# How to Investigate a Fraud Tip Without Tipping Off

- Author: PreciseBankFlow (https://precisebankflow.com)
- Published: 2026-10-17
- Category: Fraud and forensic review
- Canonical: https://precisebankflow.com/blog/how-to-investigate-a-fraud-tip

> How to investigate a fraud tip: assess it, preserve records quietly, test bank data first and decide when to bring in counsel or a forensic accountant.
To investigate a fraud tip, write down exactly what the tipster said, judge whether it is specific enough to test, quietly secure the bank records and files it points to, and test the bank data before you speak to anyone involved. Keep the circle small. Bring in counsel once the data supports the tip or before any interview.

## How do you assess whether a fraud tip is credible?

A fraud tip is credible enough to test when it names something you can check: a person, a payee, an account, a period or an amount. A vague complaint that "something is off" is worth noting but gives you nothing to test. Record the tip in the tipster's own words, with the date and how it arrived.

Credibility is not the same as truth. A tipster with a grudge can still be right, and a careful, specific tip can still be wrong. Judge the tip on what can be checked, not on how you feel about the person who gave it.

### A tip assessment worksheet

Fill in one worksheet per tip. The entries below are an example.

| Question | Example answer |
| --- | --- |
| Date and channel | 2026-09-02, anonymous email to the owner |
| Who is named | Accounts payable clerk |
| What is alleged | Payments to a vendor the clerk set up, for work not done |
| Payee or account named | "Lakeview Services" |
| Period | Since about March 2025 |
| Amount suggested | "Thousands a month" |
| How the tipster knows | Saw the clerk's name on a Lakeview invoice address |
| What can be checked without contact | Vendor file, payments to Lakeview, invoice addresses |
| Who else knows about the tip | Owner only |
| Decision | Test bank data; no contact with the clerk |

The last two rows are the ones people skip. Knowing who already knows tells you how quickly word might spread. Writing the decision down shows later that you acted on a plan.

## Preserving records quietly after a fraud tip

Preserving records means securing copies of everything the tip touches before anyone suspects a review: bank statements, check images, the vendor file, invoices, approvals and the relevant emails. Do it quietly, through routine channels where you can, so that the person named does not notice and has no reason to delete or change anything.

Practical ways to collect without drawing attention:

- **Download statements from the bank yourself**, through online banking, rather than asking the bookkeeper for them.
- **Export the vendor master file and the payables history** at a time when it looks routine, such as a month-end close.
- **Ask your IT provider to preserve mailboxes** under a retention hold rather than reading them in place.
- **Copy, do not move.** Leave originals where they are so nothing looks disturbed.
- **Log each item**: what it is, where it came from, who collected it, when.

If the named person controls the bank login or the accounting system, ask the bank directly for statements and check images. If statements arrive from that person, test them before relying on them; [tests that catch fake or altered bank statements](/blog/how-to-detect-fake-bank-statements) cover footing, file checks and confirming with the bank.

## Testing bank data first in a fraud tip investigation

Bank data is the right first test because it shows what money actually moved, and you can examine it without speaking to anyone. Start with the specific payee or account the tip names, then widen to patterns the tip implies. Each test should either support the tip, rule it out or show you need more data.

### First ten days, step by step

1. **Pull every payment to the named payee** across all accounts, with date, amount and approver.
2. **Total them by month** and compare with the period the tipster gave.
3. **Check the vendor file**: who added the payee, when, the address and bank details.
4. **Match the payee's details against employees**, including addresses and direct-deposit accounts.
5. **Pull three invoices** and look for a real business behind them: a phone number, a tax ID, a website.
6. **Compare payment sizes** with that payee's own history and with similar vendors. The [relative size factor test for outlier payments](/blog/relative-size-factor-test) flags a payment far larger than a payee's norm.
7. **Look for amounts just under the approver's limit.**
8. **Check the bank reconciliations** for the period: who prepared them, who reviewed them, and whether any reconciling items sat unexplained for months. The [bank reconciliation review checklist](/blog/bank-reconciliation-review-checklist) is a quick way to see whether review actually happened.
9. **Write a one-page summary** of what the data shows and what it does not.
10. **Decide**: close, widen the review, or bring in counsel.

PreciseBankFlow can speed up step 1 when statements arrive as PDFs: it reads each line, checks that each statement foots, and flags duplicate payments and gaps in check numbers, all of which you can [request access to through the get-started page](/get-started).

## Who inside the business should hear about the fraud tip?

As few people as possible should hear about the fraud tip: the person who received it, one decision-maker with authority over the person named, and later counsel. Everyone added increases the chance the subject hears. Choose a lead who is not in the reporting line of the person named and who has no stake in the outcome.

In a small business, the owner is often the only sensible lead. In a larger one, it might be the finance director, an audit committee chair or internal audit. If the tip names someone senior, go above them, which may mean the board.

Decide in advance what the lead will say if the named person asks why records are being pulled. A short, true answer about routine month-end or year-end work is better than an improvised one. Do not invent a story that could later look like deception to a court or an employment tribunal.

Tell the people you include, in writing, that the matter is confidential. Do not use group email lists or shared chat channels. Keep notes in a file only the lead can open.

## When a fraud tip needs counsel or a forensic accountant

A fraud tip needs counsel once the bank data supports it, before any interview, before any employment action and whenever police, an insurer or a lawsuit may follow. A forensic accountant becomes worth the cost when the amounts are significant, the scheme spans years or the findings must survive challenge from the other side.

Counsel early matters for a few reasons. Lawyers can advise on employment law before you suspend anyone. They can engage the forensic accountant so the work may be protected. And insurance policies that cover employee theft often have notice deadlines and proof requirements that counsel will want to meet.

The forensic accountant's main early job is usually to put a number on it. [How to calculate fraud loss from bank records](/blog/how-to-calculate-fraud-loss) explains defining the period, separating theft from legitimate items and presenting the figure.

## Fraud tip investigation mistakes that alert the subject

The mistakes that alert the subject are the ones that change their routine or reveal interest in their work. Asking them for documents they have never been asked for, changing their system access suddenly, or discussing the tip with their colleagues are the common ones. Any of these can lead to deleted files or a quick departure.

Others damage the evidence rather than the secrecy:

- **Confronting the person before testing the data.** You lose the chance to compare their explanation with records they did not know you had.
- **Working on originals.** Annotating the only copy of a statement makes it harder to rely on later.
- **Searching their computer yourself.** Without advice, this can create legal problems and spoil digital evidence.
- **Promising the tipster anonymity you cannot guarantee.** Say you will protect their identity as far as the law allows, not that nobody will ever know.
- **Ignoring the tip because the subject is trusted.** Long-serving, trusted staff are often the people with the access a scheme needs.

## Closing out a fraud tip that proves unfounded

A fraud tip proves unfounded when the tests show the payments are real, approved and backed by goods or services received. Closing it properly means writing down what was tested, what was found and why the matter is closed, so that if a similar tip arrives later you can see what was already ruled out.

Keep the file confidential and limited to the same small group. The person named never knew about the review, and there is usually no reason to tell them. Thank the tipster if you can reach them, without giving details.

An unfounded tip often still exposes a weak control: a vendor added without a second approval, or reconciliations nobody reviewed. Fix those quietly over the following months, framed as routine improvements rather than a response to the tip, so nobody connects the change to a review.

Also review how the tip arrived. If an employee had to email the owner anonymously because there was no other route, consider setting up a clear reporting channel with a named person outside the finance team. A tip that turned out to be wrong this time has shown you where a real scheme could start next time.