IMGCAP(1)]Social media is changing the way humankind communicates in every way. From live tweeting, to “checking in” on Facebook, to posting pictures to Instagram and tagging the geolocation, the amount of information to which the public has access is truly shocking.
When most think of social media, they think of these practices as a lighthearted, engaging avenue to keep in touch with contacts and to read up on the news. But when digital forensic experts think of social media, they see a prime place to search during their fraud investigations. The digital trail left by fraudsters on their social accounts, and others’, sets the stage for fraud examiners to connect the dots in ways that were unthinkable just a few years ago.
Discovery Tactics
Fortunately for fraud investigators, people often overshare their locations and activities on their social media accounts. Even when they don’t overshare, some social media platforms provide a plethora of searchable metadata, including timestamps and geo-locations, allowing investigators to more easily connect the dots in fraud investigations by giving them more clues to sift through.
Even if these clues are not verbally expressed, photos on some social media platforms contain geographical metadata that can ease a fraud examiner’s search. For the social media platforms that strip metadata from images when posted, oftentimes the source files can be subpoenaed to corroborate other findings. Investigators can also obtain evidence from publicly available information from the suspect’s friends and followers lists, along with locations, check-ins, Facebook emoji (like, love, wow, angry, etc.) and timelines. Through these variables, investigators have the opportunity to build a timeline of events, confirm an alibi, identify relationships between individuals or even locate a subject in real-time.
For example, when one company became concerned about a department of their business that had unusually high expenses with no legitimate business purpose, it requested an investigation. As investigators were performing their work, they confirmed the business’s concerns and found that two employees of the department were receiving a payout for their unused leave at the end of the year.
These payouts equated to all of the earned leave by both employees each year. The investigators found it highly unusual that an employee took zero vacation or sick days for multiple years in a row. After review of the public social media accounts for both employees, the investigators found that numerous pictures, which appeared to be from exotic locations, were posted to both employees’ public profiles. Upon further analysis of geo-location and image metadata, it appeared that the photos were taken on days the employees had reported being at work, and the geo-locations were not near the employment location. Through their findings on social media, the company was able to recover the erroneous payment of unused vacation time.
While the social media evidence in the example above pointed investigators in the right direction, social media evidence can also cause issues due to its easily editable, or removable, nature. One way to cure this is using Internet Archive, also known as the “WayBack Machine.” However, don’t become too dependent on the WayBack Machine; as of January 2011, it is no longer indexing Facebook.
For matters in litigation, a letter of preservations should be issued to include all social media accounts to decrease the chance that the perpetrator deletes or hides the suspicious content. To prevent losing the information, investigators must immediately save all evidence by noting the link to the accounts and printing all materials—even if you are unsure if it is applicable to the investigation. There are several tools, such as Camtasia Studio, CamStudio and ScreenFlow, that investigators can use to record these types of searches. These tools allow the investigator to record all activity appearing on the screen. It is crucial to authenticate not only the evidence gathered, but also the methods used to do so.
Social Media Ethics
Public social media profiles commonly are used in workers’ compensation and insurance claims investigations. Users interact in a casual format on social media and will tag or post information about themselves and their friends or acquaintances.
For example, an insurance company received a claim for bodily injury from an automobile accident. The claimant was unable to work and had limited physical activity due to the injury. Prior to the accident, the claimant reported being a thrill seeker who was physically active. To verify the claim, the claims investigator set out to search for publicly available social media accounts for the claimant. When searching Facebook, the investigator identified an account for the claimant, but did not find anything contradictory on the claimant’s public timeline. However, the investigator identified numerous close friends of the claimant with public profiles. Through a review of those public profiles, the investigator found the claimant was featured in numerous pictures participating in rigorous physical activity after the date of the accident. The investigator later discovered a Twitter account of the claimant that corroborated the activity in the photos. The investigator followed up with an interview, and the claimant admitted to misstating his injuries, saving the insurance company from paying a false claim.
It is wise to glean any information possible from the suspect’s closest contacts, such as family members, friends or colleagues. While obtaining this information can be greatly beneficial to an investigation, it is crucial that investigators secure the data ethically and legally. It should only be information available to the public, and it is often deemed unethical to “follow” or “friend” the suspect or their acquaintances. According to findings from the case Sumien v. Careflite described in the report,
The ethics and legality of e-discovery are constantly changing as the process grows in popularity, so be sure to stay up to date on the latest laws. While social media is an invaluable tool for fraud investigations, it’s crucial to ensure you follow the process properly and legally.
