Organised Crime

What the discipline covers

• Shell and front companies: entities with formal existence, minimal accounts and no verifiable operational trace.
• Fraud networks against businesses: invoice diversion, false suppliers, fake investment platforms, recruitment of money mules.
• Shared digital infrastructure: domains, hosting, contact details and templates reused across supposedly unrelated entities.
• Corporate opacity: layered ownership, nominee directors, frequent changes of registered office, name or corporate purpose.
• Use of legitimate business channels — logistics, payment services, professional intermediaries — as a cover for illicit activity.

Scope

• Documentary profile of a counterparty: registry data, ownership chain, public history and coherence of the declared activity.
• Assessment of a network: relationships between entities, shared people, shared infrastructure and repeated patterns.
• Verification of the plausibility of an offer, a platform or an investment scheme presented to the organisation.
• Explicit exclusions: no surveillance of individuals, no undercover contact, no pretexting, no attribution of criminal liability.

Main risks and threats

• Payment diversion fraud: legitimate invoices redirected to accounts controlled by a third party after a compromised or spoofed exchange.
• Contracting a front company that later disappears, leaving the organisation exposed to loss and to reputational damage.
• Investment and financial platforms with a professional façade, escalating deposits and no verifiable licence.
• Employees recruited unknowingly as intermediaries for the movement of funds, with direct personal and corporate consequences.
• Reputational and compliance contamination through an intermediary that fails due diligence expectations.
• Reuse of the organisation's own brand and identity to defraud its customers or its suppliers.

Relevant indicators and warning signs

• Recently incorporated company presenting a long track record, or a long-dormant company suddenly reactivated.
• Registered address shared with dozens of unrelated entities, or an address with no operational capacity for the declared activity.
• Corporate website created days or weeks before first contact, with content copied from a genuine competitor.
• Bank details in a jurisdiction unconnected with the declared activity, or changed mid-negotiation under time pressure.
• Directors who appear and disappear across a series of short-lived entities in the same sector.
• Urgency, confidentiality requests and resistance to any documentary verification that is standard in the sector.

Application of OSINT

• Reconstruction of the ownership and control chain from company registries and official gazettes across the relevant jurisdictions.
• Correlation of digital infrastructure: domain registration data, certificate history, hosting and reused contact identifiers.
• Mapping of relationships between entities and people to identify repeated roles and hidden overlaps.
• Timeline analysis: comparing incorporation, domain creation, first contact and the moment of maximum pressure to pay.
• Coherence testing between declared activity, physical footprint, staffing evidence and public financial filings.

Zero101OSINT methodology

• Definition of the decision the analysis has to support before any collection begins, so scope stays proportionate.
• Separation of three levels in every deliverable: documented fact, reasonable inference and open question.
• Corroboration rule: no finding is reported on the strength of a single source, and every source is dated and archived.
• Explicit competing explanation for each red flag — poor administration and criminal design can look identical from outside.
• Findings graded by reliability and by relevance to the specific decision, not by how alarming they sound.
• A clear statement of what was not possible to verify, so the reader knows where the residual risk sits.

Open sources used

• Company registries, official gazettes, insolvency filings and published administrative resolutions.
• Published sanctions and restrictive-measures lists, and official regulatory warnings about unauthorised entities.
• Public domain registration and certificate transparency data, and publicly reachable website content and archives.
• Court decisions published in the public domain and official statements by supervisory authorities.
• Sector press and specialised sources, always traced, dated and rated, never used as the sole support for a conclusion.

Applications for companies, organisations and security decision-makers

• Screen a new supplier, distributor or customer before a contract, a credit line or a first shipment.
• Add documented external evidence to onboarding and anti-fraud procedures without expanding internal headcount.
• Give finance and legal teams a factual basis to challenge a payment instruction that has changed unexpectedly.
• Support staff awareness with real, anonymised patterns instead of generic warnings.
• Provide a board or audit committee with traceable grounds for declining or restructuring a business relationship.

Products or analytical outputs Zero101OSINT can provide

• Counterparty due diligence report: ownership chain, public history, inconsistencies and reliability of each finding.
• Network analysis linking entities, people and shared infrastructure, with a graphical view of the relationships found.
• Assessment of a suspicious offer, platform or payment instruction, with a documented verdict on plausibility.
• Brand abuse review: lookalike domains, fraudulent sites and false profiles using the organisation's identity.
• Indicator set and internal checklist so the organisation can apply the same screening on its own.

Legal, ethical and reliability limitations