A business owner in Northern Europe discovered – weeks after the fact – that a series of authorised payments had been systematically misdirected. The funds had moved through a local account, onward into Lithuania, and from there into a structure that was already beginning to unwind its holdings. The question was not whether a fraud had occurred. The question was whether anything remained to freeze.
When a payment trail leads into Lithuania, the absence of complete records does not mean the trail is dead. Forensic reconstruction from partial bank data, corporate registry extracts, and open-source commercial intelligence can rebuild the flow of value – and identify where it settled, even when the surface architecture is designed to obscure it. This case study traces how that reconstruction unfolded and what it produced.
The account below is anonymised. Identifying details – including the precise amounts, entity names, and timing – have been generalised in accordance with our standard case-study policy. The instruments and methods are real.
Situation: authorised payments, a Lithuanian transit account, and a disappearing trail
Our client was a mid-sized trading company based in Western Europe. Over a period of several months, payments authorised under a legitimate-looking supply-chain arrangement had been clearing into an account held at a Lithuanian-registered bank. The counterparty – apparently a supplier – had gone silent. Internal audit revealed that invoices had been fabricated and that the beneficial owner behind the Lithuanian entity was unknown.
By the time the matter reached us, the receiving account showed minimal balance. The funds had been moved onward within days of each receipt – a dissipation pattern we recognise immediately. Partial SWIFT records were available. Internal account statements for the receiving entity were not. The corporate registry showed a nominee director and an offshore shareholding chain through two intermediate holding structures.
What remained? A recoverable position required answers to three questions: where the value had actually settled, whether any of it was still reachable, and whether a freezing application could be made quickly enough to matter.
The paper trail was genuinely incomplete. That is not unusual. In our experience, the most effective recoveries begin from fragments, not complete records.
Strategy: follow-the-money forensics across a layered structure
The immediate priority was forensic – not legal. Before any freezing application could be framed, we needed to establish where the money had gone and whether a freezable pool of assets existed at a reachable point in the chain.
We began with what we had: partial SWIFT message data, the Lithuanian corporate registry, publicly available real-estate registration records, and commercial database extracts covering connected entities. From those sources, we reconstructed the outward payment pattern from the Lithuanian transit account. Three onward transfers emerged, two of which pointed to identifiable real-property interests registered in Lithuania.
The third transfer led to an account in a jurisdiction outside the European Union – reachable in principle, but requiring a longer-form enforcement process. That arm of the matter was deferred. The Lithuanian property interests were the actionable finding.
The strategic decision was to move fast on the domestic Lithuanian assets while simultaneously building the documentary package needed to support a freezing application. Lithuania sits within the EU's mutual recognition and enforcement systems, which simplifies – though does not automate – the process of coordinating interim relief with admitted local counsel.
What the situation called for was a domestic freezing application supported by a forensic narrative – a reconstruction of the payment trail sufficient to satisfy the court that a good arguable case existed and that there was a real risk of dissipation. Both thresholds were met.
Process: reconstruction, application, and result
Clara Bianchi's team at Axiom Trace handled the forensic reconstruction. The work fell into three phases.
First, we mapped the full payment trail from the client's originating bank to the Lithuanian transit account and onward. This used partial SWIFT data, correspondent bank records obtained through informal cooperation with the client's own bank compliance team, and commercial database searches on the intermediate entities. The reconstruction was not perfect – it rarely is. But it was sufficient to establish the broad flow of value and to identify the two real-property interests as likely repositories of traceable proceeds.
Second, we prepared a forensic narrative: a structured chronological account of the payments, the corporate intermediaries, the nominee arrangements, and the ultimate landing points of the funds. This document was designed to be usable by admitted local counsel in Lithuania as the evidential foundation for a freezing application. It included a clear explanation of the gaps in the record and why those gaps did not undermine the overall picture.
Third, admitted local counsel in Lithuania filed for interim protective measures over the identified real-property interests. The application was made without notice to the defendant – standard practice where there is a genuine risk that advance warning will accelerate dissipation. The properties were registered and their ownership structure, while layered, was traceable through the Lithuanian land register.
The interim measures were granted. This did not resolve the underlying claim or guarantee any ultimate recovery. It created a pause – a window in which the assets could not be transferred while the substantive proceedings moved forward.
The matter in the third jurisdiction remained open. Enforcement outside the EU requires a separate recognition process, and the timeline for that arm extended well beyond the Lithuanian phase. That is an honest constraint. Speed in one forum does not automatically translate to speed across all of them.
For a confidential read on whether a similar situation is worth pursuing, contact info@axiomtracel.com.
Transferable lessons: what this matter illustrates
Three things stand out from this engagement and recur across similar matters.
Incomplete records are the norm, not the exception. The myth that a missing paper trail kills recovery is exactly that – a myth. Forensic reconstruction from partial SWIFT data, registry records, and commercial intelligence regularly produces a picture that is workable for court purposes, even when internal account statements are unavailable. We reconstruct payment trails from partial records; this is a core part of what we do, not a special case.
Timing is genuinely decisive. The gap between when funds move and when a freezing application is filed determines what is reachable. In this matter, the real-property interests had not yet been transferred – a situation that existed partly because the dissipation pattern had focused on the liquid account rather than the property holdings. Had we been instructed later, those assets might have moved. Asset tracing and urgent interim relief work together; one without the other leaves value on the table.
The cross-border layer adds real complexity. Follow-the-money work that crosses borders – even within the EU, where mutual recognition frameworks exist – requires coordination between forensic investigators, admitted local counsel, and the client's own legal team. No single actor controls the whole process. The role of a specialist like Axiom Trace is to produce the forensic foundation and to coordinate the sequencing so that legal applications in different forums support rather than undermine each other.
If the trail in your matter leads through Lithuania – or any other jurisdiction where the corporate structure and the asset base do not align – the question is whether a forensic reconstruction can produce a workable picture quickly enough. That is the assessment we start with. You can read more about our broader financial forensics work at our financial forensics insight hub, explore specific guidance on asset recovery in Lithuania at our Lithuania jurisdiction page, and see how similar reconstruction challenges arise in offshore transit points at our guide to reconstructing payment trails through Curaçao.
About Axiom Trace
Axiom Trace is an independent boutique focused on cross-border and crypto asset recovery. We trace assets that have moved across borders or on-chain and coordinate their freezing and recovery – working with defrauded principals, insolvency practitioners, and the lawyers and funders who refer them. We work lawfully and within applicable sanctions regimes, alongside local counsel where proceedings must be filed. We reconstruct payment trails from partial records and identify where value has settled, even when the surface architecture is designed to obscure it. Our forensic work has supported freezing applications in multiple forums across Europe and beyond. To discuss a matter, contact info@axiomtracel.com.
Disclaimer: This publication is for general information only and is not legal advice, nor a promise or prediction of recovery. No outcome is guaranteed. Asset recovery depends on the specific facts and on the law and procedure of each relevant jurisdiction, where local admitted counsel must act. The steps described above reflect general practice; local admitted counsel must act on the ground in Lithuania. Axiom Trace assumes no liability for actions taken or not taken based on this material. For advice on your situation, contact info@axiomtracel.com.
Recovering cross-border or crypto assets?
Confidential first review. We map tracing and recovery options and tell you honestly whether a matter is worth pursuing.
Request a case review