Uncovering a Hidden Criminal Infrastructure

This is an illustration with invented details. Harbour and Pine Logistics, the suppliers, the template name, and the mailbox are made up. The pattern is a familiar one: a service that sells the dull parts of a fraud, hidden less by secrecy than by looking like three unrelated invoices. The analyst's job is to see the service in records the company may already hold, to change the judgment only as far as the evidence moves, and to avoid becoming a customer of the thing being assessed.

What this case is not

It does not explain how to build a shell company, forge an invoice, spoof a message, open an account, or rent a place for stolen money to land. It does not explain how to hire the people who do those things. Ordering a test document "to see if the service is real" answers the question by committing it. Posing as a buyer is not cover. It is participation, and it is a poor way to keep your judgment independent of the people you are judging.

Samir Qureshi, the analyst, never contacts the service. He never tries to enter a closed channel, and he is not shown how. He uses invoices and mail Harbour and Pine already received, public register extracts he is allowed to read, a statement the company's bank gave its fraud contact, and one paragraph in a commercial bulletin the company already subscribes to. Deep Web Research for Intelligence Analysts is the boundary lesson. This case is what you do when the interesting material is a claim about a hidden service and the useful material is already in accounts payable.

The situation

Harbour and Pine is a fictional regional freight firm. In six weeks it paid three new suppliers once each. Different company names. Different people listed on the onboarding forms. Three PDF invoices. Each amount sat just under the line that would have required a second signature. That last fact is a reason to look. It is not a technique, and this write-up is not going to turn it into one.

The first judgment, written by the accounts clerk and accepted too quickly by everyone else, was comfortable. Three small firms, three opportunistic invoices, moderate confidence, because they arrived separately and the onboarding file showed different directors. Conventional checks had been done. Someone had searched the company names. The websites showed warehouses. So does every honest freight firm. A website is a costume. It is not a source.

Samir is asked to "see if they are connected" after the bank recalls one of the payments and asks, politely, whether Harbour and Pine meant to send it. The question he inherits is already slanted toward yes, they are connected, please confirm. He writes a different question.

Are these three payments one scheme, or three schemes that happen to look alike? If they are one scheme, what is the link we can actually show, and what would we be guessing?

"Hidden criminal infrastructure" is a large phrase for a small set of services: a company name that looks registrable, a document that looks like an invoice, a mailbox that answers, and an account that can take a payment. None of that appears in a single internal record under one title. It appears as admin. Criminal infrastructure is often admin with worse intentions, which is why the first search, aimed at a mastermind, finds nothing and the second search, aimed at a repeated template, finds the scheme.

What he was allowed to use

He lists the holdings before he lists the theory. A theory that needs a source he is not allowed to touch is a theory for someone else, or for no one.

• The three invoices and the messages that carried them, already in the accounts-payable mailbox.
• The onboarding forms the firm already collected. He reads them as claims made by the sender, not as facts the firm verified.
• Public company-register extracts for the three names, pulled on a stated date, one each. Three extracts were enough. He does not need a scrape of the register, and he does not need to argue with the register's terms to answer this question.
• A short statement from the firm's bank to its existing fraud contact: when the three receiving accounts were opened, that they were opened at the same branch in the same month, and that they were closed within a day of the payments. He grades that as the bank's report. He does not have, and does not ask for, a login to the bank.
• One paragraph in a commercial fraud bulletin the firm already receives. It describes complaints about a service that supplies supplier paperwork. It names a template title. It does not, in the copy Samir is using, tell anyone how to hire the service. If it had, he would have stopped reading that part and told the lawyer, not followed it.

He writes, at the top of the note, what he will not do. He will not pose as a buyer. He will not order a kit, a document, or a company. He will not try to open or reset the mailbox. He will not ask a colleague with "an account somewhere" to take a look. The list is the first paragraph the legal lead will want, so he does not make them hunt for it.

Validate the artefacts, not the story

The story says three suppliers. The artefacts are allowed to disagree with the story. That is what artefacts are for.

The messages are the firm's own mail. On all three, the display name and the From address differ. The Reply-To address is the same mailbox. Samir does not need a lecture on message headers, and he does not go looking for one. He can see the reply address in mail the company has already accepted into its mailbox. He records the address in the investigation file, not in a draft that will be forwarded around the building. A shared reply address is a link between the three messages. It is not, by itself, proof of who pays the bill for that mailbox.

The PDFs are the firm's own files. The document properties on all three show the same template title, HP-SUP-KIT, and the same authoring string. He uses the properties panel. He does not "clean" the files, and he does not need a specialist toolkit to notice that three supposedly unrelated firms wrote invoices in a template none of them would put on the letterhead. An internal template name is diagnostic in a way a company name is not. Company names are chosen to be seen. Template titles are often left because nobody thought an accounts clerk would open the properties.

He treats that match as a strong link between the documents. He does not treat it as proof of a worldwide service. Three files can share a template because one person made all three. A service is a further claim. It needs something else.

The register extracts are public and dated. Two of the three companies were registered in the same week and give the same registered office, a mailbox shop that will also sell you a pot plant if you are feeling legitimate. The third company is four years old. Samir does not drop the third to make the pattern tidy. The tidy version is "all three shells were built for this fraud." The evidence supports a smaller sentence: two look purpose-built, and the third may be a reused company that was given the same paperwork. He writes the mismatch into the judgment. A mismatch you keep is a sign you are still looking. A mismatch you delete is a sign you have joined the theory.

The bank's statement corroborates timing and place of the accounts, not the identity of a controller. Same branch, same month, closed immediately after payment, is hard to square with three honest new suppliers. It is the bank speaking, so he cites it as the bank's report and does not upgrade it to his own observation. He also does not ask the bank to "trace it through the deep web." The bank has its own duties. His job is to tell them what the invoices show.

The bulletin mentions the template title HP-SUP-KIT in complaints about a paperwork service. One bulletin is a lead that matches an artefact he holds. It is not a second observation of his three invoices, and it is not a customer list. He checks whether the bulletin is only quoting a vendor he already used. It is not. It is still one source, graded as such. Source evaluation would call this a single report that happens to fit, which is encouraging and not the same thing as confirmed.

He does not contact the service to ask if the bulletin is right. He does not order a forged invoice to see whether the template comes back matching. Commissioning the document would create the evidence and make Harbour and Pine a client. Independence is not a mood. It is a refusal to buy the thing you are assessing.

What changed the judgment

The judgment moves in steps. Each step is allowed to be smaller than the excitement in the room.

Start, inherited, moderate confidence: three unrelated invoice frauds. Basis: separate arrivals, different names on the forms, websites that existed. Samir lowers this before he replaces it. The basis is what the senders wanted the firm to believe. That is not corroboration. It is the scheme's costume, and it had already worked once.

After the shared Reply-To and the shared template title, new judgment, high confidence: the three invoices are one campaign using the same paperwork and the same reply mailbox. Confidence is high on the link between these three documents. It is not high on who operates the mailbox, and it is not a finding that a standing service exists.

The older third company changes the scope and not the link. He splits the sentence rather than averaging it into a fog. Two of the companies were registered the week they were used, at one mailbox office. The third was not. Possible explanations: a reused vehicle, a coincidence he should not force, or a registration date he misread. He rechecks the extract. The date is right. The judgment keeps the split.

The bank's account timing raises confidence that the payments were received by accounts set up for the purpose and then abandoned. It does not identify a person. He says so in one line, because someone in the meeting will ask "so who is it?" and the line needs to be already on the page. The answer is that we do not know, and the directors on the forms are claims. A mailbox-shop director is often a nominee. Write "name given on the form" and "registered office." Do not write "the operator."

The bulletin is what moves the "what is this" judgment, and only one notch. From "a person with a template" to "possibly a service that has supplied this template to more than one user," low to moderate confidence. The basis is one commercial report plus three files that share the title the report mentions. The gap is blunt: we cannot see that service's other customers, and we will not hire it to find out. If the bulletin is wrong, the link between our three invoices still stands. The service judgment falls away and the campaign judgment does not. He writes it that way so a reader can throw out the shaky half without throwing out the solid half. That is the point of not using one confidence word for both.

What changed the judgment, in order: a template title that was not meant to be seen, a reply address shared across mail the firm already had, a register office that explained how different directors could still be the same shopfront, and a bank report on the accounts. What did not change it: a look inside any hidden channel, a conversation with the service, or a test purchase. The deep web, in so far as this case ever involved one, stayed a place Samir did not go. The infrastructure showed up as repeated admin.

The reporting path

He does not brief this as a tale of a hidden network. He briefs it as a payment problem with a judgment attached, because the firm can stop a payment this afternoon and it cannot dismantle a service by Thursday.

1. Same day, to the accounts-payable lead: do not pay any further invoice that carries the template title HP-SUP-KIT or that reply mailbox. That is a control inside the firm. It is not a disruption plan against the service, and it does not require anyone to touch the service.
2. The assessment, to the finance director and the lawyer. Judgments separated: the link between the three invoices, the two-versus-one registration split, the account timing as the bank reported it, and the service as a low-to-moderate possibility. Assumptions and gaps in the same document, not in an appendix nobody opens. The standard in Intelligence Report Fundamentals is the right length: a reader should be able to repeat the judgment without the briefing.
3. Confidence wording checked against Estimative language. "High confidence they are linked" and "low to moderate confidence a wider service exists" are allowed to sit in neighbouring sentences. They are not allowed to be averaged into "we basically know."
4. A referral to the police and to the bank's fraud team, sent by the lawyer, not by a well-meaning forward. The pack holds the three invoices, the register extracts, the template title, the reply address, the bank's own reference numbers, and the statement of what Harbour and Pine did not do. It does not recommend a takedown. The firm is a victim and a witness. The analyst is not an operator, and a paragraph that begins "we suggest you seize" will be read as if the firm thinks it is.
5. One internal collection task: search the past year of the firm's own invoices and mailbox for that template title and that reply address. Their mail. Their files. If more appear, the campaign judgment extends. If none appear, the six-week window stands and he does not go fishing elsewhere to make the case larger.

He also writes who does not get the note. The template title is a lead the police do not yet have in public. He does not post it on a forum to warn the industry. The referral is the warning channel. A public tip that teaches other offenders the title was noticed is not a public service.

Legal and ethical boundaries

The lines are practical, because this is the sort of case where someone will offer to be helpful in exactly the wrong way.

Do not pose as a buyer, a supplier, or a middleman. Do not let a vendor pose as one on your behalf. A test purchase of a forged document is the offence you were trying to document, done with a notebook open.

Do not access the mailbox, the register account of the suspect companies, the bank accounts, or any server the invoices mention. The mail you may read is the mail your firm received. The register you may read is the public extract. The bank account you may hear about is the one the bank chose to describe.

Do not scrape a public register past the point the lawyer has blessed, and do not pretend three looked-up extracts were a scrape. They were not. Scale is not what made them lawful. Authority and necessity were. Three were sufficient, which is a good moment to stop.

Do not treat a named director as the operator. Record the name as "given," say what a nominee is, and leave identification to the people with the power to compel it. An analyst who names a person in a finance pack will be quoted. Assume the quotation survives.

Do not keep a private copy of the invoices in a personal mailbox "for the write-up." The investigation folder is the record. Side copies are how customer and bank details end up in the wrong place, which is a second incident wearing the costume of diligence.

If a colleague offers access to a closed channel where this service is supposedly discussed, decline it in writing and tell the lawyer. The offer is not a source. It is a decision. The decision belongs above you, and the lawful answer may still be no.

What good looks like in the pack

The paragraph he is willing to sign is specific and a little disappointing. Disappointment is a feature. It means he did not add a mastermind to fill the last slide.

Harbour and Pine assesses with high confidence that the three invoices paid in this six-week window are one campaign. They share a reply mailbox and an internal template title, HP-SUP-KIT. Two of the companies were registered the same week at the same mailbox office. The third was already four years old, so we do not assess that all three companies were created for this fraud. Our bank reports that the receiving accounts were opened together and closed immediately after payment. We treat that as the bank's statement. We assess with low to moderate confidence that the template is supplied by a service offered to more than one user, based on one commercial bulletin that names the same template title. We do not know who controls the service or the mailbox. We did not contact them, and we will not. Further invoices in our own records, if any, are the next check.

A manager can stop the next payment with that paragraph. A police officer can see what is evidenced and what is not. Nobody has to pretend the firm penetrated a hidden market. The market, if it exists, can remain hidden. The invoices did not.

Mistakes this case is built to prevent

• Calling three websites and three director names "checks," when they are the claims under test.
• Forcing the older company out of the sample because it spoils the sentence.
• Using one confidence word for "these invoices are linked" and "a criminal service exists."
• Hiring the service, or asking someone else to hire it, so the template can be compared.
• Naming a director as the operator because the register had a blank that needed filling.
• Briefing a takedown. The firm does not have that job, and the briefing will be mistaken for a plan.
• Publishing the template title as a warning before the referral has used it.
• Searching a closed channel because the invoices felt too ordinary to be the real case. Ordinary was the point. The concealment was the paperwork.

Practice

Do this on records you are already allowed to hold. A past set of invoices, a set of vendor onboarding forms, or a redacted exercise pack. Do not go and find a service to test the method against. The method is the refusal as much as the match.

1. Write the question as a link question: are these items one campaign, and what would show it?
2. List the holdings you may use. If a holding is not on the list, it is out, including anything that would require posing as a customer.
3. Find one feature the sender did not mean as a company name. A template title, a repeated reply address, a shared office on a public extract. One is a lead. Two independent features are the start of a judgment.
4. Write the awkward mismatch and keep it. If you have to delete a fact to save the sentence, the sentence is wrong.
5. Split the judgment. Link between the items, then any wider claim about a service. Give each a confidence word. Say what would drop the wider claim without dropping the link.
6. Write the reporting path: who stops the next payment, who sends the referral, and the sentence you will not write. That sentence is the one that names a person or recommends an attack on infrastructure.

If your practice answer needs a step you would not put in a letter to the lawyer, it is not an answer yet.

Back to Deep Web Research, or read the companion case Tracking Stolen Data Through the Deep Web.