what evidence would allow competing explanations to be tested?”
Context and chronology should then be established. Investigators should examine what occurred before, during and after the indicator, identify relevant people, accounts, devices, companies or transactions, and determine whether apparently isolated events form part of a wider sequence. Temporal proximity can strengthen the relevance of a relationship, but it does not automatically establish causation. The objective is to reconstruct the activity sufficiently well to understand whether the indicator is isolated, repeated or connected to other potentially significant behaviour.
Corroboration should increase evidential confidence rather than simply increase the number of indicators. Several red flags pointing in the same direction may still originate from the same underlying information or assumption. Investigators should therefore seek genuinely independent information capable of testing the hypothesis, while also looking for evidence that could refute it. Transaction records, communications, authentication information, corporate records, witness accounts, OSINT, device information and other legitimately available sources may contribute different forms of corroboration depending on the investigation.
Alternative explanations should remain live until the available evidence allows them reasonably to be discounted. Confirmation bias can arise when investigators begin with a suspicious indicator and subsequently interpret new information primarily through that initial suspicion. A defensible investigation should therefore record significant explanations considered, the enquiries undertaken to test them and the reasons they were accepted, rejected or left unresolved. Refutation is not a failure of investigation; it is part of the process by which weak hypotheses are eliminated.
Finally, the disposition should reflect the evidential position reached rather than the strength of the original suspicion. Investigators should be able to distinguish what was observed, what was inferred, what was corroborated or refuted, what remains uncertain and what the available evidence supports. Where the evidence does not justify a definitive conclusion, that limitation should be recorded rather than resolved through assumption. A defensible finding is not one that confirms the original red flag; it is one whose reasoning can be reconstructed and withstand scrutiny.
Conclusion
The expanding use of analytics, transaction monitoring, network analysis and artificial intelligence is giving organisations an unprecedented ability to identify suspicious activity. But greater detection capability does not change the fundamental discipline of investigation: identifying something unusual is not the same as establishing what happened.
A fraud indicator is valuable precisely because it directs attention towards activity that may require explanation. Its purpose is to generate enquiry, not to predetermine its outcome. The investigative task begins when that signal is tested against context, independent information, competing explanations and the evidence available as a whole.
This distinction becomes increasingly important as detection becomes more automated. A sophisticated risk score, behavioural anomaly or network connection may appear persuasive because of the technology that produced it, but analytical sophistication does not increase the evidential weight of the underlying facts. Investigators must still determine what a relationship represents, whether information is reliable, what alternative explanations remain credible and how strongly the evidence supports the proposed conclusion.
The same discipline applies when the original suspicion appears compelling. A professional investigation should be capable of changing direction when the evidence demands it. It may substantiate the initial allegation, reveal different misconduct, identify a control weakness, establish legitimate activity or leave a suspicion that cannot responsibly be taken further. The quality of the investigation lies not in confirming the original theory, but in reaching the conclusion that the evidence can actually sustain.
Defensible findings also have value beyond the individual case. Properly assessed investigative outcomes can expose fraud typologies, relationships, vulnerabilities and control weaknesses that strengthen future detection and intelligence. In that sense, investigation should not merely consume alerts; it should improve the organisation's understanding of fraud risk.
The principle at the centre of this article therefore remains deliberately simple:
A red flag tells you where to look. Evidence tells you what you can responsibly say.
Maintaining that distinction is what separates the detection of suspicious activity from a defensible investigative finding.
Methodology and Evidential Note
This article is a practitioner analysis of the relationship between fraud indicators, investigative hypotheses and evidential findings. It examines how red flags generated through transaction monitoring, behavioural analytics, data matching, network analysis, rules-based detection and other investigative or analytical processes can support enquiry without automatically establishing fraud. The analysis is intended to clarify the reasoning required to move from detection and suspicion towards conclusions capable of being explained and defended.
The article distinguishes between observation, indicator, inference, investigative hypothesis, corroboration and finding. These concepts may interact during an investigation, but they should not be treated as interchangeable. An observable fact may generate an indicator; an indicator may support a hypothesis; and corroborated information may increase or reduce confidence in that hypothesis. What can ultimately be concluded depends on the totality, reliability and relevance of the available evidence rather than the number or apparent sophistication of the indicators identified.
Examples involving transaction thresholds, account behaviour, employee conduct, invoices, investment representations and other red flags are illustrative unless expressly identified as documented cases or sourced practices. Their inclusion does not mean that the behaviour described is inherently fraudulent. The same observable behaviour may have legitimate, erroneous or fraudulent explanations, and its significance should therefore be assessed in the circumstances of the particular enquiry.
The analytical approach used throughout the article is hypothesis-led rather than confirmation-led. Corroboration refers to information that independently strengthens a relevant proposition, while refutation refers to information that weakens, contradicts or provides a credible alternative to it. Multiple indicators should not automatically be treated as independent corroboration where they derive from the same underlying source, dataset, assumption or event. Investigators should therefore consider provenance, reliability, independence, chronology and alternative explanations when assessing evidential weight.
Any original Fraud Intelligence Lab model, framework or decision structure presented in this article is an analytical construct designed to support disciplined investigative reasoning. It should not be interpreted as a statutory evidential test, legal burden of proof, regulatory framework or law-enforcement investigation methodology. The evidential threshold and procedural requirements applicable to a particular matter will depend on its legal, regulatory, disciplinary or organisational context.
Finally, references to defensible findings describe conclusions whose reasoning can be explained by reference to the information and evidence available, including relevant limitations and unresolved uncertainty. The term does not imply that every investigation must produce a definitive finding or that an investigator should resolve uncertainty in favour of the initial suspicion. The methodological principle underpinning the article is that indicators direct attention, hypotheses organise enquiry, corroboration and refutation test competing explanations, and findings should go no further than the evidence can support.
