When agencies investigate suspected business fraud, they rarely announce it up front. Instead, you’ll see clues—some obvious, some subtle—that your company, leadership, or a specific business unit is under scrutiny. Spotting these signals early lets you protect your rights, preserve evidence properly, and avoid unforced errors.
1) Direct government contact (strongest indicators)
- Grand jury subpoena or administrative subpoena. A formal demand for documents, communications, or testimony—often with tight deadlines and broad scopes.
- Civil Investigative Demand (CID). Common in civil enforcement (e.g., FTC, DOJ Civil, state AGs); still serious and often a precursor to litigation or coordination with criminal authorities.
- “Target,” “Subject,” or “Witness” letter. Language that describes your status in a federal investigation; a “target” letter is the clearest warning sign.
- Unannounced agent visit (“knock and talk”). Federal or state agents show up at your home or office to “ask a few questions.” You’re not required to talk without counsel.
- Search warrant. If executed, you’re well past the “early” stage—but warrants sometimes follow earlier overlooked signs.
2) Indirect signals via third parties
- Vendors, customers, or former employees receive subpoenas that specifically request your records or communications.
- Banks, processors, or platforms ask unusual follow-up questions (enhanced due diligence, transaction-level justifications) or suddenly terminate relationships. They can’t confirm a Suspicious Activity Report (SAR), but their behavior may indicate regulatory pressure.
- Auditors or outside accountants are approached by government investigators or request unusually granular detail they’ve never asked for before.
3) Financial and banking friction
- Unexpected account holds, wire delays, or new “source of funds” demands.
- Chargeback spikes paired with processor questionnaires focused on marketing claims, refund practices, or subscription terms.
- Insurer outreach about coverage for investigations (D&O, EPLI, crime/fidelity) triggered by a notice they received or by public-record activity.
4) “Routine” exams that don’t feel routine anymore
- Regulatory exams that expand suddenly in timeframe or scope (e.g., “please include personal-device messages” or “pull every transaction tied to X partner”).
- Requests for policies not usually examined (e.g., data-retention, complaint handling, refund/chargeback playbooks, affiliate monitoring).
- Examiner emphasis on marketing claims, ROI promises, or consumer disclosures, especially where they cross state lines or touch federal programs.
5) Internal activity spikes and employee contacts
- Former employees report being contacted at home by agents or investigators.
- Your current staff receive LinkedIn messages or calls from “Special Agent” or “Investigator” titles.
- Whistleblower hints (hotline tips, HR complaints) that reference “illegal” or “fraudulent” conduct, or mention they’ve “talked to authorities.”
6) Data and tech breadcrumbs
- Preservation notices or litigation holds from agencies or counterparties.
- Cloud providers notify you (when permitted) of legal process impacting company data (some notices are delayed or barred by gag orders).
- E-discovery footprints—unusual internal requests for historical chats, texts, or archives originating outside normal legal/compliance workflows.
What to do in the first 24–48 hours (without escalating risk)
- Engage counsel immediately. Centralize all communications through your attorney to preserve privilege and avoid inconsistent statements.
- Issue a written legal hold. Suspend auto-deletion and instruct employees to preserve emails, texts, chats, shared drives, and personal devices used for work.
- Secure and inventory data sources. Email, chat, CRM/ERP, accounting, payment processor portals, marketing platforms, and employee BYOD.
- Limit internal chatter. Create a single point of contact. Well-meaning “explanations” can be discoverable and misleading.
- Politely decline unscheduled interviews. You have the right to counsel present for any conversation with agents.
- Start a privilege-protected factual timeline. Who did what, when, and where the relevant data lives—organized under attorney direction.
- Map insurance coverage. Notify carriers (e.g., D&O, crime) per policy—but only after counsel reviews notice language.
- Plan narrow, compliant production. Over-producing is risky; under-producing invites sanctions. Scope should be negotiated by counsel.
What not to do
- Don’t delete, “clean up,” or re-write files or chats. Even routine deletion can look like obstruction after you’re on notice.
- Don’t conduct ad-hoc interviews or send “what did you tell them?” messages to employees.
- Don’t contact complaining customers or ex-employees about the investigation.
- Don’t assume it’s “only civil.” Many civil inquiries run parallel to criminal probes.
How former prosecutors approach this phase
At Simmons & Wagner, we’ve seen these investigations from the government’s side. Early on, we typically:
- Decode your status (target/subject/witness) and the agency’s theory from the document requests and timing.
- Open a professional channel with agents/prosecutors to clarify scope, negotiate deadlines, and protect your team from surprise interviews.
- Direct a privileged internal review (documents + key witness proffers) to identify defenses, compliance evidence, and remedial steps.
- Shape a precise production strategy (what exists, where it lives, and how to produce it once—correctly).
- Advise leadership and the board on risk, messaging, and next steps without waiving privilege.
If you see any combination of the signs above—especially subpoenas, agent outreach, or odd banking behavior—treat it as a likely investigation. Preserve evidence, stop informal discussions, and get experienced counsel involved immediately. Early, measured action can prevent mistakes, narrow the scope, and in some cases resolve the matter before charges are filed.