Analyst guide · Crime & Investigation
Direct answer: When a payment destination changes, verify the authority for the change separately from the appearance of the person requesting it. Measure loss from settled bank records, not from the requested amount.
A practical verification workflow
- Preserve the original invoice, verified destination and change procedure. The relevant question is whether the stated amendment conditions were actually satisfied.
- Compare the new destination with the original and document how it was introduced. A meeting image or familiar name does not replace the required approval evidence.
- Separate payment instructions that settled, instructions stopped before settlement and confirmed money returned. Each state affects the loss calculation differently.
- Report identity and mechanism limits. A diversion can be documented without proving whether a video used synthetic media, a lookalike or another form of impersonation.
A separate worked illustration
Imagine an unauthorized change requests 1600, of which 1000 settles and 600 is stopped. A confirmed 200 return leaves 800 in net settled loss for that episode. Calling the full requested sum lost would overstate the observed outcome; calling the return request successful would understate it.
The common reasoning error
Do not use a plausible supplier display name as a substitute for the authenticated change-control trail. The destination, approvers and supporting amendment all matter.
Keep an auditable analyst note
Record the question, source identifier, original observation, conversion or calculation, and the narrow conclusion it supports. Separate a confirmed fact from an inference and from information that is still unknown. Keep the original timestamp or unit alongside any normalized value so another reader can reproduce the reasoning.
Practise with the related case
Operation Invoice Mirror: Find the Diverted Settlement applies this skill in a fictional evidence packet with five graded objectives. This guide explains the method, not the hidden answer key. Case evidence and entities are invented; the separate illustration above is not a substitute for reading the dossier. Sign-in is required to use the case terminal.
Questions readers ask
Is every attempted transfer part of settled loss?
No. A stopped instruction must be distinguished from a completed debit.
Can financial records prove how an impersonation video was made?
Usually not by themselves; the financial and media-mechanism questions require separate evidence.
Reporting context and further reading
INTERPOL deepfake awareness campaign · 2026-10-19. This primary-source reporting provides recent topic context only. It is not evidence that the invented case happened, and its publication date may differ from the incident dates described.
Explore the Case Vault · Browse Intel Drops