IP Theft and Counterfeiting Investigations From the listing on the screen to the source of supply

01Scope

What IP theft and counterfeiting investigations cover

Intellectual property harm reaches a business through several different doors, and each needs its own investigative approach. Counterfeits copy a brand and deceive buyers. Grey market goods are genuine products sold outside the channel or territory the brand owner intended. Manufacturing leakage happens when an authorised factory produces extra units, sells rejects or passes moulds and specifications to others. Online brand abuse uses a company's name, logos and imagery to sell fakes or harvest payments. Trade secret theft takes formulas, source code, designs, customer data or process know-how out of the business, often through a person who once had legitimate access.

IP theft and counterfeiting investigations aim to answer the same core questions regardless of which door was used: what exactly is being infringed, who is responsible, where the goods or information come from, how much harm is occurring, and what lawful evidence exists to support action. The answers determine whether the right response is a platform takedown, a customs application, a cease-and-desist letter, a civil claim, a criminal complaint or a commercial conversation with a distributor who has strayed outside its territory.

Delator Group consultants lead these cases and coordinate the parts that cross borders. Much of the work is research and analysis that can be done lawfully from anywhere: marketplace listings, domain and hosting data, corporate registries, trade records, litigation history and open-source intelligence. Field work is different. In many countries, test purchases, enquiries at factories and anything resembling surveillance are activities that local law reserves for licensed investigators. In those jurisdictions a locally licensed partner in Delator's network completes the field component under the Delator case lead's direction, and the results are folded into one evidence package.

02Rights first

Start with the rights you can enforce

An investigation is only as useful as the rights behind it. Trademarks and design rights are territorial: a registration in the United States does nothing in a country where the brand is unregistered, and in first-to-file systems a local party may already have registered the mark. Before money is spent tracing a counterfeiter, counsel should confirm which rights exist in the jurisdictions where infringement is happening and whether they are recorded with customs authorities.

Several practical steps make later enforcement far easier. In the United States, trademarks and copyrights can be recorded with U.S. Customs and Border Protection, which uses the recordation to detain suspect imports. In the European Union, rights holders can file an application for action under Regulation (EU) No 608/2013, which asks customs authorities to watch for and detain suspected infringing goods. The TRIPS Agreement requires World Trade Organization members to provide border measures for counterfeit trademark and pirated copyright goods, though procedures and effectiveness vary.

For trade secrets, the question is whether the information was in fact kept secret. Under the U.S. Defend Trade Secrets Act of 2016 and under the EU Trade Secrets Directive 2016/943, protection depends on the information having commercial value because it is secret and on the holder having taken reasonable steps to keep it so. An investigation into a leak often begins by documenting those steps, because a claim fails if the business cannot show it protected the information in the first place.

• Confirm trademark, design and patent registrations in each jurisdiction of concern.
• Record rights with customs where that option exists and keep product identification guides current.
• Document confidentiality measures for trade secrets: access controls, agreements, marking and training.
• Identify which platforms, registrars and payment providers operate notice procedures that rely on proof of rights.

03Online

Online marketplace and e-commerce counterfeiting

Most counterfeit sales now begin online. Listings on global marketplaces, regional platforms, social commerce channels and standalone storefronts reach buyers who never see a physical market. The listing is the visible symptom. Behind it sits a network: seller accounts, often many controlled by the same people, linked storefronts, payment accounts, warehouses or fulfilment services, and a supply source.

Effective IP theft and counterfeiting investigations online go beyond reporting listings one at a time. The goal is to connect accounts to each other and to real entities, so that enforcement hits the network instead of a single disposable storefront. Links come from shared product images and descriptions, identical customer service text, reused contact details, overlapping return addresses, common payment processors, domain registration patterns and the business information that some platforms now require sellers to disclose.

Regulation has started to help. The EU Digital Services Act requires online platforms to operate notice-and-action mechanisms and to give priority to notices from trusted flaggers designated under the Act, and it requires online marketplaces to collect and make efforts to verify information about traders. In the United States, the INFORM Consumers Act requires online marketplaces to collect and verify information about high-volume third-party sellers and to disclose certain details to buyers. These obligations create records that investigations can use and give rights holders firmer ground when they ask platforms to act.

Online work is evidence work. Screenshots alone are weak. Delator preserves listings with timestamps, URLs, page source and metadata, records the steps taken to capture them, and keeps a log that lets counsel explain to a platform, a court or customs how each item was obtained.

Lookalike domains and fake storefronts

Fake storefronts use a brand's name in a domain, copy its product photography and take card payments or bank transfers. Research focuses on registration records, hosting and name-server patterns, site templates, analytics and payment identifiers that link one site to others. Where the domain itself infringes, counsel can consider complaints under the Uniform Domain-Name Dispute-Resolution Policy, administered by providers such as the WIPO Arbitration and Mediation Center, alongside hosting and payment provider notices.

Social commerce and messaging channels

Sellers increasingly advertise on social media and close sales in private messaging apps, which keeps transactions away from marketplace controls. Investigations here map public profiles, advertising, linked accounts and payment instructions, staying within platform terms and the law. Any interaction that involves engaging a seller under a buyer persona to make a purchase is treated as a test purchase and handled under the rules described below.

04Test purchases

Test purchases and evidence of sale

A test purchase turns a suspicion into evidence. It shows that infringing goods are actually offered and sold, provides a physical sample that the brand owner's product experts can examine, and often reveals shipping origins, return addresses, payment recipients and packaging that the listing never shows. In many civil proceedings, a properly documented purchase is the foundation of the claim.

The rules for test purchases differ by country. In some jurisdictions they are an ordinary research step. In others, buying under a persona to gather evidence is investigative activity that requires a licence, and in some, courts give particular weight to purchases made in the presence of a notary. Chinese practice, for example, often relies on notarised purchases as evidence in civil IP litigation. Where local law reserves this work for licensed investigators, a locally licensed partner in Delator's network makes the purchase, following a protocol the Delator case lead and the client's counsel agree in advance.

Documentation is what makes a test purchase usable. The protocol records who made the purchase, when, from which listing or premises, how payment was made, what was received, how the parcel was opened and photographed, and the chain of custody from delivery to the brand owner's examiner. The examiner's report then compares the sample against genuine product and identifies the features that show it is counterfeit or diverted.

• Pre-agreed purchase protocol approved by counsel before any purchase is made.
• Capture of the listing or premises immediately before purchase.
• Payment records and any messages exchanged with the seller.
• Unboxing photographs and video showing packaging, labels and shipping details.
• Sealed storage and a chain-of-custody log until handover to the product examiner.
• Examiner's comparison report against genuine product.

05Supply source

Tracing counterfeits back to the source of supply

Taking down listings without addressing supply is a cycle that never ends. Source investigations ask where the goods are made, who finances production, who handles export and who receives the shipments in destination markets. The answers usually come from combining several types of data rather than from a single breakthrough.

Trade data is one starting point. Import and export records available in some countries show consignees, shippers, product descriptions and volumes, and can link a small online seller to a regular importer. Corporate records connect the importer to directors, shareholders and related companies. Customs seizure notices, where the brand owner receives them, identify consignors and consignees. Packaging, labels and the physical construction of seized or purchased items can point to a particular production method, supplier of components or region.

When the trail reaches a manufacturing area, field work is usually required to confirm what is happening there. Enquiries at factories, observation of loading and shipping, and conversations with people in the supply chain are, in many countries, activities that only licensed investigators may carry out. Delator does not do this work itself abroad; a locally licensed partner in its network completes it under a written scope, and the Delator case lead integrates the results with the desk research. The aim is evidence strong enough for counsel to file an administrative complaint, request a raid by the competent authorities or bring civil proceedings with a realistic prospect of seizure.

Enforcement itself belongs to the authorities and the courts. Raids are carried out by police, customs or market regulators, or under court orders, depending on the jurisdiction. In China, for instance, administrative enforcement is commonly handled by local market regulation authorities. The investigation's role is to make sure the authorities have enough reliable information to act, and that the brand owner understands who it is dealing with before it commits to litigation.

06Diversion

Grey market diversion and parallel imports

Grey market goods are genuine, which makes them harder to address than fakes. They are products made by or for the brand owner and sold in one market at one price, then moved into another market where they undercut authorised distributors or arrive without the local labelling, warranty or regulatory approvals. Whether the brand owner can stop them depends on the law of the market where they are sold.

Legal positions differ. Within the European Economic Area, trademark rights are exhausted once goods are put on the market in the EEA with the owner's consent, so goods can circulate freely inside it, but the Court of Justice confirmed in Silhouette that member states may not apply international exhaustion, so goods first sold outside the EEA can generally be stopped. In the United States, rights holders may be able to restrict gray market imports that are materially different from the goods authorised for sale domestically, and customs offers protection for physically and materially different goods in some circumstances. Many other countries apply international exhaustion and allow parallel imports.

Whatever the legal position, diversion usually breaches a contract somewhere, and the investigation's job is to find where. Batch codes, serial numbers, lot markings and packaging variations identify which market a product was intended for. Purchases of diverted goods, made under the same protocol as counterfeit test purchases, provide samples whose codes can be matched to shipment records. Distribution data then narrows the leak to a particular distributor, sub-distributor or customer who ordered more than its market could absorb.

07Trade secrets

Trade secret theft and technology leakage abroad

Trade secret cases with a foreign dimension often involve one of three patterns: an employee or contractor who leaves for a competitor abroad and takes information with them, a joint venture partner or licensee that uses technology beyond the scope of its agreement, or a supplier that reuses tooling, specifications or software for its own products. Each pattern leaves different traces, and investigations combine digital evidence inside the company with research outside it.

Inside the company, the questions are who had access, what was accessed or transferred, and when. Endpoint logs, cloud audit trails, email records and device forensics can show downloads, uploads to personal storage, unusual printing or the use of removable media. Delator's cyber investigations and insider threat work covers that side of the case, under authorization from the company that owns the systems.

Outside the company, the questions are where the information went and how it is being used. Research covers the competitor or new employer, product launches, patent filings that reuse the company's know-how, regulatory submissions, trade show materials, hiring patterns and corporate links between the departing person and the recipient. Where the case involves background checks on named individuals abroad, Delator leverages a locally licensed partner in its network to complete that work and does not do it itself.

Remedies depend on where the information is being used. The U.S. Defend Trade Secrets Act provides a federal civil claim and, in extraordinary circumstances, ex parte civil seizure. EU member states implement the Trade Secrets Directive in national law, with injunctions and damages available. Some countries offer criminal remedies, and in the United States trade secret theft benefiting a foreign government can be prosecuted under the Economic Espionage Act. Counsel decides on forum and remedy; the investigation supplies a clear, sourced account of what happened.

08Evidence

Building evidence that holds up with platforms, customs and courts

IP theft and counterfeiting investigations succeed or fail on the quality of their evidence. A platform reviewer, a customs officer and a judge each need different things, but all of them need to know that the evidence is what it claims to be and was obtained lawfully. Weak capture methods, broken chains of custody or tainted purchases give the other side an easy way to challenge the case.

Delator's evidence standards are set at scoping and agreed with counsel. Online evidence is captured with forensic tools or documented methods that record time, URL and source data, and hashes are calculated where appropriate. Physical items are logged on receipt, photographed, sealed and stored with access records. Every investigative step that could later be questioned, such as how a persona was used for a purchase, is documented so that counsel can explain it.

Lawful methods are a firm boundary. That excludes accessing seller accounts or systems without authorization, inducing someone to commit an offence they would not otherwise have committed, paying officials, or making recordings that local law prohibits. In jurisdictions where entrapment or provocation rules affect how test purchases are viewed, the protocol is drafted with local counsel to stay on the right side of them.

• Forensic or documented capture of web pages, listings and seller profiles.
• Hash values and capture logs for digital evidence where appropriate.
• Chain-of-custody records for every physical sample.
• Purchase protocols approved by counsel and local partners before execution.
• Clear separation of confirmed facts, inferences and unverified reports in every summary.

09Scoping

How IP theft and counterfeiting investigations are scoped and priced

Scope drives cost, so the first conversation is about priorities. A brand owner facing thousands of listings across several regions cannot investigate all of them at once, and should not try. The scoping call identifies the products that matter most commercially or carry safety risk, the markets where harm is concentrated, and the outcome the business wants within a realistic budget. IP theft and counterfeiting investigations are then staged so that early findings decide whether later, more expensive phases are worth commissioning.

A typical first phase is desk-based: mapping a defined set of sellers or domains, linking them to entities and identifying likely supply routes. It is relatively quick and gives counsel enough to send notices and decide whether the network justifies deeper work. A second phase adds test purchases and trade data analysis. A third, where warranted, adds partner-led field enquiries in manufacturing or distribution areas and preparation of evidence for authorities or court.

Each phase has its own written scope and estimate, agreed before work begins. Field components are quoted separately because they depend on the jurisdiction, the licensed partner involved and the number of locations. The client sees the decision points in advance and can stop, pause or redirect the work at each one.

This staged approach also protects evidence. Rushing into field work before the online and records picture is clear can alert the target, waste purchases on low-value sellers or produce evidence that does not connect to the entity counsel actually wants to sue. Sequencing IP theft and counterfeiting investigations properly means each step builds on confirmed findings from the one before.

10Response options

Matching the response to what the investigation finds

Not every infringement justifies litigation, and not every network can be shut down with notices. Good brand protection programs match the response to the scale of harm, the identity of the infringer and the strength of the evidence. The investigation should deliver findings in a form that supports whichever option counsel and the business choose.

Coordinating with U.S. remedies

Where infringing goods are sold into the United States, rights holders have additional tools. The Lanham Act allows ex parte seizure of counterfeit goods in some circumstances. Section 337 proceedings at the U.S. International Trade Commission can result in exclusion orders that stop infringing imports at the border. Many brand owners also bring federal suits against groups of online sellers. Each route needs a different evidence set, and the investigation is scoped accordingly.

11Programs

From one-off cases to a brand protection program

Companies that face persistent counterfeiting usually find that reacting case by case costs more than a structured program. A program sets priorities by product line and market, monitors the channels where infringement appears, escalates the cases that warrant investigation, and measures results in terms that matter to the business, such as reductions in repeat listings or seizures at key ports.

Delator's consulting work helps legal and brand teams design that structure: which marketplaces and regions to watch, what thresholds trigger an investigation, how test purchases are approved, how evidence is stored, and how findings feed customs training and distributor audits. Investigative findings also inform product and packaging design, since authentication features, serialisation and track-and-trace systems make both counterfeits and diversion easier to detect.

Programs also need clear lines with the commercial side of the business. Distributors and licensees should know that territories and quality terms are monitored, contracts should give the brand owner audit rights and clear remedies, and sales teams should understand that unexplained volume growth in one territory can be a warning sign rather than good news. IP theft and counterfeiting investigations work most effectively when the contracts, the monitoring and the response plan are designed together.

12People and lawful limits

Who carries out IP theft and counterfeiting investigations abroad

Delator Group's consultants bring backgrounds that suit cross-border IP work: former law enforcement officers of many kinds, people with U.S. military intelligence and Department of Homeland Security experience, former bail enforcement agents used to finding people who do not want to be found through records, and technology specialists who handle online evidence, domains and digital forensics. The wider network holds a range of licences and certifications across the jurisdictions where it operates.

The division of labour is consistent. Delator consultants lead the case, design the strategy with counsel, carry out research and analysis, and produce the final evidence package. A locally licensed partner in Delator's network completes the field components that local law reserves for licensed investigators, such as test purchases and enquiries at manufacturing or distribution sites in many countries. Where a client needs traditional private investigation abroad unrelated to the corporate case, such as surveillance of a named person, that work is referred to a vetted investigator in the network who holds the required licence and contracts with the client directly.

Scoping always includes a check of the local rules: whether a given method is lawful, whether it requires a licence, how evidence must be gathered to be admissible, and whether data protection rules limit what can be collected about individual sellers. The answer shapes who does each task and how it is documented.

Step by step

How an Engagement Works

1. 01

   Rights and goals

   Counsel and the Delator case lead confirm which rights apply in each market and what outcome the client wants, from takedowns to litigation.

2. 02

   Written scope

   Objectives, jurisdictions, methods, purchase protocols and evidence standards are agreed in an engagement letter.

3. 03

   Online and records research

   Consultants map listings, accounts, domains, corporate records and trade data to connect sellers to entities.

4. 04

   Test purchases

   Purchases are made under the agreed protocol, by a locally licensed partner where local law requires, with full chain of custody.

5. 05

   Source and field work

   Where supply must be confirmed on the ground, a locally licensed partner completes field enquiries under Delator's direction.

6. 06

   Evidence package

   Findings, samples, captures and logs are compiled into a package built for platforms, customs, authorities or court.

7. 07

   Response support

   The case lead briefs counsel and the business, and supports takedowns, complaints or proceedings with further research as needed.

Deliverables

What You Receive

• Seller and entity network map linking accounts, storefronts, domains and companies.
• Preserved online evidence with capture logs, timestamps and hash values where appropriate.
• Test purchase records, unboxing documentation and chain-of-custody logs.
• Corporate, ownership and trade-record research on manufacturers, importers and distributors.
• Diversion analysis tracing codes and lots to territories and distribution partners.
• Takedown and notice packages formatted for the relevant platforms and providers.
• Evidence summary for counsel separating confirmed facts from inferences.
• Recommendations for monitoring, contract terms and authentication measures.

Industries

Who Uses IP theft and counterfeiting Services

• Luxury goods and fashionStrong brands attract high-volume counterfeiting across marketplaces, social channels and physical markets.
• Consumer electronics and accessoriesFake chargers, batteries and components raise safety risks alongside lost sales and warranty fraud.
• Pharmaceuticals and medical devicesCounterfeit and diverted medical products can harm patients and breach regulatory supply-chain controls.
• Automotive and industrial partsCounterfeit parts enter supply chains through distributors and online channels, creating liability and safety exposure.
• Cosmetics and personal careFakes and grey market stock bypass labelling and ingredient rules that apply in each market.
• Software, media and technologySource code, designs and licensed technology are frequent targets for misuse by former staff, partners and licensees.
• Food, beverage and spiritsRefilled, relabelled and diverted products damage brands and can create serious health risks.

Credentials

Who Does the Work

Delator Global's consultants come from backgrounds where finding facts under pressure is the job: U.S. military intelligence, the Department of Homeland Security, former law enforcement officers of every kind, former bounty hunters, and technology specialists across networks, applications, forensics and data. Behind them sits a network of locally licensed partners holding a wide range of licences and certifications, so every part of an engagement is done by someone entitled to do it in that country.

• Military intelligenceCollection planning, analysis and reporting discipline.
• Homeland securityFederal investigative and border, trade and financial crime experience.
• Law enforcementInterviewing, evidence handling and courtroom testimony.
• Bail enforcementLocating people who do not want to be found, lawfully.
• TechnologyNetwork, application, cloud and forensic specialists.
• Licensed partnersLocal licences for the work local law reserves.

Related services

Related Delator Global Services

• CorporateInsider Threat InvestigationsInsider threat investigations examine what happens when someone with legitimate access, an employee, contractor, partner or former staff member, uses it to take data, steal trade secrets, commit fraud or cause harm.
• CorporateInternational Corporate InvestigationsInternational corporate investigations rarely stay inside one legal system.
• CyberCyber InvestigationsCyber investigations establish what happened during a security incident or digital fraud, how the attacker got in, what they touched, and what evidence exists to support recovery, notification and legal action.
• CorporateSupply Chain and Sanctions InvestigationsSupply chain and sanctions investigations answer questions regulators now expect companies to answer with evidence rather than assurances: who made the goods you import, who ultimately owns the parties you deal with, and where your products end up after they leave your hands.
• CorporateInternational Due DiligenceInternational due diligence answers a simple question that is hard to answer well: who is really on the other side of this deal, and what will we inherit if we sign? Delator Group consultants lead the work for legal, compliance and deal teams, scoping each review to the risk, the jurisdiction and the decision it has to support.

Every Delator Global service

Countries

Where Delator Global Works

Delator Global handles matters in 152 countries, with a country page for each and a city page for every city over 200,000 people. Larger markets are listed below; the full list is on the international page.

• United Kingdom
• Canada
• Mexico
• Germany
• France
• India
• Brazil
• Australia
• Japan
• United Arab Emirates
• South Africa
• Nigeria
• China
• South Korea
• Spain
• Italy
• Netherlands
• Poland
• Turkey
• Philippines
• All 152 countries