Case study: freezing assets in Lithuania – fraud response

A payment clears on a Tuesday. By Thursday, the receiving entity in Lithuania has moved the funds onward. The victim – a mid-sized trading company in Western Europe – discovers the loss when a legitimate counterparty calls to ask why the invoice remains unpaid.

When funds reach Lithuania and begin moving further, an interim freezing application supported by evidence of dissipation is the instrument most likely to arrest that movement. Speed is not a preference here – it is the condition on which recovery depends. Local admitted counsel must act on the ground in any Lithuanian proceedings; this case study describes how a coordinated response can work in practice.

The sections below trace the situation, the strategy chosen, the steps taken, and the lessons that apply to comparable cross-border fraud recovery matters.

Situation: funds in transit across a Baltic border

The client was a trading company that had paid a substantial invoice – funds in the low seven figures – to a supplier it had vetted through normal commercial channels. The supplier's bank details had been changed, without the client's knowledge, by a party who had compromised the supplier's email system. A business email compromise had redirected the payment to a Lithuanian-registered entity with no trading history.

By the time the client contacted us – a matter of days after the payment – the receiving account had already disbursed a large portion of the funds to accounts in two further jurisdictions. A residual balance remained in Lithuania. The receiving entity appeared to be a shell: no employees, no premises, a recently appointed nominee director.

The window for freezing was narrow. We were retained on a Friday afternoon. Every hour mattered.

Strategy: targeting the residual balance before it moved

The strategic priority was not to build a full legal case. It was to stop the remaining funds from leaving Lithuania before the case could be built.

We assessed three options. An urgent application to the Lithuanian courts for an interim asset-freezing measure was the only tool fast enough to be useful. A letter to the receiving bank requesting a voluntary hold carries no legal weight in this context and creates the risk of alerting the fraudster. A criminal complaint can trigger investigative freezing powers, but the timeline is unpredictable and control passes to the prosecutor.

We recommended a two-track approach: an urgent civil interim freezing application, filed without notice to the defendant to prevent dissipation, running in parallel with a criminal complaint to the competent Lithuanian authority. The civil track preserved the client's control over timing; the criminal track created a secondary enforcement pathway.

Lithuanian civil procedure permits interim protective measures in urgent cases, and the courts have granted such applications in business email compromise matters where evidence of dissipation was clear. Local admitted counsel filed the application.

Process: from instruction to interim order

Our role in the first 48 hours was to assemble the evidence package local counsel needed to support the without-notice application. That meant reconstructing the payment trail – identifying the sending bank, the correspondent route, the Lithuanian receiving bank, and the account details of the registered entity.

We also prepared a corporate trace on the Lithuanian entity. Beneficial ownership registers and company filings allowed us to identify the nominee director and the registered address, which matched several other newly formed entities. This pattern is a recognised signal of a shell network used in payment diversion fraud.

The without-notice application was filed within 72 hours of instruction. The Lithuanian court granted an interim freezing measure over the residual balance in the receiving account. The order was served on the bank before the end of the following business day.

On-chain tracing confirmed that a portion of the disbursed funds had been converted to crypto assets and moved through several wallets. That strand remained open – a freezing order over digital assets and a disclosure application against the relevant exchange were the instruments under consideration. The cross-border disbursements to the two further jurisdictions were referred to allied counsel in those forums for parallel proceedings.

Transferable lessons for fraud recovery involving Lithuania

Several points from this matter apply broadly to asset recovery in Lithuania and in Baltic cross-border fraud cases.

• The residual balance is often the only recoverable asset. Fraudsters move funds in stages. By the time the victim reports the loss, the bulk has gone. The question is whether anything remains in the first-stop jurisdiction – and whether it can be frozen before the next transfer.
• A without-notice application is the standard approach when tipping-off risk is real. Notifying the fraudster through a letter to the bank before legal process is in place almost always accelerates dissipation. In our experience, voluntary-hold requests to banks rarely succeed in shell-entity fraud.
• Criminal and civil tracks are not mutually exclusive. Running both in parallel is preferable where the facts support it. The civil track gives the victim more procedural control; the criminal track can unlock investigative tools unavailable in civil proceedings.
• On-chain conversion is a consistent pattern in payment diversion fraud. Tracing should begin immediately, even before the civil application is filed, because blockchain-analytics tools can follow the funds in near real time. Delay allows for mixing and further hops.
• Shell entities leave recoverable traces. UBO registers, beneficial ownership filings, and company registry data – even where imperfectly maintained – often reveal the nominee network. That evidence is essential to any application for relief against third parties who hold or have moved the assets.

This matter is one of several we have handled in the Baltic region. The cross-border movement – from Western Europe into Lithuania and onward – is a recurring pattern. Fraud response in this context requires a coordinated engagement across at least two legal systems simultaneously. That coordination, managed from a single point of instruction, is what allows the civil and criminal tracks to run without conflict.

If funds have moved and you are uncertain whether anything remains reachable, a confidential case review is the right first step. Contact info@axiomtracel.com.

For further reading on the fraud typologies that generate these patterns, see our Fraud Response insight index. For a jurisdiction-specific overview, visit our Lithuania jurisdiction guide. For a comparable cross-border matter involving a less cooperative forum, see our analysis of recovering scam proceeds sent to the Marshall Islands.

About Axiom Trace

Axiom Trace is an independent boutique focused on cross-border and crypto asset recovery. We trace assets that have moved across borders or on-chain and coordinate their freezing and recovery – working with defrauded principals, insolvency practitioners, and the lawyers and funders who refer them. We work lawfully and within applicable sanctions regimes, alongside local counsel where proceedings must be filed. In matters like this one, our value is speed: assembling the evidence package and coordinating across jurisdictions before the window closes. To discuss a matter, contact info@axiomtracel.com.

Disclaimer: This publication is for general information only and is not legal advice, nor a promise or prediction of recovery. No outcome is guaranteed. Asset recovery depends on the specific facts and on the law and procedure of each relevant jurisdiction, where local admitted counsel must act. The steps described above reflect general practice; local admitted counsel must act on the ground in any Lithuanian proceedings. Axiom Trace assumes no liability for actions taken or not taken based on this material. For advice on your situation, contact info@axiomtracel.com.