Practice notes, published commentary and representative cases. An informed look at evidence, decisions and the situations that require closer examination.
From Neel’s writing
The interests behind the incident.
A technology problem may also be a conflict between people, companies or governments. Understanding those interests changes the questions an investigator asks.
What appears to be one payment, one account or one conversation can belong to a much larger picture.
01 / FINANCIAL HARM
The loss is the starting point.
Payment instructions, recipient accounts and communications give investigators different routes into the same event. Each needs to be preserved and examined in context.
Selected losses reported to the FBI’s IC3 in 2025, USD. Rounded figures; these are reported losses, not an estimate of all crime.
In February 2026, Anthropic reported suspected capability-extraction campaigns involving approximately 24,000 fraudulent accounts and more than 16 million exchanges.
The investigative question extends beyond a single login: which accounts share infrastructure, payment methods, timing or organisational connections?
24,000 approximate accounts 16m+ exchanges reported by Anthropic
03 / INVESTIGATIVE PRACTICE
A connection needs an explanation.
A shared address may suggest a link. A witness may explain it. Original records may support—or contradict—that account. We keep those distinctions visible as the investigation develops.
Cato & Veil’s approach: preserve the source, test competing explanations and identify what remains unresolved.
Company recordsWitness accountPayment history
Do independent sources support the same explanation?