Preserve devices. Produce a traceable record.
Money or messages have just left, and you need the trail held before anyone has a look. We preserve devices and accounts, then produce transaction and communications records that can be exhibited.
Speak to the investigations practiceWhen devices, accounts and payments are the record
- A payment diversion, authorised push payment fraud, or wallet movement has just happened.
- Devices and accounts need to be held before anyone has a look.
- You need a trail in a form a court will accept, not a thread of screenshots.
When another route may be better
If the immediate need is legal relief rather than preservation, the cryptoassets or asset-tracing pages describe that work. If you only have screenshots and will not preserve devices, the trail may already be too thin to reconstruct.
Lawful collection and provenance
Authorised push payment disputes involve banks and the Payment Services Regulations 2017, plus any relevant reimbursement scheme in force at the time. Device imaging and communications data have to be obtained lawfully. Exhibits must show provenance.
How the trail is held and mapped
- Preserve devices and accounts. Do not keep using a compromised inbox to check what happened. We capture first.
- Produce traceable transaction and communications records. Banks, payment institutions and wallets. Each hop is marked as confirmed or inferred.
- Support the legal decision. Letter, application, or stop. The map is evidence. The decision is legal.
Keys and passwords
Do not send passwords, private keys or seed phrases through the website. We will never ask for a seed phrase or private key.
Principal risks
- Using the live account after the event can overwrite the trail.
- A receiving institution may have already paid away.
- Screenshots without metadata will be attacked.
Fees
We agree the scope and charging basis before substantive work begins. Most matters are charged by reference to time; a fixed fee may be available for a clearly defined preliminary review. Full rates and terms are on the Pricing page.
Who is responsible
Each matter is supervised by a named solicitor. Specialist investigators and forensic professionals are introduced where their expertise is needed, with their role and status explained. Job titles on this site are not a reserved-activity authorisation. Confirm current authorised individuals on the Regulatory information page and the public SRA record.
Questions we are asked
Should I contact my bank first?
Yes, promptly, using a number you already hold. Then write to us with what you still have — not passwords.
Will you recover APP fraud automatically?
No. Reimbursement rules and bank processes change. We advise on the file, not on a promised scheme outcome.
Can you image my laptop remotely?
Yes, remotely as well as on site. Collection is carried out to a documented chain of custody by an independent forensic provider, imaging the device rather than working on the original, so the evidence stands up if the matter later goes to a tribunal or court. We agree the scope of collection and the search terms with you in writing first, and we do not review privileged or plainly personal material outside that scope.
What if I already reinstalled the phone?
Tell us. Some traces survive; many do not. Honesty about what was done is part of the file.
Speak to the investigations practice.
Send the facts you already have. Do not send passwords, private keys, seed phrases or original identity documents.
Speak to the investigations practiceReviewed by Priya Raman, Compliance Officer for Legal Practice, on 15 June 2026. Next review due 15 June 2027. This page is general information about the law of England and Wales and is not advice on your situation.