When fraud happens, most people's first instinct is to call a lawyer. But what if you're a three-person company, based in the UK, and it's never happened before?
We lost over £12,000. I didn't hire a lawyer. I independently organised the evidence, drafted all documents, contacted every relevant institution, and ultimately appeared in court alongside the CEO.
This article isn't a victory story — the cases are still ongoing as of writing. But I want to document the decision-making framework I built in the process, because nobody teaches you this. You have to figure it out in the most chaotic moments.
The fraudster was impersonating a property management company claiming to do real estate legal services. We ran due diligence — checked Companies House, their website, looked up their clients. Everything checked out. We'd been in contact for months, and they never once asked us for money unprompted.
That's what makes this type of fraud so hard to prevent: they don't ask for your money upfront. They earn your trust first.
Their payment method was a physical card terminal — contactless Visa transactions. This made them look like a legitimate merchant with a physical presence. We later learned this was the entire mechanism: using our payment infrastructure as a pass-through layer to extract funds.
One day, we flagged that the same card was used twice within a short window for large transactions. It was noticed — but not escalated fast enough. The funds were processed and paid out.
Then the legitimate cardholder appeared. They had no knowledge of these transactions and wanted a chargeback. Because NeroPay operated under a larger regulated payment processor, we were required to cover the chargeback or risk losing our processing rights.
We paid. Then we went after the merchant.
When we reached out for an explanation, his tone changed immediately. He claimed we had misused his stored card details — but our Terms and Conditions clearly stated that in cases of dispute, we retained the right to recover funds via card-on-file. He hadn't read them. He tried to use that against us anyway.
He said if there was a dispute, we could "contact his clients directly" — then provided no client contact details whatsoever. Classic misdirection: create confusion, exhaust the other side, then disappear.
Once we decided to pursue formal action, I started organising everything we had.
What we had: all WhatsApp conversation screenshots, email correspondence, phone call logs (our customer service system auto-records calls with prior notification), his company registration documents, the identity documents he'd submitted for KYC, transaction records, and the specific T&C clauses that governed the situation.
The hardest part was WhatsApp — we were worried he might delete messages on his end, leaving our screenshots without corroboration. Our solution was to timestamp every screenshot and store them redundantly across multiple locations to establish a clear chain of custody.
Evidence doesn't just need to exist — it needs to be credible. Every screenshot needs context so that a complete stranger can understand what happened within five minutes of reading it.
My organisation format was: a timeline (every transaction and communication, chronologically), a document index (every exhibit numbered with a description), and a financial summary (loss amount, covered chargeback, claimed amount).
Action Fraud — The UK's national fraud reporting centre. This is step one. You receive a Crime Reference Number, which you'll need for every subsequent interaction. But know what you're getting: Action Fraud is primarily a data collection system, not an enforcement body. They won't actively investigate your case.
Police — Report formally using the Crime Reference Number. Because the amount crossed a certain threshold, the police agreed to take the report, though initially suggested mediation first.
Mediation — Courts typically require a mediation attempt before formal proceedings. Our CEO attended. The other party showed no genuine willingness to resolve. Mediation failed.
County Court — Filed through HMCTS MoneyClaim Online. Once submitted and accepted, formal proceedings began.
As we assembled court documents, the full picture emerged. The person we'd been dealing with had 27 known aliases. He'd defrauded people across multiple industries — sometimes as a property company, sometimes as a used car dealer, taking payment and never delivering. He was, according to media reports, the first person in England to be legally prohibited by a court from using a false name in English-language commercial transactions.
We weren't the first victims. We wouldn't be the last — unless someone kept prosecuting.
Due diligence doesn't equal safety. We checked everything we could. The fraudster had prepared better than us. Commercial registration can be fabricated, identity documents can be faked, long-term contact can be part of the setup. Real risk management triggers when the first financial anomaly appears — not after the fact.
Your contract terms are your only protection. The one solid ground we stood on throughout was the T&C clause permitting automatic fund recovery. Without it, our legal position would have been significantly weaker. Terms aren't decorative — they're what you fall back on when everything else fails.
Get the Crime Reference Number immediately. It doesn't help you recover money. But it makes your case an official record. In every subsequent interaction — with banks, partners, courts — having that number transforms how seriously you're taken.
Document for strangers, not for yourself. Judges, mediators, opposing solicitors — none of them know your business. Your documents need to make the situation legible to someone with zero background, with no ambiguity about what happened, who did what, and how much was lost.
How this ends, I still don't know. But what I know is: without systematically organising the evidence and following every procedure, we wouldn't even have had a shot at court.
Sometimes you don't need a lawyer. You need to understand your own case better than anyone in the room.
Update: Case outcome will be added here once decided.