Phishing occurs when scammers try to trick targets into sharing personal information such as passwords, credit card numbers or bank account details. Armed with more than 30 years of experience in evidence gathering, our licenced phishing investigation experts tackle large-scale attacks to track down culprits and shut down scams.

If you have fallen victim to a phishing scam, the actionable intelligence we uncover can be utilised to help recover your money and take legal action against the criminal who stole it. Book a consultation with Hash today to arrange a phishing investigation.

Phishing attack investigators with a proven track record

World-class phishing investigations

Our investigators, analysts and researchers have been collecting evidence to fight fraudulent operations around the world for decades. Global leaders in phishing attack investigation, we have the expertise to unravel any scam with exceptional efficiency.

Powerful techniques

Availing of direct access to local databases, expert witnesses in cyber fraud, and a network of confidential informants, Hash employs a plethora of proactive methods to conduct meticulous investigations into even the most sophisticated phishing scams from foreign countries.

Global connections

Hash has vast experience collaborating with state, federal and international law enforcement agencies. Our investigators can also partner with local and foreign correspondent lawyers to reveal money trails and hidden assets in almost any country.

Actionable evidence

Hash delivers a detailed brief of evidence for use in criminal proceedings in the relevant jurisdiction. Equipped with proof of phishing fraud, and the identities of those behind it, you can take measures to prosecute the offender and recover your losses.

Robust results

Hash investigators play a pivotal role in assisting international law enforcement agencies to crack down on fraud syndicates, gathering crucial intelligence that has facilitated major police raids, arrests and prosecutions across the globe.

Total discretion

Our passionate team performs every phishing attack investigation with unwavering professionalism, sensitivity and discretion. To safeguard our clients’ confidentiality, we encrypt every piece of personal data and will never disclose case details without consent.

5 key factors to consider in a phishing investigation

1. The wider context

The type of phishing attack and its timeline and targets will all be reviewed in detail to determine any patterns present. This insight can help to identify the scammer behind the email, their strategy and motivations.

2. The header content

Header content may be topline, but it can reveal deeper information about the culprit when assessed by phishing investigation experts. Email headers may help us to uncover the attacker’s actual email address and domain, even if they have used fake details. What’s more, while additional headers are rare, they can shed light on mail scripts, URLs, and the IP address. 

Is the email coming from a trusted domain? Does it have sufficient records and do they match? Is the IP address in a reputable location? This is what we will seek to uncover.

3. The decoy content, URLs and files

It is important to examine the fraudulent email, malicious code or illegitimate website that duped the victim into engaging with this scam. Often, the most integral information is surface level. This stage involves analysing components such as:

• Attachments that may contain malware
• Malicious links that are masqueraded as legitimate URLs.
• Pushy messaging with a sense of urgency and/or inflated promises.
• Webpage code that may contain text comments, inactive software functions, coder nicknames and other key indicators.
• The website’s functional features, forms and technology stack.

4. The receiver’s response

In any phishing investigation, it is essential to consider the degree of damage done, as this will inform the overall approach.

Did the victim click the malicious link or open the attachment? If yes, is their account compromised and has money already been stolen? Have the victim’s other security programs triggered an alert?

Additionally, any unusual activity associated with the victim’s account after the phishing attack, such as new login locations or suspicious withdrawals, will be investigated thoroughly.

5. The attacker’s identity

Equipped with the above findings, it’s time to identify and track down the cybercriminal behind the attack. At Hash, we have the global resources and decades of expertise to bring attackers to justice around the world. Our skilled investigators can also gather further admissible evidence to help prove this scammer’s involvement in court.