A fraud case that is investigated well but written up badly loses money twice: once to the fraudster, and again when the recall request, insurance claim, regulatory report or prosecution fails for lack of a clear record. This template is the case file an investigator fills in, from intake to closure. It works for customer-facing fraud (account takeover, authorised push payment scams, card and refund abuse) and for internal or supplier fraud (invoice redirection, payroll diversion, expense and procurement fraud). It covers case intake, the parties, an evidence register with chain of custody, a timeline, the loss and recovery calculation, reporting decisions, root cause and closure. How to run the team and queues around it is covered in the Fraud Operations and Case Management Guide; this page is the document itself.
How to use this template
- Copy the sections below into your case management system or a controlled document. Replace text in square brackets, such as [Organisation], [Case Owner] and [Legal], with your own names.
- Open one case file per incident, not per transaction. Link related cases by reference rather than merging them, so each loss and recovery stays auditable.
- Fill sections 1 to 4 within [1 business day] of opening. Speed matters most for recovery: funds still in a receiving account can sometimes be frozen, funds that have moved on rarely can.
- Write facts, not conclusions. "The payee account was added from device X at 14:02" is evidence. "The customer was careless" is not.
- Restrict access. A case file may include personal data, staff suspicions and, in regulated firms, information about a suspicious activity report that must not be disclosed to the subject. Apply [Case File Access Standard].
- Where the case may lead to dismissal, civil recovery or prosecution, involve [Legal] before interviewing anyone or collecting staff devices.
1. Case intake
| Field | Entry |
|---|---|
| Case reference | [FR-YYYY-NNNN] |
| Date and time opened | [date, time, time zone] |
| Source of detection | [Customer report / fraud rule ID / staff report / whistleblowing line / bank or law enforcement notice / audit] |
| Fraud type | [Account takeover / APP scam / card-not-present / first-party / invoice redirection / payroll diversion / internal misappropriation / other] |
| Predication | [One paragraph: what facts justify opening an investigation] |
| Initial exposure | [Amount and currency at risk, number of accounts or transactions] |
| Priority | [P1 funds moving now / P2 loss confirmed, recovery possible / P3 historic or low value] |
| Case owner and reviewer | [Names]. The reviewer must be independent of the business area involved. |
| Conflict check | [Confirm the case owner has no relationship with any party] |
2. Immediate containment
Record each action, who took it and when. Typical actions:
- Funds: recall or hold request sent to the receiving institution [time, reference]; outgoing payments on affected accounts paused [yes/no].
- Accounts and access: customer or staff account locked, sessions revoked, credentials and authenticators reset through a verified channel. See the Account Takeover Response Playbook.
- Supplier and payroll records: changed bank details frozen and re-verified by call-back to a number held on file. See the Invoice Redirection and Supplier Bank Detail Fraud Guide.
- Related exposure: search for the same payee account, device, IP range, email domain or phone number across other customers or suppliers [results].
- Legal holds: retention hold placed on mailboxes, logs and recordings that may be needed [systems, time].
3. Parties
| Role | Name or identifier | Relationship to [Organisation] | Notes |
|---|---|---|---|
| Victim or affected party | [Customer ID / supplier / employee] | [Customer since / contract] | [Vulnerability indicators, preferred contact] |
| Subject (if known) | [Name, account, device ID] | [External / customer / employee / supplier] | [Do not alert; see section 7] |
| Receiving institution or beneficiary | [Bank, account, wallet address] | [None] | [Contacted when] |
| Witnesses | [Staff, customer contacts] | [Role] | [Statement taken yes/no] |
| External parties | [Police reference, insurer, regulator, payment scheme] | [Reference numbers] |
4. Evidence register
Every item collected gets a row. Keep the original or a verified copy, record a hash for digital files, and never edit the working copy in place. The register is the chain of custody: if an item is not here, assume it cannot be relied on later. See the Evidence Handling and Chain of Custody Guide.
| Item ID | Description | Source system | Collected by, date and time | Method and hash | Storage location | Transfers |
|---|---|---|---|---|---|---|
| [E-01] | [Transaction records for account X, date range] | [Core banking / ERP] | [Name, date, time] | [Export, SHA-256] | [Evidence store path] | [To whom, when, why] |
| [E-02] | [Authentication and session logs: device, IP, method, step-up result] | [Identity platform] | ||||
| [E-03] | [Call recording or chat transcript] | [Contact centre] | ||||
| [E-04] | [Email with original headers] | [Mail platform] | ||||
| [E-05] | [Change history for payee or supplier bank details] | [Application audit log] |
Typical evidence by fraud type:
| Fraud type | Evidence that usually decides the case |
|---|---|
| Account takeover | Sign-in history, device and IP changes, authenticator or contact detail changes, recovery events, step-up outcomes, notifications sent |
| APP scam | Payment instruction, warnings shown and the customer's responses, call or chat records, the scam contact (number, message, advert), receiving bank response |
| Invoice redirection or supplier fraud | Email headers and mailbox rules, the bank detail change request, the call-back record, approval workflow logs |
| Payroll diversion | HR or payroll self-service audit log, the sign-in that made the change, help desk tickets, employee confirmation |
| Internal misappropriation | Approval and segregation-of-duties records, system access logs, expense or purchase documents, bank statements of the receiving account where lawfully obtained |
5. Timeline
One row per event, in time order, each tied to an evidence item. Use one time zone throughout and say which. The timeline is what reviewers, insurers and law enforcement read first.
| Date and time ([zone]) | Event | Actor | Evidence item |
|---|---|---|---|
| [2026-03-04 09:12] | [Phishing SMS received by customer] | [Unknown] | [E-07] |
| [2026-03-04 09:20] | [Sign-in from new device; step-up passed by SMS code] | [Subject] | [E-02] |
| [2026-03-04 09:23] | [New payee added; payment of [amount] sent] | [Subject] | [E-01] |
| [2026-03-04 11:40] | [Customer reports; account locked; recall sent] | [Customer, Fraud Operations] | [E-03] |
6. Loss and recovery
| Line | Amount ([currency]) | Notes |
|---|---|---|
| A. Gross loss (value that left [Organisation] or the customer) | [ ] | [List transactions] |
| B. Prevented loss (stopped before settlement) | [ ] | Report separately; not part of A |
| C. Recovered from receiving institution or beneficiary | [ ] | [Date, reference] |
| D. Recovered from subject (repayment, civil recovery) | [ ] | |
| E. Insurance recovery | [ ] | [Policy, claim reference] |
| F. Customer reimbursement paid by [Organisation] | [ ] | [Basis: scheme rule, goodwill, liability finding] |
| G. Amount reclaimed from another institution under a scheme rule | [ ] | [For example a shared reimbursement arrangement] |
| H. Investigation and remediation cost | [ ] | [Internal hours, external fees] |
| Net loss to [Organisation] = A minus C, D, E and G for [Organisation]'s own losses, plus F and H | [ ] | Agree the formula with [Finance] and apply it the same way to every case |
In the UK, the Payment Systems Regulator's reimbursement requirement for authorised push payment scams over Faster Payments and CHAPS says most victims should be reimbursed within five business days and splits the cost 50:50 between the sending and receiving firms. Check the current rules and limits on the PSR's pages before recording a reimbursement decision.
7. Reporting decisions
Record each decision, including a decision not to report, with the reason, the approver and the date.
| Report | Applies when | Decision and reference |
|---|---|---|
| Police (UK: Report Fraud) | Fraud or cyber crime against [Organisation] or its customers. Report to Report Fraud (which replaced Action Fraud on 4 December 2025) at reportfraud.police.uk or on 0300 123 2040. In Scotland, report to Police Scotland on 101. | [Yes/No, crime reference] |
| Suspicious activity report (UK) | Regulated-sector firms that know or suspect money laundering must report to the National Crime Agency through the SAR Portal. A defence against money laundering request has a notice period before funds can move. | [Yes/No, submitted by MLRO, reference] |
| Suspicious activity report (US banks) | Under 31 CFR 1020.320, suspicious transactions of at least USD 5,000; due within 30 calendar days of initial detection, extendable to 60 days at most if no suspect is identified; ongoing schemes also need a prompt phone call to law enforcement. | [Yes/No, BSA ID] |
| Regulator or scheme notification | [Material incidents under your regulator's rules, card scheme fraud reporting] | [ ] |
| Data protection | Personal data was accessed or disclosed without authorisation; assess against breach notification rules (for example 72 hours to the supervisory authority under UK and EU GDPR where reportable) | [Assessed by DPO, outcome] |
| Insurer | Crime or cyber policy notice conditions | [Notified when] |
Tipping off: where a suspicious activity report has been or may be filed, do not tell the subject or anyone outside the permitted group. Record customer communications in section 9 with that in mind.
8. Analysis and findings
- Method of attack: [How the fraud worked, step by step, referencing timeline rows]
- Control that should have stopped it: [Name the control and why it did not: absent, bypassed, overridden, or worked as designed but the threshold was too high]
- Identity angle: [Which account, credential or authentication step was abused, for example an SMS code intercepted after a SIM swap, a supplier mailbox compromised, a payroll self-service account taken over]
- Customer or staff conduct: [Facts only; reference warnings shown and responses]
- Findings: [Numbered findings, each with the evidence items that support it]
- Linked cases: [References sharing a payee, device, actor or method]
9. Communications
Log every contact with the victim, the subject (if approved by [Legal]), receiving institutions, police and insurers: date, channel, who, summary, and any commitment made. Customer outcome letters must state the decision, the reason and how to complain or escalate.
10. Remediation actions
| Action | Owner | Due | Status |
|---|---|---|---|
| [Add rule: new payee plus new device within 10 minutes triggers hold] | [Fraud Operations] | [ ] | [ ] |
| [Remove SMS step-up for payee changes where passkeys are enrolled] | [Product] | [ ] | [ ] |
| [Enforce call-back for supplier bank changes] | [Finance] | [ ] | [ ] |
11. Closure
- Outcome: [Confirmed fraud / not fraud / unable to determine]
- Final net loss: [from section 6]
- Disciplinary, civil or criminal action: [Status and references]
- Retention: evidence kept until [date], based on [retention rule, for example five years from SAR filing for US banks under 31 CFR 1020.320]
- Quality review: reviewed by [independent reviewer] on [date]; findings [ ]
- Sign-off: [Case owner], [Reviewer], [Head of Fraud], [date]
Implementation guidance
- Agree the fraud type list and loss formula first. Without consistent categories and one net loss formula, your fraud metrics cannot be compared month to month. See the Fraud Metrics and KPIs Guide.
- Build the evidence register into the tool. Make hash and collector fields mandatory for file uploads so chain of custody is captured as work is done, not reconstructed later. ISO/IEC 27037 sets out guidelines for identifying, collecting, acquiring and preserving digital evidence.
- Pre-agree recall routes. Keep a current list of receiving institution fraud contacts and the scheme routes for recall and hold requests, and test them.
- Pilot on closed cases. Re-document three to five recent cases in the template, find the fields nobody can fill, and fix the data source or drop the field.
- Review quality monthly. Sample closed files for timeline completeness, evidence references behind every finding and correct reporting decisions.
Control mapping
| Template section | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 |
|---|---|---|
| 1-2. Intake and containment | RS.MA-01 | IR-4, IR-5 |
| 4-5. Evidence and timeline | RS.AN-03 | AU-9, IR-4 |
| 7. Reporting decisions | RS.MA-01 | IR-6 |
| 8, 10. Findings and remediation | RS.AN-03 | IR-4 |
Metrics to track: median time from detection to first recall request; share of gross loss recovered; share of cases with every finding linked to an evidence item; cases reopened after quality review; average case age at closure by priority; repeat cases sharing a payee or device after a remediation action was closed.
Standards and references
- eCFR: 31 CFR 1020.320 Reports by banks of suspicious transactions
- National Crime Agency: Suspicious Activity Reports
- GOV.UK: Report Fraud, new service from City of London Police
- Payment Systems Regulator: APP scams
- ISO: ISO/IEC 27037 Guidelines for identification, collection, acquisition and preservation of digital evidence
- NIST: Cybersecurity Framework 2.0
- Report Fraud: Should I report to Report Fraud? (Scotland: Police Scotland on 101)
Related NHI Mgmt Group resources: Fraud Operations and Case Management Guide · Evidence Handling and Chain of Custody Guide · Occupational and Internal Fraud Guide · Fraud Data Sharing and Consortium Intelligence Guide