If you suspect fraud inside your company, the first 72 hours determine how much of the evidence survives. Do not confront the person, do not reorganise or delete files, and do not announce an investigation: preserve the records first, then define precisely what you need to establish. Every route open to you afterwards, internal recovery, a criminal complaint, or a civil claim, depends on the integrity of the material secured in those three days.
Why the First 72 Hours Decide the Outcome
Fraud is rarely discovered at the moment it happens. It surfaces through a reconciliation that will not balance, a supplier unknown to operations, a customer complaint about a payment the ledger does not show, or a resignation that arrives too conveniently. By the time the suspicion forms, the conduct has usually been running for months.
What changes in the first 72 hours is not the fraud. It is the evidence. Accounting systems overwrite audit trails on a cycle. Email is deleted. Mobile devices are wiped and returned. Shared drives are tidied. A suspect who learns of the suspicion has both motive and, usually, continuing access. The difference between a provable claim and an unprovable one is normally decided in this window, before any lawyer or expert is formally engaged.
Hours 0 to 12: Contain, Do Not Confront
Restrict the circle of knowledge to the smallest group that can act: typically the owner or board chair, one trusted finance person outside the suspected chain, and external counsel. Every additional person raises the probability that the subject learns of the inquiry within the day.
Do not suspend, transfer, or interview the suspected individual yet. A suspension that precedes evidence preservation is the most common way UAE businesses lose their case: it converts a quiet inquiry into a race, and the party with system access wins that race. It also creates labour law exposure if the suspicion later proves unfounded.
Do quietly review access rights. Note who holds administrator privileges on the accounting system, the banking portal, and the email domain. Revoke nothing yet unless funds are actively moving, in which case protecting the asset outranks preserving the audit trail. Where a transfer is in progress, contact the bank immediately, and be aware that a police report may be required before a bank will freeze an account.
Hours 12 to 24: Preserve the Records
Preservation means creating a fixed copy of the evidence in a form that can later be shown to be unaltered. Six categories matter most in UAE financial disputes.
- Accounting system data: a full backup, not a report export. Reports are conclusions; the underlying transactional data with its audit log is the evidence.
- Bank statements and payment instructions for the full period under suspicion, obtained from the bank directly rather than from internal files.
- Email and messaging for the individuals involved, captured at server or platform level rather than from the user's own device.
- Supplier and customer master data, including the change history showing when bank details were amended and by whom.
- Contracts, purchase orders, delivery notes, and approvals for the transactions in question.
- Access and authorisation logs from the accounting system, the banking portal, and the ERP or building system where available.
Record what you took, when, from where, and who handled it. This chain of custody record is unglamorous and decisive. A UAE court assessing a financial expert report weighs the reliability of the underlying material, and evidence with an unbroken, documented custody trail is materially harder to challenge. Electronic records, email, and system extracts have defined probative value under Articles 53 to 63 of Federal Decree-Law No. 35 of 2022 on Evidence in Civil and Commercial Transactions, and the court assesses material defects in an instrument under Article 37 of the same law.
Do not work on original files. Take a copy, seal the original, and analyse the copy. Opening a spreadsheet changes its metadata, and an opposing party will raise that point.
Consider carefully who performs the capture. The IT administrator is often the natural choice and occasionally the wrong one, because administrator credentials are themselves a route to the conduct under examination, and because a capture performed by someone inside the suspected chain can be challenged later on independence grounds. Where the suspicion touches finance and IT together, an external party should take the images, with a member of management present as witness.
Hours 24 to 48: Define the Question
Investigations fail when their scope is "find out what happened". Define instead the specific financial question that has to be answered, because that question determines the method, the cost, and whether the result is usable in court.
Useful questions are narrow and quantifiable: what was the total value of payments to this supplier in the period, how many were supported by a delivery note, and what proportion went to an account whose details were amended within thirty days of payment. That is answerable. "Is the finance manager stealing" is not.
Set a preliminary period. Fraud examinations expand naturally, and an unbounded scope produces an expensive analysis that arrives too late to be useful. Start with the period where the anomaly appears, and extend only when the findings justify it.
Hours 48 to 72: Choose the Track
By the end of the third day you should decide, with counsel, which route you are pursuing. The tracks are not mutually exclusive, but they impose different evidential standards and different timelines.
The criminal track means filing a complaint with the police, which is then referred to the Public Prosecution. Embezzlement of movables entrusted to a person is an offence under Article 453 of Federal Decree-Law No. 31 of 2021 on Crimes and Penalties, which also penalises fraud and forgery. The criminal standard is high and the process is controlled by the prosecution rather than by you, but in practice it carries the strongest recovery leverage.
The civil track means a claim for the losses before the civil or commercial court. This is where a court-appointed accounting expert is typically instructed to quantify the loss, and where the quality of your preserved records translates directly into the amount the expert can substantiate.
The regulatory track may not be optional. If your business is a designated non-financial business or profession, the anti-money laundering framework imposes suspicious transaction reporting obligations within the timeframes it prescribes (Federal Decree-Law No. 20 of 2018 on Anti-Money Laundering, as amended, and its implementing regulation). Reporting obligations run independently of whether you pursue recovery.
The internal track, meaning quiet settlement and a negotiated exit, is legitimate and common. Do not choose it before the quantification is done. Settling for a figure you have not verified means settling for the amount the suspect is prepared to admit.
Sequence matters as much as selection. A criminal complaint filed before the loss is quantified tends to produce a file the prosecution cannot easily progress, while a civil claim filed without the preservation work behind it invites an expert instruction the records cannot answer. Note also that limitation periods run from dates fixed by law rather than from the date you discovered the problem, so counsel should confirm the applicable period early rather than at the point of filing. Limitation is a matter of substantive law, found in the Civil Transactions Law (Federal Law No. 5 of 1985, as amended) and the Commercial Transactions Law (Federal Decree-Law No. 50 of 2022), rather than in the procedural code.
Errors That End Cases
Confronting the individual before the records are secured. Announcing an investigation to staff. Allowing the suspect to hand over their own laptop or export their own reports. Working on original files. Waiting for the annual audit to confirm the suspicion, which delays the response by months and does not answer the question, because a statutory audit is not a fraud investigation and is not scoped to find one.
How AABDxb Helps
AABDxb conducts forensic accounting examinations for UAE businesses and prepares financial expert reports for court proceedings. The firm is led by a Ministry of Justice registered court-appointed accounting expert, which means investigation work is scoped from the outset to the evidential standard a UAE court applies rather than to an internal management standard. Engagement in the first days typically covers evidence preservation guidance, definition of the financial question, and quantification of the loss.