Money that’s been stolen doesn’t disappear. It moves.

That distinction sounds simple, but it’s the foundation of every asset tracing investigation we conduct. Fraudsters believe that if they move stolen funds fast enough, through enough layers, across enough corporate structures, the money becomes untraceable. In eleven days, we proved otherwise tracking $1.8 million through seven shell companies spanning three states before a significant portion could be dissipated beyond recovery.

This is how tracing stolen money through layered corporate structures actually works, what the investigators’ toolkit looks like in 2025, and what organizations can do to ensure that when theft occurs, the trail hasn’t gone cold by the time experts arrive.

The Engagement: What We Were Handed on Day One

The call came from a company that had discovered a significant gap between what their accounts payable records showed in vendor payments and what those vendors could verify they’d received. The discrepancy: approximately $1.8 million in payments over 14 months that appeared legitimate in the accounting system but couldn’t be reconciled to any documented goods or services.

The company’s internal team had already done what many organizations do well: they identified that something was wrong. What they hadn’t been able to determine was where the money had actually gone and whether any of it was recoverable.

On day one, we had three things: the company’s accounting records, access to their banking institution’s transaction histories, and a name a former accounts payable manager who had resigned two weeks before the discrepancy was discovered. The timing wasn’t coincidental.

Before anything else, we secured the evidence. Digital records were preserved under legal hold, the accounting system’s audit trail was exported and locked, and device forensics were initiated on the AP manager’s former company computer. What evidence fraud investigators actually look for begins with this step because evidence that isn’t preserved on day one is often gone by day three.

Days 1–3: Following the First Wire

Asset tracing in fraud cases almost always starts with bank records. Not accounting records bank records. The two don’t always match, which is often where fraud hides. In this case, the accounting records showed payments to four vendor names. The bank records showed those payments going somewhere entirely different.

The technique forensic investigators use here is called funds flow analysis: mapping every outgoing payment from the victim company’s accounts against the receiving account details, then tracing what happened to funds at each receiving institution. This produces a sequential picture of where money went at each step not where the accounting records said it went.

The first wire we traced went to a company registered in Delaware with no website, no employees, and a registered agent address shared with 847 other LLCs. This is a well documented pattern in shell company fraud: Delaware’s minimal disclosure requirements and low formation costs make it the jurisdiction of choice for layered corporate structures. In 2024, Treasury’s Financial Crimes Enforcement Network (FinCEN) identified over 32 million existing legal entities in the U.S. with potential beneficial ownership opacity concerns the scale of the problem reflects how accessible shell company formation has become.

We requested the bank records for that Delaware LLC through the company’s legal counsel using a civil subpoena. Within 48 hours, we had the outgoing wire records and they showed the funds moving again, immediately, to a second entity.

Days 3–7: Corporate Mapping Through Seven Layers

Tracing stolen money through layered shell companies is primarily a corporate mapping exercise. For each entity that receives funds, investigators conduct a parallel ownership search: registered agent filings, Secretary of State records, beneficial ownership database searches where available, UCC filings, and cross references against known addresses and names. Each entity reveals something a shared registered agent, an address that appears in another context, a signatory name that connects two otherwise unrelated entities.

By day seven, we had mapped all seven corporate layers:

• Layer 1–2: Delaware LLCs registered within three months of the fraud beginning, sharing a registered agent with no disclosed beneficial owners
• Layer 3: A Wyoming LLC another minimal disclosure jurisdiction whose single member was listed as Layer 2
• Layers 4–5: Nevada entities, again with nominee directors, but with one key error: a bank account application for Layer 4 listed a phone number that had been used in Layer 1’s registration documents
• Layer 6: A Florida LLC registered to an individual the AP manager’s spouse under a name variation that didn’t immediately surface in basic name searches but appeared in a cross reference against the phone number from Layer 4
• Layer 7: A personal bank account held by the AP manager directly, receiving transfers from Layer 6

This is what shell company fraud used by insiders looks like when it’s been carefully constructed: each layer adds a barrier, and most investigators stopping at any single layer would find a dead end. The connection across all seven layers was a phone number used carelessly on a single bank application four years earlier.

This single identifier a phone number appearing in two registration documents in different jurisdictions is the kind of link that didn’t exist in financial records or corporate filings alone. It emerged from cross referencing multiple data sources simultaneously. This is why modern forensic asset tracing combines public record analysis with open source intelligence rather than treating them as separate disciplines.

Days 7–11: Asset Freeze and Recovery Positioning

Tracing stolen money only creates value if it leads to recovery. Knowing where funds are doesn’t return them legal action does. From day seven onward, our work shifted from investigative to evidentiary: documenting the full funds flow in a format that could support emergency legal applications.

The company’s counsel filed for a civil freezing injunction on day nine, supported by our forensic report documenting the seven layer flow and the identifiable assets remaining at Layer 6 and Layer 7. A freezing injunction sometimes called a Mareva order prevents a defendant from dissipating assets before judgment. Courts grant them when the applicant can demonstrate both a good arguable case and a real risk that assets will be moved or spent if not frozen.

Of the $1.8 million originally stolen, approximately $680,000 remained in identifiable accounts at the time of the freeze. The remainder had been spent primarily on real estate deposits, personal expenses, and one significant cash withdrawal that left no traceable destination. Partial recovery is the norm in asset tracing, not the exception. As forensic investigators consistently note, tracing locates what remains; it cannot recover what has already been spent.

The criminal referral followed the civil freeze coordinated through counsel to maximize the evidentiary value of the investigation findings in both proceedings simultaneously. This dual track approach (civil asset recovery + criminal referral) is the structure that best serves victims’ interests in cases with traceable assets. For organizations weighing their options, our post on recovering money from an embezzling employee explains the full range of legal pathways.

What Made This Investigation Work in 11 Days

Eleven days is fast for a seven layer asset trace. It was possible because of two factors that are worth understanding for any organization that may face this situation.

Speed at the source. The company engaged legal counsel and forensic investigators immediately upon discovering the discrepancy before any confrontation occurred, before the AP manager was contacted, and before any internal communication about the investigation reached people who could alert the perpetrator. Every hour between discovery and engagement is an hour for funds to move further or accounts to be closed. The instruction to secure records, say nothing internally, and call an expert is not overcautious it is the difference between 11 days and too late.

Evidence preservation before action. Because digital records, banking data, and device forensics were secured on day one under proper legal hold protocols, the audit trail was complete when we needed it. The accounting system audit trail which showed the original transactions was intact. The AP manager’s former computer contained email communications that corroborated intent. None of this would have been available if the company had handled the initial discovery informally.

These two factors speed and evidence preservation determine the ceiling on what’s recoverable in any asset tracing engagement. How to document financial fraud so it holds up in court covers the documentation standards that made the freezing injunction possible.

Conclusion: Money Moves Fast. Investigators Move Faster.

The seven shell company structure in this case was designed to make tracing stolen money impossible. It nearly worked. What broke it was a phone number used carelessly, an investigation launched immediately, and a forensic methodology that treated every data source as potentially connected rather than examining each in isolation.

The practical lesson for organizations is straightforward: the single most important factor in recovering stolen funds is how quickly a professional investigation begins. Every day between discovery and engagement is a day for assets to move, accounts to close, and the trail to fade.

If you’re facing unexplained financial discrepancies payments that don’t reconcile, vendor accounts that don’t check out, a sudden resignation from someone with financial access the sequence is: preserve your records, engage legal counsel, and call a forensic accountant before anything else. Don’t confront, don’t investigate informally, and don’t wait to see if the numbers correct themselves.

They won’t. But the money can still be found if you move fast enough.

Frequently Asked Questions

1. How long does asset tracing typically take? The timeline varies significantly based on the number of corporate layers involved, the jurisdictions where assets are held, and how quickly legal tools like subpoenas and freezing injunctions can be obtained. Simple domestic traces can be completed in days; multi jurisdictional cases involving offshore entities may take weeks or months. Speed at the start of the investigation before assets are dissipated is more important than the total duration of the trace.

2. Can stolen money be recovered if it’s been moved through shell companies? Often, yes but the recovery rate depends heavily on how quickly the investigation starts and whether funds remain in identifiable accounts. Funds that have been moved through multiple layers but not yet spent are traceable and potentially recoverable through civil freezing injunctions. Funds that have been converted to cash or used for non recoverable personal expenditures cannot be traced beyond the point of conversion. Partial recovery is common; speed of engagement is the most important variable.

3. What makes shell companies effective for concealing stolen money? Shell companies work primarily through opacity: multiple layers of corporate ownership in low disclosure jurisdictions make it time consuming to identify who actually controls and benefits from each entity. Delaware, Wyoming, and Nevada are frequently used in domestic fraud because they require minimal beneficial ownership disclosure. Each layer a fraudster adds creates another subpoena, another jurisdiction, and another delay which is why the speed of investigation matters so much.

4. What legal tools are available to freeze stolen assets? Civil freezing injunctions (sometimes called Mareva orders) allow courts to prevent defendants from moving or spending assets pending judgment, when the applicant can demonstrate a strong claim and risk of dissipation. Asset freeze orders can be obtained on an emergency basis sometimes within 24 to 48 hours when supporting forensic evidence is strong. Criminal cases can also result in asset restraint orders. Working with legal counsel who specializes in fraud recovery is essential for accessing these tools effectively.

5. What role does the Corporate Transparency Act play in shell company fraud investigations? The Corporate Transparency Act, which took effect in 2024, requires most U.S. companies to report beneficial ownership information to FinCEN. When fully implemented and enforced, this requirement will significantly reduce the opacity of domestic shell company structures making asset tracing faster and cheaper for investigators. However, enforcement is still developing and offshore entities remain a significant concealment tool that CTA doesn’t address.

6. What should an organization do immediately upon discovering unexplained financial transfers? Preserve all financial records and digital evidence in their current state do not allow modifications, deletions, or access changes. Engage legal counsel before taking any other action, including confronting employees or notifying the perpetrator. Retain a forensic accountant to begin the trace as quickly as possible. Notify your fidelity bond or commercial crime insurer according to your policy’s reporting requirements. Every additional hour before engagement is an hour for assets to move further from recovery.

References

1. ForensicSpot. (2025). Asset Tracing Methodologies in Investigation. https://forensicspot.com/topics/forensic accounting/asset tracing methodologies
2. HKA Global. (2024). Following the Money: Forensic Accounting Tracing Methods and Best Practices. https://www.hka.com/article/following the money forensic accounting tracing methods amp best practices/
3. Turning Numbers Forensic Accounting. (2026). How Forensic Accountants Trace Hidden Assets. https://www.turningnumbers.com/blog/how forensic accountants trace hidden assets
4. TrueScope Consulting. (2025). Asset Tracing Techniques to Uncover Hidden Wealth in 2025. https://truescopeconsulting.com/asset tracing financial concealment/
5. FasterCapital. (2025). Asset Tracing: Following the Money Trail in Financial Forensics. https://fastercapital.com/content/Asset tracing  Following the Money Trail in Financial Forensics.html
6. Association of Certified Fraud Examiners (ACFE). (2024). Occupational Fraud 2024: A Report to the Nations. https://www.acfe.com/ /media/files/acfe/pdfs/rttn/2024/2024 report to the nations.pdf
7. U.S. Department of the Treasury, Financial Crimes Enforcement Network (FinCEN). (2024). Beneficial Ownership Information Reporting. https://www.fincen.gov/boi
8. GRF CPAs & Advisors. (2024). ACFE Study Finds Median Losses from Occupational Fraud Increasing. https://www.grfcpa.com/resource/acfe study occupational fraud/
9. Breakfast Leadership Network. (2025). Asset Tracing: How Private Investigators Recover Hidden or Stolen Assets. https://www.breakfastleadership.com/blog/asset tracing how private investigators recover hidden or stolen assets
10. Federal Bureau of Investigation (FBI). (2024). White Collar Crime Money Laundering and Financial Crimes. https://www.fbi.gov/investigate/white collar crime

Disclaimer: This article is provided for informational and educational purposes only. The investigation described is based on real world forensic experience presented in an educational context; identifying details have been modified to protect confidentiality. This content does not constitute legal, financial, or professional advice, and no professional or client relationship is created by reading it. Asset tracing methodologies, legal tools, and recovery options vary by jurisdiction and case type. Consult a qualified attorney or certified fraud examiner for guidance specific to your situation. For questions about FraudOrder services, visit https://fraudorder.co/