It is happening right now.
The first hours decide the rest.
Almost every organisation handles its first incident in the same order: panic, then cleanup, then questions nobody can answer because the cleanup destroyed the answers. We work the order the other way round.
What the first day looks like
Not a methodology diagram. This is the order the work actually happens in, and the reason each step comes where it does.
-
Hour 0
Stop the bleeding
What to disconnect and what to leave running. Pulling the wrong plug destroys the evidence that tells you how far in they got, and pulling nothing lets them keep going.
-
Hour 0 to 2
Preserve before you clean
Logs, mailbox rules, session tokens, payment trails. Most of what proves what happened has a retention window measured in days, and it starts running before anyone calls us.
-
Hour 2 onward
Work out what actually happened
Which account, which route in, what was reached, what was taken, and whether it is still open. Written as findings with the evidence attached, not as reassurance.
-
Same day
Chase the money while it can still be frozen
Where funds moved, and the reporting that gives a bank a reason to act. Speed is the single biggest factor here, and it is measured in hours.
-
Within the deadline
The reporting you are obliged to do
CERT-In directions give six hours from noticing a listed incident. A personal data breach carries its own notification duty under the DPDP Act. We help you file accurately rather than late.
-
After
Tell people what to tell people
Staff, customers, your board, and where it applies the police. A written account that says what is known and what is not, so nobody has to improvise under pressure.
What we are called for
- Business email compromise and invoice redirection
- Payroll and vendor payment fraud
- An employee who ran a file from a fake recruiter
- Ransomware, and the decision about whether to pay
- A leaked or stolen credential set in active use
- Customer data found somewhere it should not be
- Executive impersonation on WhatsApp or email
- A fake app or site taking money from your customers
How we work
Two people, reachable directly, who answer the phone rather than routing you through an intake queue. The investigative method is the same open-source one behind everything published on this site: registration records, hosting, certificate history, company registries, and where an image or a phone number has appeared before. Public records, read in the order that tells you who is behind something.
The output is written and evidenced. What happened, what is known, what is not known, and what each claim rests on, in a form a bank, an insurer, a regulator or a police station can read without us in the room. Where we are guessing, it says so.
What this is not
- Not a money-back service. Reporting fast gives a bank the chance to freeze a receiving account. Nobody can guarantee the outcome, and a fee charged against a promise of recovery is the scam itself.
- Not a 24/7 monitored SOC. We are two people. If you need someone watching a console overnight, you need a different kind of supplier, and we will say so rather than take the work.
- Not law enforcement. We cannot compel anyone, seize anything or arrest anybody. We can make a complaint far harder to dismiss.
- Not a substitute for your lawyer. Statutory deadlines and notification duties are real and we will help you meet them accurately, but the legal call is not ours.
What the work looks like
The Trifleck investigation started the way one of these calls does: an engineer in Bengaluru was sent a malicious file by a fake recruiter, recognised the pattern and did not run it. Public records then tied the recruiter's company to three other fronts: the live websites share one registrar and one Icelandic privacy proxy, two were registered three hours and ten minutes apart on the same day, two list the same street address, and the recruiter's photograph came from a fourteen-year-old profile. It is published in full, so you can judge the standard of the work before you engage us.
If it is happening now
Call first and write later. Tell us what you have seen, what you have already switched off, and what is still running. We will tell you the first three things to do before any money is discussed, because those three things are time-critical and billing is not.
If money has just left a personal account, call 1930 and file at cybercrime.gov.in now. That is free, it is faster than us, and it is the right first move whether or not you ever speak to us.