principles of fraud examination...search operators search strings: • combine multiple operators to...

© 2018 Association of Certified Fraud Examiners, Inc.

Principles of Fraud

Examination

Investigating on the Internet

© 2018 Association of Certified Fraud Examiners, Inc. 2 of 27

Introduction

▪ The Internet is a powerful tool for fraud

examiners.

▪ Examiners should use the Internet in every

investigation.

▪ Awareness of resources and methods can

make investigations effective and efficient.


Putting the Information to Use

▪ Background investigations and due diligence

▪ Assessing the need for an investigation

▪ Planning the investigation

▪ Gathering evidence

▪ Preparing for and conducting interviews

▪ Prevention


Important Considerations for


▪ Planning resource allocation:

• Determine goals and scope early.

• Understand the impact of an assignment or

investigation.

• Conduct a cost/benefit analysis on paid Internet

tools or services.




▪ Legal issues:

• Laws governing access to information, including

credit records and health records

• Privacy laws and rights

• Defamation

• Discrimination in hiring

• Local laws




▪ Online identity:

• Pretexting and covert accounts:

• Site terms of service

• Invasion of privacy

• Recent warnings




▪ Online identity:

• Mask your IP:

• VPNs

• Tor

• Virtual operating systems

• Public Wi-Fi


Search Engines

▪ Best starting point:

• Google

• Bing

• Dogpile

• Country-specific search engines


Search Engines: Google

Settings


Search Engines: Google


Search Engines: Bing


Search Engines: Dogpile


Search Operators

▪ Quotation marks around a phrase or words

returns the exact phrase—“[search terms]”.

▪ AND—place between terms to make

searches more relevant and specific: [search

term] AND [search term].

▪ OR—place between terms to bring in more

potentially relevant results: [search term]

OR [search term].


Search Operators

▪ Parentheses—group search terms and

operators like a math equation for “search

strings” involving multiple operators:

(“[search terms]” OR “[search terms]”)

AND [search term].

▪ + Designates two words that must appear

together in either order—Mason+Wilder

returns results for pages listing Mason Wilder

or Wilder, Mason.


Search Operators

▪ Placing the minus sign (-) before a word

returns pages that do not contain that term—

fraud -Ponzi would return pages in which the

word fraud appears but excludes the word

Ponzi.

▪ Use additional operators such as filetype:,

site:, allintext.


Search Operators


Search Operators

▪ Search strings:

• Combine multiple operators to further narrow

results.

• It works like a math formula.

• Save search strings that work for you to plug and

play for subsequent investigations.


News Alerts


The Archived Web

▪ The Wayback Machine (www.archive.org):

• Saves previous versions of websites

• Organized by date

• Not comprehensive or exhaustive

▪ Google, Bing, and Archive.is also offer

resources for archived Web pages.

http://www.archive.org/


The Archived Web


People and Username Search Sites

▪ Search for a

subject’s Internet

presence using a

name, email,

phone, and

username.

• Spokeo

• BeenVerified

• Pipl

• Intelius

▪ Check availability

of usernames on

sites, potentially

identifying profiles.

• Knowem.com

• Namechk.com

https://www.spokeo.com/

https://www.beenverified.com/lp/c59108/1/landing?utm_expid=.ZG16Iju9Q2O9J5Z7Z2CFhA.1&utm_referrer=

https://pipl.com/

https://www.intelius.com/

https://knowem.com/

https://namechk.com/


Blogs and Social Media

▪ To be comprehensive, fraud examiners must

check blogs and social media for:

• Background on prospective witnesses and

suspects:

• What are they saying online?

• What are they complaining about?

• Awareness of potential risks and security issues

• What people are saying about the company:

• Find potential tips or dissatisfied customers and

employees.


Main Social Media Sites

▪ Main sites:

• LinkedIn

• Facebook

• Twitter

• Instagram

▪ Other sites


LinkedIn

▪ Claims more than 560 million users

worldwide

▪ Older, more professional demographic

▪ Wealthier subjects and executives more likely

to be on this platform

▪ Subjects much less likely to use aliases

▪ Types of information available:

• Place/jurisdiction of residence, employment

history, professional connections, knowledge or

skills, contact information


LinkedIn Tips

▪ Switch profile

settings to

anonymous to

avoid alerting

subject.

▪ Search by

name,

employer.

▪ Look for what

isn’t there.


Facebook

▪ Most popular social media site in the world

▪ More than 2 billion active users worldwide

▪ Becoming less popular with younger

demographic

▪ Valuable resource for any type of information

or investigation

▪ Privacy settings not necessarily deal

breakers

▪ Settings and policies subject to change


Facebook Tips

▪ If no profile found initially, incorporate middle

name, search for family.

▪ Narrow down results by school, hometown,

current city, employer, mutual friends.

▪ Look for tagged photos and statuses,

comments, and groups.

▪ Search by user ID.

▪ Search by name, alias, email, and phone

number.

▪ You could show up as suggested friend.


Instagram

▪ More than 1 billion active users

▪ More popular with younger demographic than

older

▪ Privacy settings “all or nothing”

▪ Types of information:

• Place of residence, connections, habits, activity

timelines, hobbies/interests, travel, self-incrimination,

lifestyle, assets, and sentiment


Instagram Tips

▪ Pay attention to geotagging or time stamp

info.

▪ Aliases much more likely to be used, but this

can be an advantage if a user is found via a

linked account (e.g., Twitter).

▪ If a subject’s profile is private, try friends and

family.

▪ You could show up as a suggested

connection.

▪ It is not browser-friendly.


Twitter

▪ It has more than 330 million active users.

▪ If the subject isn’t “verified,” they might not

use their real name.

▪ Types of information:

• Place of residence, connections, habits, sentiment,

activity timelines, hobbies/interests, travel, self-

incrimination, lifestyle, assets

▪ It’s great for monitoring subjects during an

investigation and identifying potential

witnesses.


Twitter Tips

▪ Use TweetDeck to follow multiple accounts,

topics, and geolocations.

▪ Identify subjects using geolocation and

TweetDeck.

▪ Privacy are settings similar to Instagram, “all

or nothing,” but fewer people use them.

▪ You could show up as suggested connection.

▪ Patience is required for subjects with many

tweets.


Other Sites

▪ YouTube—not a great source if the subject

hasn’t uploaded videos

▪ Pinterest—not a lot of personal information or

meaningful interaction, not easy to search

▪ Tumblr—hard to find users but could provide

valuable psychological insight

▪ Periscope—not as many users, but if could

be a be a great resource if the subject has an

active profile


Other Sites

▪ Regional sites—Vkontakte (Russia/Eastern

Europe), WeChat (China), Weibo (China)

▪ Messaging apps—Snapchat, WhatsApp,

WeChat

▪ Online forums—Reddit, niche sites, dating

sites


Social Media Tools

▪ Social Mention


Social Media Tools

▪ Intel Techniques


Social Media Tools


Social Media Tools

▪ Tweetdeck


Social Media Tools

▪ Input “fraud charges” geocode:30.272164,-

97.750225,10km” for geolocation search.


Social Media Tools


Social Media Tools

▪ Stalkscan


Social Media Tools

▪ Search is Back!


Social Media Tools

▪ Snap Map


Social Media Tools

▪ Reddit Investigator


Social Media Tools

▪ TweetBeaver


Social Media Tools

▪ Webstagram


News

▪ Search engines have targeted news

searches:

• Search tools

▪ News databases:

• LexisNexis

• Factiva

• HighBeam

• Proquest

▪ Local news sources

▪ Press release databases


News


Public Records

▪ Directories of local government sites with

public records available:

• Publicrecords.onlinesearches.com

• Publicrecords.searchsystems.net

• BRBPub.com

▪ Political donation information:

• Followthemoney.org

https://publicrecords.onlinesearches.com/

http://publicrecords.searchsystems.net/

http://www.brbpub.com/

http://followthemoney.org/


Nonprofits and Charities

▪ GuideStar.org

• Search GuideStar’s database of more

than 700,000 U.S. nonprofit

organizations.

▪ Nozasearch.com

• Noza gathers data about private

foundation activities that might be of

interest to grantseekers, philanthropic

organizations, and individual donors. It

has information about more than

60,000 nonprofit organizations.

http://www.guidestar.org/Home.aspx

https://www.nozasearch.com/


Corporation Search

▪ Connect subjects of an investigation to

relevant entities by searching for a

company’s registration, formation, address,

agents and officers, and more:

• Kompass.com

• Corporationwiki.com

• Opencorporates.com

https://us.kompass.com/

https://corporationwiki.com/

https://opencorporates.com/


Online Tracing Resources

▪ By using Whois protocol and other searches

you can potentially identify:

• Technical information about owner or registrant of

an email address or website

• Additional websites registered to a subject

• Subject’s Internet Service Provider (ISP)

• Location of a website’s server

▪ User-friendly tools available


Web Domains/IPs


Maps and Images

▪ Get latitude

and longitude

for geolocation

purposes with

Google Maps.

▪ Use Street

View.


Maps and Images


Maps and Images

▪ Reverse image searches through Tineye,

Google, Bing, or Yandex


Maps and Images

▪ Metadata (exif):

• Right-click on image, copy address, and put into

tool or upload.


Maps and Images

▪ Geolocation


Case Study

▪ Burkman allegedly

told reporters that the

information he has in

this tweet comes

from Surefire

Intelligence.


Case Study


Questions?

Mason Wilder, CFE

[email protected]

512-276-4184

mailto:[email protected]

principles of fraud examination...search operators search strings: • combine multiple operators to...

Documents