J / Journal
Journal
Eighteen notes on intake, evidence and windows for action. Not advice on a specific matter.
2025-11-12IntakeThe first 48 hours after an incidentThe trail does not cool evenly. Payments, logs and correspondence keep different clocks.2025-10-28SecurityWhy we never take seed phrasesA secret key is not evidence. It is control over an asset that can still be lost a second time.2025-10-09PaymentsThe chargeback window is shorter than it looksA card trail lives by the scheme rules, not by the client’s emotion.2025-09-18Investment scamHow to assemble a pig-butchering fileThe scheme lives for months. Evidence is not one transfer, but a repeating descriptor and an off-ramp.2025-08-30TRACEA mixer is not a dead end. It is another confidence levelAn observed hop and a probabilistic cluster cannot be written as one line to a venue.2025-08-07CyberIf the ransom has already goneThe payment is a new source. It can be traced. It does not undo the incident.2025-07-21EvidenceChain of custody without theatreA court and a bank do not ask whether the file looks pretty. They ask who touched it, and when.2025-07-02PaymentsThe descriptor gives away the brand networkSeven websites and one statement text is already an investigation, not a coincidence.2025-06-16CyberWhat an exchange wants in an account takeoverA support-chat screenshot is not a chronology. The venue wants a court-ready event tape.2025-05-29BanksWhat a bank needs to see in the fileA bank reads risk and source, not a manifesto of injustice.2025-05-08Private clientsRomance and investment are often one payment schemeThe emotional layer does not cancel the descriptor. It only slows the file.2025-04-17OrganisationsQuiet forensics of internal fraudA premature scandal burns evidence faster than the ledger.2025-03-26TRACEA bridge does not erase the trail. It renames itA venue refusal for ‘insufficient attribution’ often means the file mixed networks without confidence levels.2025-03-04CounselWhat counsel should receive on day oneCounsel should not have to be a graph analyst. They need a verifiable file.2025-02-14CyberWhen a ransom should not be paidPayment creates a new trail and a new dependency. It is a board decision, not a restore button.2025-01-22MethodFact, inference, hypothesis — three different lettersMixing confidence levels is the most expensive error in a letter to a venue.2024-12-11CryptoOTC as a point of actionNot every off-ramp is an exchange. Sometimes it is a desk that still holds a compliance lever.2024-11-19IntakeHow matter intake worksThe form is not marketing. It is the boundary where we separate a mandate from curiosity.