What information a tracer needs from you

A payment leaves your account. Hours pass. Then the realisation arrives – not a bank error, but a fraud. The first instinct is to call the bank. The second is to search for someone who can recover the money. Both are reasonable. Neither, on its own, preserves what a tracer actually needs to work with.

A tracer needs three categories of information from you: the documented flow of the money, the identity and contact details you were given by the fraudster, and a clear account of how the scheme was presented to you. Without these, even a well-resourced investigation starts blind – and delay compounds the problem, because assets move and digital traces fade.

This analysis works through each category in detail, addresses where victims typically lose time, and explains how the information you hold shapes the instruments a recovery specialist can bring to bear.

Why the First Hours Determine the Range of Options

Speed is the most honest thing a tracer can tell a fraud victim. A freezing or disclosure application is typically made without notice to the defendant, precisely because advance warning allows dissipation. That application depends on evidence the victim supplies. If that evidence is incomplete, the application is weakened or delayed – and delay narrows the field.

In our experience, the gap between a fraud being discovered and a victim making first contact with a recovery specialist is often measured in days, sometimes weeks. That gap is almost always the most expensive part of the case. Funds that were traceable on day one may have passed through two or three additional wallets or correspondent banks by day five. Accounts that were open may have been closed. The dormant period – while the victim is reporting to the bank, waiting for a police reference, or simply in shock – is the period during which the fraudster consolidates the exit.

What should you do in those first hours? Document everything, change nothing, and send the full picture to a specialist as fast as you can. The rest of this analysis explains what "everything" means.

The steps below apply to fraud victims, insolvency practitioners, and the lawyers instructing them. The categories are the same; the emphasis shifts depending on who holds the original relationship with the fraudster.

Category One: The Money Trail – What Moved, Where, and When?

The most important documents in any tracing instruction are the ones that show the actual movement of funds. A tracer uses these to reconstruct the payment trail before any formal process begins, and to anchor the first witness statement in a freezing or disclosure application.

You should gather, as a first step:

• Bank statements for every account that sent or received funds connected to the fraud, covering a period starting before the first payment.
• Transaction confirmations, SWIFT references, or payment receipts for every transfer you made.
• Any account details you were given for the receiving end – account number, sort code, IBAN, routing number, or wallet address.
• Cryptocurrency transaction IDs (transaction hashes) for any on-chain transfers, together with the wallet addresses used at each end.
• Screenshots of any payment platform, investment portal, or exchange interface that shows your balance or transaction history.

Why does the receiving account matter so much? Because it is the first choke point. A Bankers Trust order can compel a receiving bank to disclose what happened to the funds after they arrived – where they went next, under what instructions, and whether they were swept. But that order is directed at the receiving bank, and the receiving bank is identified from the account details on your transfer confirmation. Without those details, the tracer is asking a court to freeze or investigate an account they cannot yet identify. Courts do not grant relief in a vacuum.

In crypto matters, the transaction hash is the equivalent of the SWIFT reference. It anchors the on-chain trace. Blockchain-analytics tools can follow the funds through multiple hops, through mixers or bridging protocols, and into exchange deposit addresses. But the trace starts at the transaction you made. If you cannot supply the hash, the tracer must work backwards from your wallet history – possible, but slower.

A common mistake at this stage is to send the tracer a summary rather than the underlying documents. A victim who says "I sent £150,000 to an account in Cyprus on three dates in October" is less useful than a victim who attaches the three payment confirmations, the account details they were given, and the bank statement showing the debits. The documents are the evidence. The summary is interpretation.

Category Two: The Fraudster's Digital Footprint – What Identity Were You Given?

Every fraudster presents an identity. It is almost always false. But even a false identity leaves traces, and those traces feed a Norwich Pharmal order – a disclosure order compelling a third party who holds information to name the wrongdoer. The application requires you to show that the third party genuinely holds identifying information. Your records of the identity you were given are the foundation of that showing.

You should preserve and supply:

• All names, titles, and company names the fraudster used – including variations across different communications.
• Every email address, phone number, and messaging handle (WhatsApp, Telegram, Signal, WeChat, or similar).
• Website URLs, domain names, and any company registration numbers or regulatory references the fraudster supplied (even if these are forged, they are traceable).
• Physical addresses given for offices, correspondence, or registration – including addresses on contracts, letterhead, or account-opening documents.
• Copies of any identity documents sent to you during an onboarding or KYC process – passports, driving licences, utility bills.
• Names of any individuals introduced as colleagues, advisers, brokers, or third-party auditors.

Do not assume that a false identity is worthless. Domain registrars hold registration records. Phone numbers are linked to SIM registrations and network providers. Email headers contain routing information. Messaging applications have account records. The fraudster who fabricated every document still had to register a domain somewhere, and that registrar is a third party who can be compelled to disclose. A Norwich Pharmal order is precisely the instrument for that situation.

In our experience, victims often discard or lose access to the initial communications once they suspect fraud – either because they delete them in distress or because the fraudster's website goes dark and their email addresses stop responding. The moment you suspect a fraud, the instinct to cut contact is understandable. But do not delete the communication history. Export it first. An email thread that looks worthless to a victim often contains routing metadata, IP addresses embedded in headers, and domain-tracing leads that a specialist can pursue.

Category Three: The Full Story of How the Scheme Worked

A tracer needs to understand the scheme as it was presented to you – not because the narrative is interesting in itself, but because it maps the probable structure of the fraud and suggests where the money went. Different fraud typologies use different financial infrastructure. Knowing the typology narrows the investigation.

You should be prepared to explain:

• How you first came into contact with the fraudster – a social media message, a WhatsApp introduction, a cold call, an email, or a referral from someone you trusted.
• What the investment, service, or business relationship was described as – the asset class, the promised return, the mechanism, the currency.
• How long the scheme ran before the fraud became apparent – weeks, months, years.
• The full sequence of payments: first payment, subsequent payments, and any funds you were persuaded to add after the fraud began (in cases where the victim was strung along).
• Any withdrawal attempts – whether you were told you could withdraw, whether a withdrawal was blocked, and on what grounds.
• Whether any third parties were involved – introducers, solicitors, custodians, auditors, or platform administrators who presented themselves as independent.
• Whether you received any "returns" before the fraud ended – simulated profits that are common in certain scheme types.

Why does the scheme's mechanics matter for a tracer? Because a romance fraud that moved funds through personal bank accounts has a different recovery architecture than a crypto investment fraud that used a fake exchange. The first may lead to a Bankers Trust order against a high-street bank and a proprietary injunction in a common-law forum. The second may lead to a freezing order over digital assets, a disclosure order against a virtual-asset service provider (VASP), and – if stablecoins were involved – a direct approach to a stablecoin issuer to freeze the relevant balance.

A tracer who understands the scheme type can assess, in the first conversation, which instruments are available and which forums have jurisdiction. That assessment is faster and more accurate when you have told them the full story.

If you have referred the matter to a lawyer, ensure the lawyer's instruction letter contains all three categories. A tracer working from an incomplete instruction will spend the first days asking questions that the victim could have answered at the outset.

To understand how different fraud types affect recovery routes, the Fraud Response cluster at axiomtracel.com/insight/fraud-typologies/ covers a range of scheme types and the investigative approaches they require.

What Contrasting Positions Exist on Disclosure to a Tracer?

There is a genuine tension in recovery instructions between completeness and privilege. It is worth addressing directly, because it is a point on which practitioners disagree.

One position holds that the victim should disclose everything to the tracer as early as possible, without filtering. The argument is that a tracer working from partial information will make worse decisions than one working from the complete picture, and that the risk of self-incriminating disclosure is generally low in standard fraud cases where the victim is clearly the deceived party.

The contrasting position – held more strongly by lawyers who instruct tracers than by tracers themselves – is that the initial disclosure to a tracer should be filtered through legal privilege where possible. The concern is that material passed to an investigator before a privilege structure is established may be discoverable by the defendant in subsequent proceedings. This matters most in complex cases where the victim's own conduct may be scrutinised – for example, where due diligence failures allowed a large fraud to run for years, or where the victim is a corporate entity and regulatory obligations may be relevant.

In our experience, the practical resolution is this: get the material to a specialist fast, and deal with privilege structure promptly thereafter. A fraud that is not investigated because the victim is waiting to establish privilege is a fraud where the assets dissipate while the privilege question is being resolved. The two steps can run in parallel – but the tracing cannot wait.

There is a second tension worth naming: between disclosure to the tracer and disclosure to law enforcement. Some victims believe that reporting to the police or a financial-intelligence unit is an alternative to hiring a tracer. It is not. Law enforcement and private recovery run in parallel. Law enforcement may preserve evidence that supports a private claim; a private freezing or disclosure order may reach assets and information that law enforcement cannot access under its own process. Neither route forecloses the other. In cases we have worked on across several jurisdictions, the two tracks have operated simultaneously without conflict.

How Does the Information You Hold Shape the Instruments Available?

The instruments a tracer can recommend depend on what you can prove, and what you can prove depends on what documents you hold. This is the practical link between the categories above and the relief a court will grant.

Consider three scenarios:

Scenario A – The victim holds a payment confirmation, the receiving account details, and a complete email thread. A Bankers Trust order against the receiving bank is a realistic first step. A Norwich Pharmal order against the domain registrar, email provider, or hosting company is available for identity disclosure. A proprietary injunction can be sought once the defendant is identified. The tracer has enough to open the file and draft the first application within days.

Scenario B – The victim holds only a bank statement showing a debit, a phone number, and a general description of the scheme. The tracer must first establish the identity of the receiving account from the bank's own SWIFT records, which requires the bank's cooperation or a separate disclosure order. The phone number may support a disclosure application to the network provider. The scheme description helps characterise the fraud type, but it does not provide the documentary anchor for an application. Recovery is possible – but the timetable is longer, and the costs of the preliminary steps are higher.

Scenario C – The victim transferred cryptocurrency to a wallet address and has the transaction hash. On-chain tracing begins immediately using blockchain-analytics tools. Public blockchains are transparent: on-chain movements are traceable even when identities are hidden behind wallet addresses. The trace may follow the funds through multiple hops into a centralised exchange deposit address. At that point, a disclosure order against the VASP – requiring it to identify the account holder – becomes the next instrument. If the funds were converted to stablecoins, a direct freeze of the specific token balance by the stablecoin issuer is available, in appropriate legal circumstances. All of this depends on having the transaction hash and wallet address at the outset.

The practical lesson across all three scenarios is the same: the stronger your documentary record, the faster the tracer can move to a formal application, and the less time and cost is spent on preliminary investigation that you could have avoided by preserving the right documents from the start.

For matters where cross-border enforcement will be needed – enforcement of a judgment or award in another jurisdiction – a separate feasibility assessment is typically the right starting point. See axiomtracel.com/services/feasibility-report/ for the approach Axiom Trace takes to assessing whether a matter is worth pursuing.

What Tracers Cannot Work With – and the Myth That Reporting to the Bank Is Enough

A persistent myth in fraud recovery is that reporting the fraud to your bank starts the clock on recovery. It does not. A bank's fraud team has obligations to you as a customer, but those obligations are narrow. A bank will typically investigate whether its own systems were used in a way that breaches its policies. It will not trace the full payment chain across multiple correspondent banks. It will not identify the beneficial owner of the receiving account. It will not apply for a freezing order or seek disclosure from a third-party registrar.

Reporting to the bank is necessary. It is not sufficient.

A second myth – more dangerous – is that any firm offering to recover your funds is doing the same work. The recovery-scam sector is real and is designed to exploit victims who are already in distress. A second operator approaches, claims to have recovered funds for others in identical situations, requests an upfront fee, and disappears. What distinguishes a legitimate tracer from a recovery scam?

• A legitimate tracer explains the instruments available and the process by which they operate. They do not promise outcomes.
• A legitimate tracer asks for your documents first. A scam operator asks for your money first.
• A legitimate tracer will tell you honestly when a matter is unlikely to be recoverable. A scam operator tells every victim that recovery is guaranteed.
• A legitimate tracer works within applicable law, including sanctions regimes. They coordinate with local counsel where proceedings must be filed in another jurisdiction.

No recovery is guaranteed. The instruments described in this analysis – freezing orders, Norwich Pharmal orders, Bankers Trust orders, on-chain tracing followed by VASP disclosure – are powerful tools. But their availability depends on the facts of your matter, the evidence you hold, the jurisdiction where the funds can be reached, and the time that has elapsed. A specialist who tells you otherwise is not being straight with you.

If you have already been approached by a second operator offering recovery of your first loss, treat it with the same scepticism you might have applied, in hindsight, to the original fraud.

Cross-Border Complications: When the Money Has Left Your Jurisdiction

Many fraud victims assume that because the fraud happened in their country, the recovery process will also happen in their country. That is rarely true. A worldwide freezing order can, in principle, reach assets outside the forum in which it was granted, subject to conditions and safeguards. But reaching assets in a foreign jurisdiction typically requires that jurisdiction's cooperation – either through the recognition of a foreign judgment or order, or through parallel proceedings commenced locally.

The cross-border element introduces three specific complications for the information a tracer needs.

First, the tracer needs to know where the money appears to have gone, not just where it was sent. The receiving account in one jurisdiction is often a transit account. The ultimate destination – the jurisdiction where the beneficial owner's assets sit – may be different. The documents you hold may show only the first step. The tracer's job is to follow the chain, but they need your documents to identify where that chain begins.

Second, the choice of forum for emergency relief depends on where assets are located and which courts have personal jurisdiction over the defendant. If you have been given false information about the fraudster's location, the forum question is harder. The identity documents and digital footprint you preserved become more important – not less – when the fraudster's actual location is unknown.

Third, in matters that involve offshore corporate structures – shell companies, nominee directors, or trust arrangements – the UBO register of the relevant jurisdiction, or a corporate disclosure order, may be the route to the beneficial owner's identity. The information you supply about the corporate structure of the entity you dealt with (including any company registration numbers or registered address, even if false) helps direct that inquiry.

For a concrete example of how jurisdiction affects recovery routes in offshore-connected fraud, the analysis at axiomtracel.com/insight/fraud-typologies/investment-fraud-recovery-routes-in-nevis/ addresses a specific offshore context in detail.

The New York Convention provides for recognition and enforcement of foreign arbitral awards across most signatory states, which is relevant if the dispute arose under an agreement with an arbitration clause. But arbitral enforcement presupposes an award, which presupposes proceedings. The threshold question for most fraud victims is much earlier: can I freeze the assets before they move further?

Preparing Your Information Package: A Practical Summary

What does a well-prepared client instruction look like? It is not a long narrative. It is a set of organised documents with a covering note. The covering note answers four questions:

• When did the money move, how much, and to where?
• Who did you deal with – what names, platforms, and contact details were you given?
• How was the scheme presented – what were you told you were investing in or paying for?
• What evidence do you currently hold – and what have you already provided to the bank or law enforcement?

The documents that should accompany that note are everything listed in categories one, two, and three above. Export email threads in their original format, not as screenshots – the headers matter. Download transaction records from any platform before it goes offline. If a website has already been taken down, run an archive search for cached versions and note the URL.

Should you speak to a recovery specialist before you have all of this assembled? Yes – always. A specialist can tell you in the first call what is most urgent to preserve, and they can begin the preliminary assessment of which instruments are available while you gather the full documentation. But the call should be followed by the documentation, as fast as you can assemble it. The assessment is only as good as the facts it rests on.

Is every fraud recoverable? No. The honest answer is that the prospects depend on what was taken, where it went, how fast the response was, and whether the fraudster can be identified and located. A tracer who tells you every loss is recoverable is not being honest with you. A tracer who tells you no loss is recoverable without reviewing your documents is equally uninformative. The answer sits in the facts of your specific matter, and those facts live in the information you bring to the first conversation.

The steps above cover the typical pattern of a first instruction. Your matter turns on specific facts – what was taken, where it went, and which forums can act on the evidence you hold. A confidential case review tells you whether it is worth pursuing and what the realistic first steps are. Contact Axiom Trace at info@axiomtracel.com to request that review.

Related Analysis

• Fraud Response: typologies, first response, and recovery routes – the full cluster covering scheme types and victim action-guides.
• Feasibility Report – Axiom Trace's structured assessment of whether a matter is realistically recoverable and what it would take to pursue it.
• Investment Fraud Recovery Routes in Nevis – how offshore corporate structures affect the instruments available and the forum choices a recovery specialist must make.

Frequently Asked Questions

Q: What should I do in the first hours after a fraud?

A: Do not delete any communications. Export email threads and preserve transaction records in their original format. Contact your bank to flag the transfer – this stops further payments and begins a paper trail – but understand that a bank report alone does not recover funds. Simultaneously, gather the documents described in this analysis and contact a recovery specialist. Hours matter: assets dissipate and digital traces fade. Reporting to the bank is a necessary step; it is not a substitute for a tracing and recovery instruction.

Q: Is my loss realistically recoverable?

A: Recovery depends on specific facts: the amount taken, where it went, how quickly the response begins, and whether the fraudster can be identified and located. No outcome is guaranteed. A recovery specialist can assess viability only after reviewing your documents. The clearer and more complete your records – payment confirmations, account details, communication history – the faster and more accurate that assessment will be. If you are uncertain, a feasibility report is a structured way to answer the question before committing to full proceedings. You can also use the viability check at axiomtracel.com/viability-check/ as a first orientation.

Q: How do I avoid a second, recovery-focused scam?

A: Recovery scams – operators who approach fraud victims and offer to recover their losses for an upfront fee – are a well-documented second-stage fraud. A legitimate recovery specialist will ask for your documents before asking for anything else. They will explain the instruments available (freezing orders, disclosure orders, on-chain tracing) and will not promise or guarantee recovery. They will tell you honestly if a matter is unlikely to be recoverable. If an operator approaches you unsolicited, claims guaranteed recovery, or asks for a fee before conducting any investigation, treat it as a fraud. Legitimate recovery is conditional, measured in weeks to months, and grounded in evidence – not promises.

About Axiom Trace

Axiom Trace is an independent boutique focused on cross-border and crypto asset recovery. We trace assets that have moved across borders or on-chain and coordinate their freezing and recovery – working with defrauded principals, insolvency practitioners, and the lawyers and funders who refer them. We work lawfully and within applicable sanctions regimes, alongside local counsel where proceedings must be filed.

We regularly advise clients in the first hours after a loss, when the information available is incomplete and the window for effective action is narrowing. In our experience, the quality of the initial instruction – the documents the client brings to the first call – is one of the strongest predictors of how quickly the investigation can move. We have traced assets across banking and on-chain channels in multiple jurisdictions, coordinating with local counsel to pursue freezing and disclosure relief where proceedings require it.

To discuss a matter, contact info@axiomtracel.com.

Disclaimer: This publication is for general information only and is not legal advice, nor a promise or prediction of recovery. No outcome is guaranteed. Asset recovery depends on the specific facts and on the law and procedure of each relevant jurisdiction, where local admitted counsel must act. Axiom Trace assumes no liability for actions taken or not taken based on this material. For advice on your situation, contact info@axiomtracel.com.