A case beyond the individual report
Examine related accounts and activity across fraud, scam, coordinated-abuse and child-safety concerns. Retain the original reports so the wider investigation remains connected to what users and reviewers observed.
Investigate the networks harming your users.
Investigate coordinated abuse, fraud and child-safety concerns across accounts and services, with the context your safety team needs to respond.
Individual reports can hide a coordinated pattern.
A scam may use several accounts to reach users. An abusive group may move between services. Child-safety and violent-threat investigations can begin with a single report whose wider context is still unclear. Related material arrives at different times and in different queues.
Investigators need to understand which accounts and incidents belong together, examine the evidence behind those connections and preserve the original context. The resulting case must be useful to the internal team or authorised agency that receives it.
Across your platform’s safety priorities.
Coordinated abuse and harassment
Investigate related accounts targeting users or communities. Compare reported activity and relevant identifiers to assess the apparent coordination and retain the evidence behind it.
Fraud, scams and impersonation
Follow reported scam accounts, fraudulent offers or impersonation attempts beyond one report. Examine the related actors and sources so fraud and safety teams can assess the wider operation.
Child safety and exploitation
Develop reported grooming or exploitation concerns into an investigation with the original context preserved. Prepare reviewed findings for the people responsible for child safety and any authorised referral.
Extortion and threats of violence
Investigate sexual extortion, coercion or violent threats that may involve a network of accounts. Keep the chronology and supporting sources available as the team assesses the concern and prepares its response.
Example use case
Investigate a suspected sexual-extortion network.
Reports of threats against users may involve several accounts and services. Investigators need to establish whether the activity is connected, understand the immediate concern and decide whether an authorised agency referral is appropriate.
Illustrative example. Rows are accounts; columns are events. Cyan marks an overlap to examine.
- Account rows
- Event columns
- Pattern for review
Retain the reported threats
Bring the original reports and authorised account information into Vantage. Keep the context that prompted the concern, including what was reported and when.
Examine the apparent network
Compare the relevant accounts, identifiers and source material. Assess whether the similarities support a connection, and keep unanswered questions visible as the investigation develops.
Prepare a useful referral
Compile a reviewed record for authorised internal teams or an appropriate agency, with the supporting sources and a record of what was released.
What matters for
your team.
Review before attributing an actor
Inspect the material behind a proposed account relationship. Investigators assess what a connection supports and whether independent checks are needed.
Findings the receiving team can use
Prepare the relevant evidence and context for trust and safety, fraud operations or an authorised agency. A recipient should be able to examine the findings without reconstructing the original investigation.
Vantage
Develop a persistent investigation around reported accounts and activity, with the original material available as analysts examine the wider pattern.
Lighthouse
Keep watch across relevant actors and patterns while safety investigators focus on active matters, with alerts assessed by the team.
Putting Azonic
to work.
How does an investigation develop from reports already in our queues?
Bring the relevant reports and authorised account information into a case, retaining the context of each report. Investigators can then examine related identifiers and sources together rather than treating every report as an isolated item. The connection to your existing queues should be scoped around the team’s workflow.
How are proposed links between accounts examined?
Keep the sources behind each proposed relationship available for review. Investigators can compare the identifiers and activity in context, distinguish supported links from similarities and record the questions that need further checking.
What does a referral outside the original safety team include?
Prepare a reviewed account of the relevant findings, supporting citations and important uncertainty for the intended recipient. The originating case retains the original reports, supporting material and record of what was released.
How can an active investigation follow activity across services?
Use the external sources and internal records your organisation is authorised to access. Lighthouse can maintain awareness of relevant actors and patterns while Vantage holds the active investigation. Source coverage, permissions and the investigative questions should be established for the use case.