1. Don’t Panic:  The most common reaction when someone identifies a suspected fraud is to react in a totally uncharacteristic manner. They may instigate a ‘witch hunt’ and try and punish anyone who may be implicated in any way.  It is vital that you do not panic but proceed with a structured investigation from the outset; do not act too hastily.   2. Don’t alert the suspect:  If you suspect something is amiss do not alert the suspect or anyone who may react in such a way as to jeopardize an effective investigation of the problem. If you have no idea of who is responsible it is prudent to tell as few people as possible of your suspicions. In circumstances like this it is wise to employ the services of independent investigators who will give you an impartial assessment of the situation.                                                                  Remember:  if you alert the suspect at this stage they may well take steps to cover their tracks, e.g. by deleting or destroying vital evidence.

3.  Don’t tamper with what could be the evidence:  Do not be tempted to start investigating the problem yourself. Unless you are well versed in the preservation of evidence and forensic issues, you run the high risk of contaminating or destroying the very evidence you are trying to obtain. Failure to secure and examine the evidence in line with recognized procedures could rule any evidence retrieved inadmissible in court. Just the simple act of switching on a computer suspected of being used in a fraud can destroy vital evidence that may be present thereon. If it is possible to remove the computer from use without alerting the suspect then do so, but if this is not possible...   We have gone in after hours in many cases to perform the images and/or clones of the actual hard drives / media and performed the forensic examinations of the evidence in our lab without raising any suspicions in the clients companies.