A company director discovers that a trusted financial officer has been diverting funds for three years. The internal accounts show a series of transfers to what appear to be supplier invoices. None of the suppliers exist. As of early 2026, this pattern – fictitious payees, layered onward transfers, and a real-estate endpoint – remains one of the most common forms of internal fraud we encounter.
Fraud proceeds routed into real estate are recoverable, but the window narrows quickly. The key instruments are a proprietary injunction to freeze identified property and a Bankers Trust order to compel banks to disclose account movements. Both require a reconstructed payment trail before any application is made – and that reconstruction is where the work begins.
This case study traces the steps taken in one such matter: how a fragmented paper trail was rebuilt, how the property was identified, and what was done to preserve value for the claimant.
Situation: Internal fraud, fictitious payees, and a gap in the records
The client was a mid-sized trading business. A senior employee had, over approximately three years, raised and approved payment instructions to a set of fictitious vendor accounts. Each individual payment was sized to fall below the threshold that would trigger additional sign-off. The cumulative loss was in the mid-seven figures. The fraud came to light only when a new auditor reviewed dormant supplier relationships.
The immediate problem was the records. Payments had been processed through three separate banking relationships. One bank had been replaced during the period; its historical records were held by a liquidator and were incomplete. Internal accounting entries had been partly overwritten during a system migration. What remained was a patchwork: some full statements, some partial, and a period of roughly eight months where only debit totals were available – no payee details at all.
The instinctive reaction, from both the client and their lawyers, was that the trail was dead. That instinct is understandable. It is also, in our experience, usually wrong.
Strategy: Reconstruct first, apply second
The governing principle in matters like this is straightforward: you do not apply for any relief until you can show a court where the money went. A proprietary injunction over real estate requires more than an allegation – it requires a traceable link between the claimant's funds and the specific asset you are asking the court to freeze.
The strategy had three components. First, reconstruct the payment trail from every available source – not just bank statements, but internal approvals data, email metadata, payroll records, and counterparty-facing documents such as delivery receipts that were never actually fulfilled. Second, identify the beneficial owner of the accounts that received the funds. Third, follow those funds forward to where they settled – in this case, real property.
Each step was sequenced deliberately: reconstruction before identification, identification before any legal step. Moving in the wrong order – for example, alerting the suspect through an ill-timed request – risks dissipation. The application for a freezing order and any related disclosure order must be made without notice, and courts expect a well-grounded evidential picture before they will grant relief on that basis.
If you are assessing a similar matter, our asset tracing service page sets out the building blocks of a tracing engagement in more detail.
Process: Rebuilding the trail from incomplete records
The reconstruction began with the partial records that were available. Forensic analysis of the complete periods established the pattern: timing, value bands, and the naming conventions used for fictitious payees. That pattern was then used as a reference against the gap period. Where no payee details existed, we analysed the debit totals against the established cadence. Roughly 80% of the unattributed debits could be matched to the fraud pattern with high confidence – sufficient to support a conservative estimate of the total dissipated.
The receiving accounts proved to be held in a name that was itself a shell. Disclosure tools – including a Bankers Trust order applied for without notice – compelled the relevant bank to produce account records for those receiving accounts. Those records showed the funds were aggregated across several intermediary accounts before being moved again.
The onward movement crossed two jurisdictions. In both, local counsel coordinated the equivalent disclosure applications. One forum yielded records promptly; the other required a follow-on request under a mutual legal assistance mechanism. The cross-border element added weeks to the process – but the key asset had been identified before those requests were complete, and a proprietary injunction was sought over the property as soon as the tracing chain was sufficiently documented.
The property itself was held in the name of a nominee. A sham-trust analysis and beneficial ownership review – drawing on available UBO register data and documentation obtained through the disclosure process – established that the true owner was the fraudster. That finding anchored the proprietary injunction application.
For a related walkthrough of cross-border transfer tracing, see our analysis of tracing wire transfers routed via Nevis.
What made recovery possible – and what nearly prevented it
Two things made recovery achievable in this matter. First, the decision to pursue the forensic reconstruction before taking any overt legal step. Had the client's lawyers sent a demand letter early – which was the initial instinct – the suspect would have had time to sell the property or encumber it. Second, the without-notice application for interim relief moved quickly once the trail was documented. The proprietary injunction was granted within days of the application being filed.
What nearly prevented recovery was the gap in the bank records. Had the forensic reconstruction not been able to bridge that gap analytically, the tracing chain would have been broken and the court would not have been satisfied that the claimant's funds were linked to the property. The lesson is not that incomplete records are fatal – it is that the approach to incomplete records must be methodical, transparent about its confidence levels, and conservative in what it claims.
A second near-miss came from the cross-border element. One jurisdiction's disclosure process was slower than anticipated. A receiving account in that jurisdiction had been partially depleted by the time the records arrived. The funds that remained – combined with the real-estate asset – represented a recovery that, while not complete, was materially significant for the claimant.
Transferable lessons for practitioners and principals
What does this matter teach? A few points bear repeating across the cases we handle in the financial forensics practice.
- Incomplete records do not end a tracing exercise. Pattern analysis, corroborating sources, and forensic reconstruction can bridge gaps that initially appear fatal to the case.
- The sequence matters as much as the instruments. Asset tracing feeds the legal application; the legal application must not precede the tracing – or dissipation follows.
- Shell and nominee structures add complexity, but they are not opaque. UBO register data, sham-trust analysis, and disclosure orders work together to identify the beneficial owner behind the structure.
- Cross-border cases require parallel coordination. Waiting for one jurisdiction to complete before starting another adds delay that assets can exploit. Where legally permissible, run disclosure requests in parallel.
- Proprietary injunctions over real estate are powerful but time-sensitive. Property can be sold, mortgaged, or transferred. The injunction application must move as soon as the tracing chain supports it.
Could this approach work in your matter? The facts vary considerably from one case to the next. The starting question is always: how complete is the trail, and where has value settled? The earlier that assessment is made, the more options remain open.
To assess whether a tracing engagement is viable in your situation, request a confidential case review: info@axiomtracel.com.
About Axiom Trace
Axiom Trace is an independent boutique focused on cross-border and crypto asset recovery. We trace assets that have moved across borders or on-chain and coordinate their freezing and recovery – working with defrauded principals, insolvency practitioners, and the lawyers and funders who refer them. We reconstruct payment trails from partial records and identify where value has settled, including in real estate and corporate structures held through nominees. We work lawfully and within applicable sanctions regimes, alongside local counsel where proceedings must be filed. To discuss a matter, contact info@axiomtracel.com.
Disclaimer: This publication is for general information only and is not legal advice, nor a promise or prediction of recovery. No outcome is guaranteed. Asset recovery depends on the specific facts and on the law and procedure of each relevant jurisdiction, where local admitted counsel must act. Axiom Trace assumes no liability for actions taken or not taken based on this material. For advice on your situation, contact info@axiomtracel.com.
Recovering cross-border or crypto assets?
Confidential first review. We map tracing and recovery options and tell you honestly whether a matter is worth pursuing.
Request a case review