Investigative Steps

  • Increase FontDecrease Font
  • Download, Save and Print this Section
  • Assemble Toolkit
  • Print Text-Only Page
  • Bookmark
  • View Sitemap

Investigative Steps

Not all criminal investigations require in-depth documentation, but the nature of identity crime is such that it warrants superior organization not only to help investigators make progress toward arrests, but also for the purposes of helping victims and preparing for prosecution.

Remember that you will have to explain the case to a prosecutor who will in turn have to explain it to a jury. Due to the complexity of the cases, it is very helpful to keep detailed and organized case files to make sure that it is possible later to tell a coherent and logical story about the crime and the suspect’s involvement.

The organizational methods often will benefit by use of a spreadsheet or other case management software. There are courses available through federal and regional law enforcement agencies that teach these methods. They are not designed solely for identity crime investigations but are significant in the investigation of all organized criminal enterprises.

The following basic investigative steps are recommended once a reported complaint moves into an identity crime case:

Step What Happens
Review the Case

The investigator reviews the details provided in the initial interview with the victim. If the detective was the initial interviewer s/he is re-checking known facts. If s/he is tasked with the follow-up investigation, s/he will want to become familiar with the facts reported. The review is also intended to discern that the facts meet the elements of the crime classification and help decide what information is needed from the victim in the next interview.

Re-Interview the Victim

The follow-up interview is conducted to determine if the facts have changed (like in an incident of false reporting), or new facts have been learned by the victim. The victim can clarify any information in the initial report that may be unclear. The detective will also have the opportunity to establish that the victim has in fact followed up on the steps s/he was advised to take at the initial interview.

Authenticate the Crime

The re-interview may have provided more information to help determine the true nature of the complaint and identify whether or not the incident involves

  • False reporting
  • Civil dispute
  • Domestic dispute
  • Misidentification
  • Another (additional) crime
Begin Analysis

Based upon the known facts, begin to state the “who, what, where, when, why, and how” of the case. Like in any investigation, this will be a continuous process as evidence and leads are tracked down and results are analyzed.

Who: Victim information and suspect information, if known
What: Purchase, theft, etc., using victim’s identifiers. Which identifiers were used?
Where: Merchant locations or IP addresses logged, delivery addresses, land line phone numbers, etc.
When: As per billing/account statements, etc.
Why: Motive
How: Were the identifiers compromised? Were the identifiers used? e.g., Internet, phone purchases, benefits

Pursue Initial Leads

What point in the criminal enterprise is exposed?
Where do the facts thus far put us in the criminal enterprise? Merchandise drops may indicate the location or a place to start looking for those involved in passing off the identities for profit. IP addresses may indicate where the computer was located that was involved in the passing of identities. If the locations are outside your jurisdiction what is the next step?

Gather Evidence – Be Timely and Careful with It17

Through victim’s consent or through subpoena/court order, investigators will need documentation from financial institutions and government agencies.

The investigator will begin creating a paper and digital trail of physical evidence. Do not overlook the traditional investigative skills learned through training and experience. Not all documents in the trail will be digital. Paper document evidence will exist and is subject to forensic treatment. Security surveillance video of the target and surrounding businesses still exists and suspect photo arrays still need to be shown to witnesses. The investigator/detective still needs to hit the streets and look for witnesses and other physical evidence that may put a subject at the scene where an ATM skimmer may have been employed, or a computer used at an Internet café.

Create a Timeline

Timelines are important in that they produce a visual concept of the incident as dates and time are concerned. Identity crimes are complicated, and a timeline releases the investigator from committing these details to memory when it comes to evaluating data and conducting interviews. An examination of the timeline reveals any lack of detail that may need to be addressed and eventually gives supervisors and the prosecutor the ability to understand the case. Each entry into the timeline should note the source of the information and should only deal with event time.

Build the Cast of Characters

Keep track of all the actors, locations and businesses involved. Each needs to be identified by their various identities or appearances. Listing out this information frees up the investigator from memorizing all the individual details and connections and where the information is located for reference during the investigation.

Conduct Link Analysis

Use your department resources as well as FTC’s ID Theft Clearinghouse on Consumer Sentinel https://register.consumersentinel.gov/ and the U.S. Attorney’s Office NICLE program http://www.usdoj.gov/usao/pae/News/Pr/2008/jul/niclerelease.pdf.

Putting all the information together in a manner that relates persons, places and events through phone records, IP addresses, etc., is a challenge that can overwhelm a single detective assigned to a complex case. Nevertheless, it is an important aspect that is required in some cases to take down a whole criminal organization right to the top.

Create an Evidence Book with an Index
  • Include your timeline and cast of characters.
  • Note any follow-up steps on missing or newly important documents including:
    • Customer record
    • Signature card
    • Credit application
    • Transaction history
    • Payment history and method (online or mail)
    • Addresses and telephone numbers associated with the account
    • Additional authorized users
    • Videos of any in-person transactions
Look for Common Points of Compromise Across Different Crimes and/or Additional Victims

Remember that these crimes are rarely isolated, and that they often have companion crimes, as they are instrumental in concealing another crime or in creating financial gain for the perpetrator.

Collaborate & Share Information

As the case progresses, the requirement for outside agencies and investigators from financial institutions assisting the investigation will become necessary. This necessity will be based on your agency’s jurisdiction or an element of the crime or ability to access persons, places or things outside its authority. In some circumstances a federal agency may be the correct organization to conduct the primary investigation.

17As more commerce is being conducted on the Internet it is important to act immediately to preserve evidence or information that may be stored on digital media. Information may have a short shelf life in these circumstances due to the ever expanding need for increased storage media. Security video is also subject to the demands of storage needs as it too becomes more digital based. Older technology such as video tape may have an even shorter life span as equipment ages and becomes obsolete. Paper documents as well as other physical evidence should be treated as in other crimes to preserve it for prosecutorial value.

Return to top of page

Investigative Steps

Not all criminal investigations require in-depth documentation, but the nature of identity crime is such that it warrants superior organization not only to help investigators make progress toward arrests, but also for the purposes of helping victims and preparing for prosecution.

Remember that you will have to explain the case to a prosecutor who will in turn have to explain it to a jury. Due to the complexity of the cases, it is very helpful to keep detailed and organized case files to make sure that it is possible later to tell a coherent and logical story about the crime and the suspect’s involvement.

The organizational methods often will benefit by use of a spreadsheet or other case management software. There are courses available through federal and regional law enforcement agencies that teach these methods. They are not designed solely for identity crime investigations but are significant in the investigation of all organized criminal enterprises.

The following basic investigative steps are recommended once a reported complaint moves into an identity crime case:

Step What Happens
Review the Case

The investigator reviews the details provided in the initial interview with the victim. If the detective was the initial interviewer s/he is re-checking known facts. If s/he is tasked with the follow-up investigation, s/he will want to become familiar with the facts reported. The review is also intended to discern that the facts meet the elements of the crime classification and help decide what information is needed from the victim in the next interview.

Re-Interview the Victim

The follow-up interview is conducted to determine if the facts have changed (like in an incident of false reporting), or new facts have been learned by the victim. The victim can clarify any information in the initial report that may be unclear. The detective will also have the opportunity to establish that the victim has in fact followed up on the steps s/he was advised to take at the initial interview.

Authenticate the Crime

The re-interview may have provided more information to help determine the true nature of the complaint and identify whether or not the incident involves

  • False reporting
  • Civil dispute
  • Domestic dispute
  • Misidentification
  • Another (additional) crime
Begin Analysis

Based upon the known facts, begin to state the “who, what, where, when, why, and how” of the case. Like in any investigation, this will be a continuous process as evidence and leads are tracked down and results are analyzed.

Who: Victim information and suspect information, if known
What: Purchase, theft, etc., using victim’s identifiers. Which identifiers were used?
Where: Merchant locations or IP addresses logged, delivery addresses, land line phone numbers, etc.
When: As per billing/account statements, etc.
Why: Motive
How: Were the identifiers compromised? Were the identifiers used? e.g., Internet, phone purchases, benefits

Pursue Initial Leads

What point in the criminal enterprise is exposed?
Where do the facts thus far put us in the criminal enterprise? Merchandise drops may indicate the location or a place to start looking for those involved in passing off the identities for profit. IP addresses may indicate where the computer was located that was involved in the passing of identities. If the locations are outside your jurisdiction what is the next step?

Gather Evidence – Be Timely and Careful with It17

Through victim’s consent or through subpoena/court order, investigators will need documentation from financial institutions and government agencies.

The investigator will begin creating a paper and digital trail of physical evidence. Do not overlook the traditional investigative skills learned through training and experience. Not all documents in the trail will be digital. Paper document evidence will exist and is subject to forensic treatment. Security surveillance video of the target and surrounding businesses still exists and suspect photo arrays still need to be shown to witnesses. The investigator/detective still needs to hit the streets and look for witnesses and other physical evidence that may put a subject at the scene where an ATM skimmer may have been employed, or a computer used at an Internet café.

Create a Timeline

Timelines are important in that they produce a visual concept of the incident as dates and time are concerned. Identity crimes are complicated, and a timeline releases the investigator from committing these details to memory when it comes to evaluating data and conducting interviews. An examination of the timeline reveals any lack of detail that may need to be addressed and eventually gives supervisors and the prosecutor the ability to understand the case. Each entry into the timeline should note the source of the information and should only deal with event time.

Build the Cast of Characters

Keep track of all the actors, locations and businesses involved. Each needs to be identified by their various identities or appearances. Listing out this information frees up the investigator from memorizing all the individual details and connections and where the information is located for reference during the investigation.

Conduct Link Analysis

Use your department resources as well as FTC’s ID Theft Clearinghouse on Consumer Sentinel https://register.consumersentinel.gov/ and the U.S. Attorney’s Office NICLE program http://www.usdoj.gov/usao/pae/News/Pr/2008/jul/niclerelease.pdf.

Putting all the information together in a manner that relates persons, places and events through phone records, IP addresses, etc., is a challenge that can overwhelm a single detective assigned to a complex case. Nevertheless, it is an important aspect that is required in some cases to take down a whole criminal organization right to the top.

Create an Evidence Book with an Index
  • Include your timeline and cast of characters.
  • Note any follow-up steps on missing or newly important documents including:
    • Customer record
    • Signature card
    • Credit application
    • Transaction history
    • Payment history and method (online or mail)
    • Addresses and telephone numbers associated with the account
    • Additional authorized users
    • Videos of any in-person transactions
Look for Common Points of Compromise Across Different Crimes and/or Additional Victims

Remember that these crimes are rarely isolated, and that they often have companion crimes, as they are instrumental in concealing another crime or in creating financial gain for the perpetrator.

Collaborate & Share Information

As the case progresses, the requirement for outside agencies and investigators from financial institutions assisting the investigation will become necessary. This necessity will be based on your agency’s jurisdiction or an element of the crime or ability to access persons, places or things outside its authority. In some circumstances a federal agency may be the correct organization to conduct the primary investigation.

17As more commerce is being conducted on the Internet it is important to act immediately to preserve evidence or information that may be stored on digital media. Information may have a short shelf life in these circumstances due to the ever expanding need for increased storage media. Security video is also subject to the demands of storage needs as it too becomes more digital based. Older technology such as video tape may have an even shorter life span as equipment ages and becomes obsolete. Paper documents as well as other physical evidence should be treated as in other crimes to preserve it for prosecutorial value.