Cyber investigations
Cyber Investigation Services
Online harassment, fraud and scams leave traces, but few people know where to look or what a court will accept. Our cyber investigation services identify the people behind anonymous accounts, fake emails, fraudulent payments and crypto scams, and deliver evidence your attorney, the police or your bank can use.
Rexxfield is a team of cybercrime investigators that has been working these cases since 2008. We combine open-source research, technical analysis and legal process support to turn an anonymous username into a named person, or tell you plainly when the evidence cannot get there.
Book a free consultationOur cyber investigation services
Every service below has its own page with more detail on how we work and what you receive.
Harassment, stalking and anonymous accounts
- Identify an anonymous antagonist: we work to identify internet trolls, stalkers and anyone sending threats or impersonating you from behind an anonymous account.
- Social media investigations: we trace fake and anonymous profiles on Instagram, X, Reddit, TikTok and other platforms.
- Online defamation investigations: we identify the people behind smear campaigns, fake reviews and defamatory posts, and preserve the evidence before it disappears.
- Investigations for celebrities and public figures: we investigate obsessive fans, stalkers and online threats against people in the public eye.
- Digital executive threat intelligence: we monitor and investigate threats against executives and their families.
Fraud and financial crime
- Business email compromise investigations: we investigate hijacked inboxes and fake payment instructions. Read a real example in our business email compromise case study.
- Wire fraud and financial crime investigations: we trace where the money went and prepare findings for banks and law enforcement.
- Romance scam investigations: we identify the scammers behind fake relationships and document the fraud.
- Google Ads click fraud investigations: we find the source of fraudulent clicks that drain your advertising budget.
Cryptocurrency and digital assets
- Scam and digital assets investigations: we trace stolen cryptocurrency and the wallets and people behind it.
- Crypto scam evidence pack: we assemble the transaction evidence you need to report a scam and support recovery efforts.
- Cyber-focused private investigations and digital asset tracing: we locate and trace digital assets in disputes and recovery matters.
- Crypto assets and divorce: we help attorneys and spouses find hidden cryptocurrency during divorce.
Legal and intelligence support
- Litigation support: we provide forensic analysis, reports and testimony for attorneys and legal teams.
- Subpoena preparation: we prepare the factual basis and wording of subpoenas for your attorney to issue to platforms and providers.
- Intelligence reports: we deliver written research on people, organizations and online activity.
How a cyber investigation works
Every case is different, but most follow the same path.
You describe the case
Tell us what happened, what evidence you have and what outcome you need. We tell you honestly whether an investigation can help.
We scope the work and agree the fee
You see the fee before work starts. Our fees are published.
We preserve the evidence
We capture emails, messages, posts and account details in a form that holds up in court, because online evidence disappears quickly.
We investigate
We map the accounts, run technical checks on domains, email headers and files, and compare any suspects against the evidence. Each finding has a source and a confidence level.
We prepare the next step
If the identifying records sit with a provider, we prepare the subpoena details for your attorney. If you have a suspect, we test whether the evidence supports them.
You receive a report
Our written report and affidavit support a protective order, a lawsuit or a police report. If your case goes to court, we also provide expert testimony.
How we handle evidence and chain of custody
Evidence only helps if a court, a bank or a police department will accept it. We build every case with that in mind.
- Capture first. We preserve emails with full headers, messages, web pages and account details as soon as we receive them, with the date, time and source recorded for each item.
- Original files stay untouched. We work from copies and keep the originals unchanged, so no one can argue that the evidence was altered.
- A written record of every step. We log who handled each item, what we did with it and what we found, so a third party can repeat our work and reach the same result.
- Findings with confidence levels. Our reports separate confirmed facts from reasoned inferences and say how strong each one is.
- Lawful methods only. We do not hack accounts or devices. Evidence gained that way would harm your case.
How we work with attorneys
Many of our cases involve a lawyer from day one. We work as your attorney’s technical team, and we can also work directly with you and bring in counsel later.
- Before you file. We identify anonymous defendants so your attorney can name the right person in a complaint.
- Legal process. We prepare the factual basis for subpoenas, preservation letters and platform requests. Rexxfield is not a law firm, so your attorney issues them.
- Reports and affidavits. We write findings in plain language that a judge can follow.
- Testimony. If the case goes to court, our investigators testify to the methods and findings.
- Confidentiality. We treat every engagement as confidential and share findings only with you and the people you name.
Who we help
Individuals and families
facing harassment, stalking, sextortion, impersonation or scams.
Attorneys
who need to identify an anonymous defendant before they file, or need technical evidence for a case.
Businesses and executives
dealing with email compromise, fraud, defamation or threats.
Public figures
facing stalkers and coordinated online abuse.
Law enforcement agencies
that need support on cybercrime investigations.
Why clients choose Rexxfield
Evidence that stands up
We document every step so your attorney or the court can rely on it.
Honest assessments
We tell you when open sources reach their limit and what the most practical path forward is.
Proven results
Browse our case studies and client reviews.
What cyber investigation services can and cannot do
We start with open-source research (OSINT), and it often answers the question on its own. We follow usernames, linked accounts, domain and email records, photos and public records to build a profile of the persona, and we tie it to a real person only with evidence. Read how an OSINT investigation works. No investigator can guarantee a name. Some cases reach a point where only a platform or provider holds the record that identifies the person. In that case we explain why and move to a lawful, controlled engagement that draws out the details we need. If the case ends up in court, we work with your attorney to support the litigation.
We also cannot promise that stolen money will come back. Recovery depends on how fast you act, where the money went and the cooperation of banks and exchanges. If you have just sent a payment, call your bank first and report the incident to the FBI’s IC3 in the United States or ReportCyber in Australia.
What do cyber investigation services cost?
The fee depends on the type of case, so we publish our fee structure and quote you before work begins. See our fees page for details. Lawyers and law enforcement agencies can ask us about their own arrangements.
Frequently asked questions
What are cyber investigation services?
Cyber investigation services identify who is behind online harassment, fraud and scams. They combine open-source research, technical analysis of emails, accounts, domains and transactions, and support for legal process, and they end in a report you can use with your attorney, the police or your bank.
Can you find who is behind an anonymous account?
Often, but not always. Open-source research often identifies the person: we link usernames, domains, email addresses and public records, and we score each suspect on the evidence. We state the confidence of each finding. When only the platform holds the answer, we use a lawful, controlled engagement to get it another way, and we support your attorney if the case goes to court. Read our guide on how to find a fake email sender for an example of how the process works.
Can you recover stolen cryptocurrency?
We trace where the funds went and prepare evidence for exchanges, banks and law enforcement. We cannot promise recovery, and speed matters, so contact us as soon as you notice the theft.
Is a cyber investigation legal?
Yes. We use lawful methods only, and we advise you on what you can and cannot do yourself.
Can you work with my attorney?
Yes. We prepare reports, affidavits and the factual basis for subpoenas, and we work with attorneys and law enforcement throughout.
How long does an investigation take?
It depends on the case and on whether we need records from a provider. We give you a realistic estimate when we scope the work.
Do I need to be in the United States?
No. We support clients and law enforcement around the world.
Tell us what happened
Choose your case type and we will tell you honestly whether an investigation can help, and what it would cost.
Start your investigationRexxfield is a cyber-investigations firm, not a law firm. This page is general information, not legal advice.