Analyst guide · Cyber Intelligence
Direct answer: Count unique settled transactions before summing overlapping exports. Then distinguish transaction loss, recovery and authenticated customer identities; these are different totals.
A practical verification workflow
- Choose a stable transaction reference and preserve the source export for every row. Identical references across reports usually require reconciliation rather than addition.
- Build the union of transactions and verify that repeated rows agree on currency, amount and status. Investigate conflicts instead of silently keeping the larger figure.
- Subtract only confirmed returns associated with the defined episode. An open recovery request or a promised refund does not reduce a settled-loss total.
- Map customer aliases only where evidence authenticates the link. Multiple profiles are not automatically multiple people, while an unmapped profile is not automatically a new verified identity.
A separate worked illustration
Export A lists transfers U, V and W; export B lists V, W and X. Their union has four transfers, not six. If the only settled recovery concerns V, net loss changes by that recovery once. The number of account labels in either export still cannot establish the number of unique human victims.
The common reasoning error
A dramatic headline can combine gross loss, net loss and account counts without explaining the denominator. Reproduce each measure from its own ledger before comparing reports.
Keep an auditable analyst note
Record the question, source identifier, original observation, conversion or calculation, and the narrow conclusion it supports. Separate a confirmed fact from an inference and from information that is still unknown. Keep the original timestamp or unit alongside any normalized value so another reader can reproduce the reasoning.
Practise with the related case
Operation Alias Ledger: Count Victims Without Double Counting applies this skill in a fictional evidence packet with five graded objectives. This guide explains the method, not the hidden answer key. Case evidence and entities are invented; the separate illustration above is not a substitute for reading the dossier. Sign-in is required to use the case terminal.
Questions readers ask
Should a promised refund reduce reported loss?
Not when the measure is settled cash loss and the return has not settled.
Can a profile name identify a unique person?
Not by itself. Use authenticated mappings and clearly label the remaining uncertainty.
Reporting context and further reading
INTERPOL cybercrime operation report · 2026-10-22. This primary-source reporting provides recent topic context only. It is not evidence that the invented case happened, and its publication date may differ from the incident dates described.
Explore the Case Vault · Browse Intel Drops