See our process in action

A short intake call established the timeline, which platform was affected, and what evidence the client already had — screenshots of the fake profile and messages it had sent.

Working from the fake profile the client reported, the analyst reverse-image-searched the profile photos, checked the account's creation date, and cross-referenced its follower/messaging pattern against the client's real account — using only publicly available information.

Findings were compiled into an evidence package matching the platform's impersonation-policy language, with sourced, timestamped screenshots.

The client submitted the package through the platform's official impersonation report. The fake account was removed within the platform's standard review window.

The first priority was stopping further payments and confirming the client hadn't deleted any conversation history — that history is the core record in requests like this.

Analysts organized the domain, profile photos, and wallet addresses the client supplied, and formatted the platform's publicly listed registration data the client pointed us to — all from public sources and the client's own records.

A timeline report was built connecting the contact pattern, the platform's red flags, and the transaction trail the client supplied, labeled by confidence level (Confirmed / Probable / Possible).

The client used the report to support a fraud dispute with their bank and filed with the FBI's IC3 and the FTC.

The client was walked through preserving evidence correctly first — not deleting or blocking accounts until the record was captured, since blocking can hide message history on some platforms.

Analysts organized the timestamped, source-linked messages and posts the client provided from every affected platform, and mapped the pattern into a single chronological timeline.

The timeline was compiled into a clear report with a plain-language summary up front, ready for the client to bring to whoever they chose.

The client chose to bring the same report to their workplace HR process and the local police non-emergency line, so both worked from one consistent record instead of two different retellings.

The client listed every name, handle, and email they'd ever used publicly, so the review could search broadly instead of missing older accounts.

Analysts searched public data broker listings, old forum posts, breached-credential indexes, and social account privacy settings tied to those identifiers.

Findings were grouped by exposure type (address/phone, breached passwords, public social settings) and ranked by how easily each could be found.

The client received a prioritized action list — which data broker opt-outs to file first, which passwords to rotate immediately, and which account settings to lock down.

The client shared their real domain, logo assets, and social handles as a baseline, plus every customer report they'd already collected.

Analysts searched for lookalike domains, typosquats, and cloned social profiles, and documented which ones were actively soliciting payments versus dormant.

Each fraudulent asset was logged with registrar, hosting, and platform details, and matched to the correct abuse-report channel for that specific host or platform.

The client used the report to file takedowns with the relevant registrars and platforms in parallel, instead of discovering each new fake one at a time from customer complaints.