Dodgy Dave diverts an invoice through a mule account¶

Dave learns that Northmere Joinery is about to pay a £12,480 supplier invoice. A convincing message supplies “updated bank details”, and the business sends the money to an account controlled by Leanne Price. Dave plans to move it through a payment wallet before anybody notices. His plan relies heavily on everybody else’s payment systems being less organised than he is.

This is an invoice-diversion example, separate from the motorbike investigation and the recruitment and harassment stories.

Dave finds a payment worth diverting¶

A compromised mailbox contains invoice INV-7742 from Calder Electrical to Northmere Joinery. Dave copies the genuine invoice, changes the receiving details and sends a short follow-up saying the supplier has moved banks.

The genuine invoice number and amount help the false instruction survive a routine check. They also give the later investigation distinctive values with which to compare the message, business payment and receiving-account records. A transaction reference can be a powerful matching feature even though the entered reference alone does not prove the payment’s purpose.

Dave recruits Leanne¶

Dave tells Leanne that his payment account has reached a business limit and offers her £600 to receive a client payment. Leanne supplies account details and agrees to move the money immediately after it arrives.

A mule account describes the suspected function of Leanne’s account. It does not settle whether Leanne was knowingly laundering fraud proceeds, recklessly ignored the circumstances or was herself deceived. Her communications, account opening, device possession, transfer instructions and retained benefit test those possibilities.

The distinction between account holder, user and beneficiary keeps the evidence precise without pretending the receiving name is worthless.

The money moves quickly¶

Dave believes rapid movement makes the money untraceable. In fact, the short intervals create a highly distinctive sequence across independent providers.

Receipt, immediate app access, beneficiary creation and rapid transfers from the registered device are a strong circumstantial combination. Evidence of mule-account control can then be compared with Leanne’s communications and possession of the device.

Dave receives useful value¶

Wallet PW-604 is registered under false details, but its provider records a recurring device identifier also used when Dave later purchases high-value electronics for collection. The collection booking uses a telephone number associated with Dave, and store footage records the person collecting the goods.

No single feature has to perform the whole attribution. The invoice reference joins the instruction to the payment; the receiving account and registered device address Leanne’s role; the wallet session, collection details and physical evidence address Dave’s control and benefit. Together these are strong, mutually corroborating lines of enquiry.

Following the complete payment chain matters because movement of money and personal attribution are related but separate propositions. The providers establish the route; account, device, communications and collection evidence connect people to it.

Dave adds another layer¶

Dave sends the remaining wallet balance onwards and deletes his collection confirmation. This may make recovery and attribution harder. It also creates further provider accounts, transaction identifiers, timestamps and device events.

A digital-wallet account does not automatically identify its user, but repeated device access, linked contact details and real-world collection evidence can make the route towards Dave compelling. Complexity is not the same as disappearance.

What Dave changed - and what he did not¶

Dave diverted the invoice, not the evidence. The altered document, matching payment reference, rapid movement, registered-device use and eventual benefit give the investigation several independent ways to test what happened.