The short answer
When fraud is discovered, the first 48 hours usually decide whether the money comes back. For a General Counsel, four things immediately matter: preserve the evidence, control the communications, map the money and decide whether the company needs urgent court relief. This guide sets out your first response strategy, and things to avoid which could undermine recovery prospects before proceedings even begin.
EXECUTIVE SUMMARY
- Fraud rarely announces itself. It surfaces as an odd invoice, a changing explanation or a payment routed around ordinary review. Inconsistency is the strongest signal.
- You do not need to know the full loss before acting. Waiting to quantify every dollar gives more time for evidence to disappear and assets to move.
- The first response is calibrated in six steps: preserve evidence, control communications, map the money, instruct external counsel who are conflict-free and nimble, and have deep expertise in civil fraud matters, consider urgent court relief, then sequence the parallel steps (insurers, regulators, employment action).
- Freezing and search orders are powerful but exceptional. They demand careful evidence, full and frank disclosure and a clear litigation strategy from day one.
Fraud rarely announces itself as fraud
Fraud usually first appears as something smaller. An unusual invoice. A supplier payment that does not quite match the contract. A credit card statement with an explanation that changes twice. A whistleblower complaint. An account moved off the usual ledger. A senior employee who can approve exceptions without real challenge.
By the time the issue reaches you, the board or the CFO, the question is no longer only what happened. It is whether the company can still recover the money, keep the evidence and stop assets moving. That is where speed matters, and where the General Counsel sets the tone for everything that follows.
WORKED EXAMPLE: A COMMON FRAUD PATTERN A large company has a long-running distribution arrangement with an external partner. Over time, one internal manager becomes the person who approves top-up funding, marketing support and one-off spending. The partner submits invoices. The invoices are approved. Payments are made. The process looks ordinary because it has been repeated many times. Then two things emerge. First, some invoices may not be supported by genuine business activity. Secondly, some of the money may have funded benefits for an insider or related persons: credit card payments, hospitality, gifts, travel and other personal spending. At that point the problem is no longer a controls failure. It may involve breach of employee duties, breach of directors’ duties, misleading or deceptive conduct, knowing assistance, knowing receipt, conspiracy and claims to trace and recover the money. If companies received the funds, there may be claims against those entities and the people behind them. One more thing is typical. The company does not yet know the full amount of the loss. The early evidence proves serious wrongdoing but not every dollar. That is not a reason to wait. Waiting lets evidence disappear and assets move. |
How to spot fraud early
The strongest fraud signals are behavioural and procedural, not dramatic. False or inflated invoices usually sit inside a process that looks compliant on its face. Watch for invoices approved by the same small group, vague descriptions of services, repeated “exceptional” payments, funding requests outside budget, supplier records that do not match actual performance, and payments routed through accounts that escape ordinary review.
Misappropriation often leaves a second trail. Look for personal spending paid indirectly, unexplained card charges, reimbursement claims with weak records, benefits provided by suppliers, unusual hospitality, gift cards, payments to relatives or associates, and payments with no commercial connection to the stated purpose.
The most important red flag is inconsistency. If the stated business purpose changes, if the documents do not match the explanation, if a person who should know the answer is “surprised” by records they previously received, or if the same transaction is described differently to different people, escalate it.
What to do in the first 48 hours
Preserve the evidence.
Issue a written preservation notice. Lock down emails, messaging accounts, laptops, phones, accounting systems, CRM records, payment approval workflows, card statements, bank records, supplier files and board papers. Do not let the people under suspicion manage the collection.
Control the communications.
Internal speculation can damage privilege, alert wrongdoers, prejudice later proceedings and create discoverable material that hurts the case. Appoint a small investigation team with clear reporting lines to legal counsel and to the board or an appropriate committee. You should give careful attention to the maintenance of legal professional privilege.
Map the money.
Identify the source of funds, the approval pathway, the recipient accounts, the immediate beneficiaries and any onward transfers. Fraud recovery is often won by tracing before the trail goes cold.
Instruct external counsel with civil fraud expertise.
Dealing with fraud is a specialist discipline in and of itself. Far too often, fraud claims are lost, and asset recovery fails, because in-house counsel turns to their panel firms or usual litigation lawyers. Due to the need for speed, choosing a conflict-free law firm, with civil fraud expertise, that is nimble enough to quickly clear conflicts and run to court is essential. Your external counsel can help maintain privilege, assist you in investigative matters and be an independent sounding board.
Decide whether urgent court relief is needed.
Australian courts can restrain a respondent from dealing with assets where there is a good arguable case and a danger that a prospective judgment will be wholly or partly unsatisfied: Uniform Civil Procedure Rules 2005 (NSW) r 25.14; Federal Court Rules 2011 (Cth) r 7.35. Evidence of fraudulent misappropriation itself readily supports the inference of that danger: Patterson v BTR Engineering (Aust) Ltd (1989) 18 NSWLR 319 at 321–322. The NSW Court of Appeal restated the principles in KR Properties Global Pty Ltd v Kazzi [2024] NSWCA 141. Search orders can preserve evidence where there is a strong case, serious potential loss and a real possibility that material will be destroyed: UCPR r 25.20. These remedies are exceptional and call for a high degree of caution: Cardile v LED Builders Pty Ltd (1999) 198 CLR 380 at [51]. They demand careful evidence, full and frank disclosure, proportionate orders and a clear litigation strategy.
Sequence the parallel steps.
Employment action, contract termination, insurer notification, reports to regulators or police, continuous disclosure for listed entities, and the preservation of rights against auditors, advisers, counterparties, directors and officers. Each of these can help or hurt the recovery. Order them strategically.
The legal tools for recovery
Fraud recovery is not one claim. It is usually a combination of claims and remedies built to preserve assets, obtain information, trace funds and convert evidence into a recoverable judgment.
A plaintiff may seek a freezing order to stop assets moving, with ancillary orders requiring the respondent to disclose their assets. Search orders can preserve devices, accounts and business records. Subpoenas and notices to produce can obtain bank, accounting, email and third-party records. Where money has moved through companies, trusts or related entities, claims can be framed to reach the recipients and those who assisted, and in a proper case a freezing order can extend to third parties holding the assets: Cardile v LED Builders Pty Ltd (1999) 198 CLR 380. It can reach assets outside Australia: Deputy Commissioner of Taxation v Huang [2021] HCA 43.
The substantive claims depend on the facts. They may include breach of contract, breach of fiduciary duty, breach of statutory duties, misleading or deceptive conduct, dishonest assistance, knowing receipt, conspiracy, deceit, unjust enrichment, money had and received, equitable compensation, account of profits, constructive trust and tracing. Where a company is insolvent or close to it, liquidators may add voidable transaction claims, insolvent trading issues and public examination powers.
If your company is on the receiving end, the task is different but equally urgent. A freezing order can affect ordinary business, personal assets, legal spending, banking relationships and reputation before liability is proved. The response may involve challenging the alleged case, narrowing the order, negotiating carve-outs, protecting privilege, correcting overreach, complying with asset disclosure obligations and building the evidentiary answer before the return date.
Why the record matters
Fraud disputes are built on documents. Courts, regulators and insurers will test what was known, when it was known, who approved what, what was escalated, and why no one acted sooner.
For a plaintiff, a disciplined record supports urgent relief and recovery. For a defendant, contemporaneous records may be the difference between misconduct and a poor process, between knowledge and assumption, and between personal liability and a defensible commercial explanation.
The best record is created early: a chronology, a document map, a funds-flow analysis, a witness list, a privilege protocol, a preservation notice, a board paper and a litigation plan.
A practical framework: the 48-hour checklist
Window | Action | Owner |
Hour 0–4 | Issue a written preservation notice. Suspend document destruction. Secure devices, mailboxes, accounting systems and payment records. | GC, with IT |
Hour 0–4 | Appoint a small investigation team. Route all reporting through legal counsel to protect privilege. | GC |
Hour 4–12 | Remove the suspected persons from the evidence chain and from payment approvals, without tipping them off. | GC, with HR and finance |
Hour 4–24 | Map the money: source of funds, approval pathway, recipient accounts, onward transfers. | External counsel, forensic accountants |
Hour 12–24 | Brief the board or the audit and risk committee. One page. Facts, unknowns, next steps. | GC |
Hour 24–48 | Decide on urgent relief: freezing orders, search orders, disclosure orders. Prepare the evidence for a without-notice application if needed. | External counsel |
Hour 24–48 | Consider parallel steps: insurer notification, employment action, regulator and police reporting, continuous disclosure. | GC, with external counsel |
Ongoing | Build the record: chronology, document map, funds-flow analysis, witness list, privilege protocol, litigation plan. | Investigation team |
How Ironbridge handles it
Ironbridge Legal is built for urgent, complex commercial disputes. We act where fraud has been discovered, where assets may move, where evidence may disappear, and where the first court application can shape the whole case. Our fraud, asset tracing and recovery practice is recognised by The Legal 500 and Doyle’s Guide.
For companies pursuing recovery, we move quickly to preserve evidence, freeze assets, trace funds, identify claims and recover value. For those responding, we deal with urgent applications, protect rights, manage disclosure obligations, challenge overreach and build the defence. Fraud cases need more than outrage. They need speed, judgement and a recovery strategy.
Frequently Asked Question
Further Information
For further information about responding to suspected fraud, urgent freezing and search orders, or fraud and asset recovery strategies, please contact the author of this article:
