International Fraud Investigations Embezzlement, procurement fraud and kickbacks, traced through the ledgers and the people

01Scope

What international fraud investigations involve

Occupational fraud is usually grouped into three families, a framework popularized by the Association of Certified Fraud Examiners: asset misappropriation, corruption and financial statement fraud. Asset misappropriation covers theft of cash, inventory and other assets, including billing schemes, payroll schemes and expense reimbursement fraud. Corruption covers kickbacks, bid rigging, conflicts of interest and bribery. Financial statement fraud covers deliberate misstatement of revenue, assets, liabilities or disclosures. Most real cases mix at least two of these, for example a buyer who takes kickbacks and covers them with inflated invoices.

International fraud investigations add distance to that mix. The people involved may sit in a subsidiary that headquarters visits twice a year. Records may be kept in a local accounting system, in a local language, under local accounting rules. Bank accounts may sit in a third country. Local management may be part of the problem. The investigation therefore has to work out not only what happened but how to get reliable evidence of it from places the company does not fully see.

Delator's role is to answer the specific questions the company needs answered: whether fraud occurred, how it worked, who was involved, how much was lost, over what period, whether it is continuing and which controls failed. Each answer is tied to evidence, and the level of confidence is stated plainly. Where facts cannot be established, the report says so rather than filling the gap with inference.

02Whistleblowers

Handling whistleblower reports that start international fraud investigations

Tips remain one of the most common ways occupational fraud comes to light, and many international fraud investigations begin with a hotline message or an email to a board member. How the company handles that first report affects both the investigation and its legal position. In the European Union, the Whistleblowing Directive, (EU) 2019/1937, requires organisations above certain sizes to maintain internal reporting channels, acknowledge reports within seven days, provide feedback within three months and protect reporters against retaliation. National laws implementing the directive add their own details. Other countries, and U.S. programmes such as the SEC whistleblower programme, create further incentives for reporters to go outside the company if they feel ignored.

Delator helps companies triage reports quickly and fairly. Triage asks whether the report is specific enough to test, which records would confirm or refute it, whether the reporter can be contacted safely for more detail, and whether anyone named in the report has influence over the evidence. A short, documented triage memo protects the company whichever way the facts fall, because it shows the report was taken seriously and handled proportionately.

Protecting the reporter's identity is part of the investigative design. Requests for records are framed so they do not point to the source, interview sequences avoid revealing what prompted them, and the circle of people who know the reporter's identity is kept as small as possible. Any sign of retaliation is escalated to counsel immediately.

03Schemes

Fraud schemes common in cross-border operations

Some schemes appear again and again in multinational groups, because decentralised purchasing, local bank accounts and limited headquarters oversight make them easy to run. Knowing the common patterns lets the investigation test the right transactions first rather than reviewing everything.

The schemes below are described in general terms. In practice each one has local variations, for example the use of informal cash advances in some markets or the routing of supplier rebates through related companies in others.

Procurement fraud and kickbacks

An employee with influence over purchasing steers contracts to a favoured supplier in return for a share of the margin. Signs include a supplier that wins repeatedly despite higher prices, specifications written around one vendor, change orders that inflate value after award and quotations from competing bidders that look as if they came from the same hand. Kickbacks are often paid offshore or in cash, so the investigation tests pricing and award patterns first and uses them to decide who to look at more closely.

Shell and conflicted vendors

A company controlled by an employee or a relative is set up as a supplier and paid for goods or services that are overpriced or never delivered. Corporate registry research, address and bank account matching against employee records and examination of what was actually received usually reveal these. Where the next step is a background check on an individual linked to the vendor, Delator leverages a locally licensed partner in its network to complete that work and does not do it itself.

Expense and card fraud

Fictitious, inflated, duplicated or personal expenses are claimed as business costs. In cross-border settings, foreign currency claims, cash-heavy markets and weak receipt standards make this easier. Testing expense claims against travel bookings, card data, calendars and access logs usually settles the question quickly.

Payroll and ghost employees

Payments to people who do not work for the company, or who left long ago, or inflated overtime and allowances, are classic payroll schemes. Matching payroll to access badges, system log-ins, tax records held by the company and bank account details shared with vendors or other employees is often decisive.

Inventory and asset theft

Goods are written off as damaged, sold through unofficial channels or shipped to fictitious customers. Inventory adjustments, scrap records and freight documents are compared against physical counts and customer records.

Financial statement manipulation

Revenue is recognised early, reserves are released to hit targets, related-party sales are dressed as third-party transactions or round-tripping inflates turnover. These schemes are often driven by incentive pressure at local management level and typically need forensic accounting work alongside the investigation, coordinated with the audit committee and external auditors.

04Red flags

Red flags in ledgers and financial statements

Red flags are not proof. They are reasons to look. A useful international fraud investigation turns red flags into testable hypotheses and then tests them against documents and data. The table below sets out indicators Delator often sees at the start of a matter, what they can mean and the first test that usually helps separate fraud from innocent explanation.

Context matters. A spike in year-end sales may be a genuine seasonal pattern in one market and a cut-off problem in another. Large cash withdrawals may be normal where suppliers do not accept transfers. The investigation's first job is to understand what normal looks like in the local business before treating anything as abnormal.

05First steps

The first days of an international fraud investigation

What happens in the first days often decides what can be proven later. The priority is preservation. Email, file shares, accounting data, chat platforms and mobile devices used for work should be preserved before anyone involved learns that questions are being asked. Automated deletion policies may need to be suspended for relevant custodians. Paper records at a foreign site may need to be secured, which sometimes means an unannounced visit by a consultant with local management that is not implicated.

Preservation has to respect local law. In some EU countries, suspending deletion or imaging devices may require employee notice or works council involvement, and preservation must still be proportionate. Delator agrees a preservation plan with counsel that identifies which steps can be taken immediately and which need a short legal process first.

Alongside preservation, three practical steps often matter. First, check crime or fidelity insurance policies, which typically require prompt notice of discovery and may set strict deadlines for proof of loss. Second, if money is still moving, consider whether payments can be stopped, bank details frozen or a recall requested. Third, limit knowledge of the matter to a small group and avoid any action that tips off the people involved, including asking them casual questions about the transactions.

• Issue legal holds and suspend auto-deletion for relevant custodians
• Image laptops and work phones forensically where lawful
• Export ERP and ledger data covering the suspected period and a margin either side
• Secure physical records at foreign sites
• Notify insurers in line with policy terms
• Stop or review pending payments to suspect vendors

06Data analytics

Forensic data analytics across subsidiaries

The most efficient international fraud investigations start in the data. ERP systems such as SAP, Oracle and Microsoft Dynamics, and the many local accounting packages used by smaller subsidiaries, hold a complete record of who created vendors, who approved invoices, who changed bank details and when payments were released. Delator's analysts extract that data with the client's IT team, normalise it across entities and currencies and run tests designed around the suspected scheme.

Typical tests include duplicate payment detection, vendor master analysis for shared bank accounts, addresses, phone numbers and tax identifiers, comparison of vendor details against employee master files, threshold clustering, unusual posting times and users, sequential invoice numbers from a single vendor, payments to vendors created and paid within days, and price variance analysis against comparable purchases. Benford's law analysis of leading digits can help identify populations that deserve a closer look, though on its own it proves nothing.

Data analytics narrows the field. Instead of reviewing thousands of transactions manually, the team focuses on the few dozen that combine several risk factors. Those transactions are then tested against source documents: purchase orders, delivery notes, contracts, emails and, where needed, physical inspection of what was supposedly delivered. The combination of pattern and document is what turns an analytical exception into a finding.

• Vendor master, employee master and bank detail cross-matching
• Duplicate and near-duplicate payment testing
• Approval threshold clustering and split purchase detection
• Journal entry testing for unusual users, accounts and timing
• Price and margin benchmarking across subsidiaries
• Timeline reconstruction of vendor creation, changes and payments

07Digital evidence

Email, messaging and device evidence in fraud cases

Fraud is planned in conversation, and much of that conversation now takes place on messaging platforms rather than corporate email. WhatsApp, WeChat, Telegram, Signal, LINE and similar apps are common business tools in many markets. Whether a company can lawfully review them depends on device ownership, company policy, local privacy law and employee consent. A company-owned phone governed by a clear acceptable use policy is very different from a personal phone used occasionally for work.

Delator's forensic examiners collect from laptops, mobile devices, cloud mailboxes and collaboration platforms using documented procedures, recording hash values at acquisition and maintaining a chain-of-custody log for every item. Collection is targeted to custodians and date ranges agreed with counsel, which keeps cost down and supports proportionality under data protection law. Review uses search terms in every relevant language, refined as the team learns local slang, code words and abbreviations used by the people involved.

Where fraud involves payment diversion through compromised email, such as a fraudster impersonating a supplier and supplying new bank details, the matter overlaps with cyber investigations. Delator's cyber team can determine how the account was compromised, what the attacker saw and whether the attack is continuing, so the fraud and the intrusion are investigated as one connected event.

Messaging evidence is rarely complete on its own. Deleted chats, disappearing messages and conversations moved to personal devices leave gaps. Good international fraud investigations treat those gaps as facts to be explained rather than ignored: when a custodian switched devices, when a chat was cleared, and whether the timing lines up with events in the ledger. Patterns of deletion around key transactions can be as informative as the messages that survive, and the report records both.

08Interviews

Interviewing staff and the subject of an allegation

Interviews come after the data and documents, not before. By the time the subject of an allegation is interviewed, the team should already know the answers to most of its questions. The purpose of the subject interview is to give the person a fair opportunity to explain, to test those explanations against the evidence and to identify anything the documents have missed.

Sequencing matters. Process witnesses, such as accounts payable clerks, warehouse supervisors and procurement assistants, explain how things are supposed to work and how they actually work. Their accounts often reveal the workarounds that made the fraud possible. People closer to the transactions come next, and the subject comes last. Interviewers are prepared with document bundles, translated where needed, and the interview plan is agreed with counsel.

Local employment law shapes every interview abroad. Employees may have rights to representation, to advance notice of the topics, to a written record or to have a works council member present. Some jurisdictions treat any appearance of coercion very seriously. Delator's interviewers, many with law enforcement backgrounds, are trained to conduct fair, non-coercive interviews that produce reliable information and stand up if later challenged. Interview summaries are prepared for counsel, and admissions are documented carefully without pressure or promises.

09Third parties

Investigating vendors, related parties and external accomplices

Most internal frauds need an external partner: a vendor that issues false invoices, a customer that accepts diverted goods, a bank account holder who receives funds. International fraud investigations therefore look outward as well as inward. Delator consultants research the corporate history of suspect vendors in their home registers, identify directors and shareholders where records allow, check court and insolvency records, review procurement portals and local media, and examine whether the vendor has a real operating presence.

Physical verification is sometimes decisive. A registered address that turns out to be a residential apartment, a virtual office or an empty unit tells its own story. Where a site visit or discreet inquiry about a vendor or individual falls within work local law reserves for licensed investigators, a locally licensed partner in Delator's network carries it out and reports back to the case lead.

Beneficial ownership is often the hardest question. Public registers vary widely in reliability and access, and many EU registers restricted public access after the Court of Justice's 2022 ruling on beneficial ownership transparency. Where records run out, the team relies on indirect evidence: shared contact details, signatories on documents, bank account information in the company's own records, and patterns of communication between employees and the vendor. Conclusions about ownership are stated with the level of confidence the evidence supports.

Distributors, joint ventures and minority investments

Not every fraud happens inside an entity the company controls. Distributors, agents, franchisees and joint venture partners can inflate claims for rebates and marketing support, divert goods to other markets, misreport sales or siphon value from a shared venture. In these cases the company's access to evidence depends largely on its contracts. Audit rights clauses, information rights in shareholder agreements and reporting obligations in distribution agreements are often the starting point for international fraud investigations involving third parties.

Delator reviews the relevant agreements with counsel at the outset to establish what records the company is entitled to see, on what notice and in what form. Where audit rights exist, consultants plan and conduct the audit with a forensic focus, testing claims against underlying invoices, shipping records and end-customer data rather than accepting summary reports. Where rights are weak, the work relies on the company's own data, market intelligence and public records, and the report explains how those limits affect the conclusions.

Joint ventures raise particular sensitivities. The partner may also be the investigation's subject, local directors may owe duties to the venture rather than to the shareholder, and evidence may sit in systems the company does not run. Planning these matters carefully, including how and when to raise concerns with the partner, is usually as important as the fact-finding itself.

10Legal context

Legal frameworks that bear on corporate fraud abroad

Several legal developments raise the stakes of fraud inside multinational groups. In the United Kingdom, the Economic Crime and Corporate Transparency Act 2023 created an offence of failure to prevent fraud, in force from 1 September 2025, which can make large organisations criminally liable when an employee, agent or other associated person commits a specified fraud offence intending to benefit the organisation or its clients. The defence is to show reasonable fraud prevention procedures. Large organisations for this purpose are those meeting two of three thresholds: more than 250 employees, more than 36 million pounds in turnover and more than 18 million pounds in total assets. The offence can reach non-UK groups where there is a sufficient UK nexus.

For U.S. issuers, the Sarbanes-Oxley Act requires management to assess internal control over financial reporting, and a fraud at a foreign subsidiary can reveal a control weakness that must be evaluated and, sometimes, disclosed. External auditors working under ISA 240 or the equivalent U.S. standards consider the risk of material misstatement due to fraud and will want to understand what an investigation found. Financial statement fraud can also bring securities law exposure.

At local level, the company's options typically include a criminal complaint, civil claims against the individuals and accomplices, employment proceedings and insurance recovery. Some jurisdictions offer powerful civil tools. English courts can grant worldwide freezing injunctions and Norwich Pharmacal orders requiring third parties to disclose information about wrongdoers. In the United States, 28 U.S.C. section 1782 allows parties to foreign proceedings to seek discovery from people found in the U.S. Counsel chooses the tools; Delator's job is to provide the factual basis for them.

11Recovery

Quantifying loss and recovering value

Recovery starts with an accurate loss figure. Delator builds a loss schedule that identifies each transaction, the evidence for treating it as fraudulent, the amount, the currency, the date and the confidence level. Transactions are grouped into proven, probable and possible categories so counsel and insurers can see exactly what supports each figure. Investigation costs are tracked separately, because some crime policies cover them and others do not.

Cross-border losses raise accounting questions that domestic cases do not. Amounts may need to be converted at transaction-date rates or at a single agreed rate, local taxes such as VAT may have been reclaimed on fictitious invoices and may need to be corrected with the tax authority, and the same loss may be recorded differently in local statutory accounts and group reporting. The loss schedule states the conversion method and flags tax consequences for the finance team, so the figure presented to insurers, auditors and courts is the same figure everywhere.

Insurance is often the fastest route to recovery. Commercial crime and fidelity policies usually require timely notice, a detailed proof of loss and cooperation with the insurer's own investigation. Policies may exclude losses discovered after a certain period or involving certain employees. A loss schedule built for the insurer's review from the start saves months of back and forth.

Where recovery from the wrongdoers is realistic, international fraud investigations frequently move into asset tracing: identifying bank accounts, property, companies and other assets held by the individuals or their associates, and assessing which legal tools in which country can reach them. Delator's asset tracing work follows the same model, with records research and analysis by consultants and any licence-reserved inquiries completed by locally licensed partners.

12Remediation

Fixing the controls that allowed the fraud

Every fraud exposes a control failure. Sometimes it is obvious: one person could create a vendor, approve its invoices and release payment. Sometimes it is subtle: approvals existed on paper but were rubber-stamped because the approver relied on local management. Delator's reports include control observations written for the finance, procurement and internal audit teams who will fix them, not generic recommendations copied from a framework.

Common remediation points include segregation of duties in the purchase-to-pay cycle, independent verification of vendor bank detail changes, vendor onboarding checks proportionate to risk, rotation of procurement staff in high-risk categories, mandatory leave policies, continuous monitoring rules based on the analytics that detected the scheme and clearer escalation routes for concerns raised locally. Many of these overlap with the reasonable fraud prevention procedures that UK guidance under the failure to prevent fraud offence expects large organisations to maintain.

Clients sometimes ask Delator to return after six or twelve months to test whether remediation took hold. Re-running the original analytics against new data is a straightforward way to show that the gap has closed, and it is evidence a regulator, auditor or insurer may find persuasive.

Step by step

How an Engagement Works

1. 01

   Intake and triage

   A confidential call with you and counsel to assess the allegation, the countries involved and what has been preserved.

2. 02

   Preservation plan

   Legal holds, data exports and device imaging planned to respect local privacy and employment rules.

3. 03

   Written scope

   Questions, period, entities, methods, partner tasks and a phased budget agreed in writing.

4. 04

   Data analytics

   ERP, ledger and master file data analyzed to isolate the highest-risk transactions.

5. 05

   Document testing

   Flagged transactions tested against contracts, delivery records, emails and, where needed, physical checks.

6. 06

   Third-party research

   Vendors and related parties researched by consultants; licence-reserved inquiries completed by local partners.

7. 07

   Interviews

   Process witnesses first and the subject last, with counsel and in the interviewee's language.

8. 08

   Report and recovery

   Findings, loss schedule and control observations, with support for insurance, recovery and remediation.

Deliverables

What You Receive

• Preservation and data collection plan by country
• Data analytics results with flagged transaction populations
• Loss schedule grouped by proven, probable and possible
• Vendor and related-party research findings
• Chronology of the scheme and key events
• Interview summaries prepared for counsel
• Evidence register with chain-of-custody records
• Final report with findings, confidence levels and limits
• Control observations for finance, procurement and internal audit

Industries

Who Uses Fraud investigations Services

• ManufacturingHigh-volume procurement, scrap and inventory create room for kickbacks, theft and diversion.
• Construction and engineeringSubcontracting, change orders and site cash create classic procurement fraud exposure.
• Energy and miningRemote operations, large service contracts and local suppliers make vendor fraud hard to see from headquarters.
• Retail and consumer goodsDistributor rebates, promotional spend and inventory shrinkage are frequent fraud channels.
• Healthcare and life sciencesDistributor margins, sample stock and event spending can conceal both fraud and corruption.
• LogisticsFreight, fuel and customs costs are easy to inflate and difficult to verify remotely.
• TechnologyReseller discounts, channel incentives and revenue recognition can be manipulated at local level.
• Nonprofits and NGOsGrant funds spent through local partners in many countries need careful verification when concerns arise.

Credentials

Who Does the Work

Delator Global's consultants come from backgrounds where finding facts under pressure is the job: U.S. military intelligence, the Department of Homeland Security, former law enforcement officers of every kind, former bounty hunters, and technology specialists across networks, applications, forensics and data. Behind them sits a network of locally licensed partners holding a wide range of licences and certifications, so every part of an engagement is done by someone entitled to do it in that country.

• Military intelligenceCollection planning, analysis and reporting discipline.
• Homeland securityFederal investigative and border, trade and financial crime experience.
• Law enforcementInterviewing, evidence handling and courtroom testimony.
• Bail enforcementLocating people who do not want to be found, lawfully.
• TechnologyNetwork, application, cloud and forensic specialists.
• Licensed partnersLocal licences for the work local law reserves.

Related services

Related Delator Global Services

• CorporateInternational Corporate InvestigationsInternational corporate investigations rarely stay inside one legal system.
• CorporateAnti-Bribery and Corruption InvestigationsA suspicious commission to a customs agent, a consultant paid through a third country, a hospitality budget that keeps growing near a tender deadline: these are the facts that start anti-bribery and corruption investigations.
• CorporateInternational Asset TracingInternational asset tracing is the work of finding out what a debtor, a fraudster or a counterparty really owns or controls outside its home country, and where it sits, so that a judgment, an arbitral award or a fraud claim turns into money.
• CyberCyber InvestigationsCyber investigations establish what happened during a security incident or digital fraud, how the attacker got in, what they touched, and what evidence exists to support recovery, notification and legal action.
• CorporateInsider Threat InvestigationsInsider threat investigations examine what happens when someone with legitimate access, an employee, contractor, partner or former staff member, uses it to take data, steal trade secrets, commit fraud or cause harm.

Every Delator Global service

Countries

Where Delator Global Works

Delator Global handles matters in 152 countries, with a country page for each and a city page for every city over 200,000 people. Larger markets are listed below; the full list is on the international page.

• United Kingdom
• Canada
• Mexico
• Germany
• France
• India
• Brazil
• Australia
• Japan
• United Arab Emirates
• South Africa
• Nigeria
• China
• South Korea
• Spain
• Italy
• Netherlands
• Poland
• Turkey
• Philippines
• All 152 countries