First Hour Case Control Checklist

Core idea

The first hour is about establishing control, not about answering the case. Six areas get covered before analysis starts, and one of them is a standing list of conditions that mean you stop and notify a supervisor now rather than at the end of the shift. Budget 30 to 60 minutes.

Components

Case administration. Assign or verify the case number. Record the assigned investigator. Identify the reporting source (victim, SAR, referral, internal alert). Determine investigative authority and jurisdiction. Assess urgency and whether victimisation is ongoing. Record date and time received.

Initial case assessment. Summarise the allegation. Identify suspected offences, known subjects, and known victims. Decide whether cryptocurrency is central or incidental to the matter. Identify immediate investigative priorities.

Digital evidence identification. Identify known wallet addresses, known transaction hashes, blockchain networks, and assets. Identify exchanges or VASPs already known. Identify available screenshots, emails, chat logs, and documents.

Evidence preservation. Preserve the original complaint or referral. Preserve wallet addresses and transaction identifiers exactly as received. Capture source URLs. Open the evidence inventory. Start chain of custody documentation if policy requires it.

Investigation planning. Define objectives. Identify intelligence gaps and what further information is required. Prioritise tasks. Decide whether external or specialist resource is likely to be needed.

Documentation. Create investigation notes. Record every information source consulted and every investigative action performed. Save supporting material to the case file. Keep assumptions recorded separately from verified facts.

Immediate escalation indicators. Notify a supervisor now if any of these are present: active fraud in progress, significant financial losses, vulnerable victims, ransomware indicators, sanctions-evasion indicators, terrorist-financing indicators, large-scale money laundering indicators, child exploitation or human trafficking indicators, darknet marketplace activity, imminent risk of asset dissipation.

When to use

The moment a case is assigned or received, on every case, regardless of how small the reported loss looks. The escalation list is worth re-reading whenever the picture changes mid-case, because several of those indicators only surface after the first trace.

Avoid when

Slow down here rather than speeding up. The recurring failures are starting blockchain analysis before understanding the allegation, leaving the original referral unpreserved, omitting timestamps on investigative actions, blending assumptions into documented facts, and deferring preservation while doing more research. None of those look like mistakes in the first hour, and all of them cost hours later.

Example

A referral describes a modest five-figure loss to a trading site. Nothing about the amount triggers escalation, but the victim mentions the platform is still messaging them asking for a “tax payment” before withdrawal. That is active fraud in progress and ongoing victimisation, so it goes to a supervisor inside the first hour rather than sitting in a queue.

Related

Case Opening Procedure · The First 24 Hours of a Crypto Theft · Intake Triage Checklist · Five Intake Red Flags · PI Response Priority: Freeze, Monitor, Predict, OSINT · Victim Artifact Intake: Getting the Starting Point Right · Time-Decay of Crypto Evidence · Identify the Predicate Typology First