Top tips from investigators in asset recovery cases

Alejandro Gomez Igbo
Forensic Risk Alliance (FRA), London
AGomezIgbo@forensicrisk.com

Jonathan Benton
Intelligent Sanctuary (iSanctuary), Cambridge
info@isanctuary.io

Joana Rego
Raedas, London
jrego@raedas.com

Keith Oliver
Peters & Peters, London
keoliver@petersandpeters.com

Rachel Cropper-Mawer
RCM Law, Jersey
rachelcroppermawer@gmail.com

In investigations, the most valuable breakthroughs rarely arrive in the form of a newly discovered document. More often, they come from a person – someone who can explain what the documents already say, why they exist and what they really mean. Sources and witnesses, in that sense, are not distinct categories but points on a continuum. A conversation that begins informally may later carry evidentiary weight, which is why every engagement must be approached with care from the outset.

Unlike law enforcement, investigators do not compel cooperation. People speak because they trust the person sitting across from them. That trust is built through preparation, clarity of purpose and an ability to listen as much as to ask. Lawyers, by training and reputation, can be intimidating; investigators are often better placed to occupy this middle ground: curious rather than adversarial, comfortable with uncertainty and able to build relationships without overpromising or blurring professional boundaries. They are not legal advisers, nor confidants in the therapeutic sense.

Cultural awareness matters as much as factual mastery. Gender dynamics, language choice and social norms shape how conversations unfold, and misjudging them can close doors before they open. Ultimately, rapport – not charm, but genuine empathy, attentiveness and respect – is the investigator’s most powerful tool. It allows conversations to happen on the other person’s terms before moving, carefully, to the investigator’s.

Preparation is the quiet determinant of success. Identifying individuals is rarely difficult in a world where personal data circulates freely. Understanding motivation is, however, much harder. Before any approach, investigators must think carefully about why someone might speak, what they stand to lose by doing so, and where sensitivities lie. Direct outreach is usually brief and restrained; misrepresentation is unnecessary and can be corrosive. And in a reflection of a simple truth, third-party introductions prove most effective: people are more willing to speak when trust is borrowed.

Ethical cooperation depends on transparency and foresight: avoiding inducements, separating insight from hearsay and ensuring that what emerges can withstand scrutiny later. There is no formula for success – but preparation, judgment and human understanding can make the difference between silence and substance.

The use of artificial intelligence (AI) in investigations has shifted document review from a back-end exercise into an active investigative tool. Modern platforms now allow lean teams to navigate very large volumes of data in short timeframes, surfacing patterns, inconsistencies and behavioural signals that would previously have taken weeks or months to uncover. Tools such as Relativity aiR for Review^[1] are a clear example of this shift. They are most valuable when used early, to generate insight and direction rather than simply confirm what is already suspected. As these tools become more widely available (at no additional cost) the real differentiator is no longer the technology itself but the quality of the prompting, the underlying investigative hypothesis and the judgement applied to the results. AI speeds up understanding, but it still relies on disciplined and critical thinking.

Speed should still be balanced with a strong grasp of evidence integrity and privacy boundaries, particularly in cross-border matters. Investigations increasingly span jurisdictions with very different data protection regimes, and assumptions that are held in one country may be invalid in another. As an example, in Mexico, legitimate interest is not recognised as a lawful basis for processing personal data. That reality forces teams to rethink collection strategies from the outset, including consent, necessity and proportionality. Tool choice, therefore, becomes a legal and strategic decision, not just a technical one. Knowing which forensic methods can be used, and where, is critical to preserving admissibility.

How digital evidence is collected also has a direct impact on cooperation. Mobile device extraction can be extremely powerful, but it can also feel highly intrusive to a witness if handled without care. A proportionate approach, such as isolating specific applications such as WhatsApp rather than performing a full device image, can maintain forensic integrity while making the process more comfortable for the individual involved. In asset recovery work, evidence only creates leverage if it is both persuasive and defensible. Speed and sophistication matter, but outcomes ultimately depend on whether the process stands up to scrutiny long after the investigation is over.

Project Apex illustrated key investigative lessons from a major crypto fraud in which two investors lost 124 BTC, valued at approximately £11 million. The scam combined AI voice calls, fake trading platforms and prolonged grooming over WhatsApp, with funds rapidly laundered through long wallet chains. Once assets moved into non-custodial environments, recovery options became extremely limited. The case exposed slow and inconsistent global freeze powers, reduced intervention opportunities and the highly engineered nature of trust in modern scams.

A core lesson was the importance of speed. Crypto laundering is time sensitive, and tracing must begin immediately. Legal freezing orders are often slow, costly and inconsistently enforced, making early engagement with cooperative exchanges critical. In practice, direct relationships and industry coalitions can disrupt off-ramps faster than formal legal processes.

Effective investigations also require prioritisation. Early peeling chains rarely hold recoverable funds, so efforts should focus on custodial endpoints, high-value off-ramps and liquidity providers. Strategy should be guided by probability of recovery rather than theoretical tracing depth.

The scale of the scam should determine the scale of the response. Fake online trading platforms often indicate multiple victims and co-mingled funds across organised networks, requiring broader jurisdictional coverage and longer timelines. Project Apex also highlighted the risks of relying solely on analytics tools, where attribution errors can misdirect legal action. Overall, the case demonstrated that successful recovery depends on speed, judgement, intelligence sharing and trusted partners, even in highly complex cases.