Open-Source Intelligence

Why Open-Source Intelligence Matters to a Fraud Examiner

Open-Source Intelligence (OSINT) sits inside the Investigation section of the CFE Exam, under Sources of Information. It matters because nearly every fraud examination begins with background research: Who is the subject? What companies do they control? Where do they live, what do they own, who are their associates, and what have they said or done publicly? Before a single interview is conducted or a subpoena is drafted, a competent examiner has usually built a profile from information that is lawfully and publicly available. OSINT is fast, inexpensive, low-risk, and does not tip off the subject. It also provides the corroboration that transforms suspicion into evidence and the leads that direct more intrusive techniques such as records requests, surveillance, or interviews. The ACFE emphasises that examiners should exhaust non-intrusive, publicly available sources before moving to methods that are costlier, require legal process, or carry privacy risk. Understanding OSINT is therefore foundational to the entire fraud examination methodology taught in the Fraud Examiners Manual.

What Open-Source Intelligence Is

OSINT is intelligence produced from information that is publicly available and legally accessible. Open refers to the openness of the source, not necessarily to cost: some open sources are free (a government website, a news article, a social media post), while others are open but fee-based (commercial public-record aggregators, subscription news archives, paid corporate registries). The distinguishing feature is that the information can be obtained without compulsory legal process, without insider cooperation, and without deception.

Key categories of open sources tested on the exam include:

1. Public records: Documents created or maintained by government bodies that the public has a right to inspect. Examples: real property records, UCC filings, court records (civil, criminal, bankruptcy), corporate and business registrations, professional licences, voter registrations (jurisdiction-dependent), and regulatory filings such as SEC disclosures.
2. Media sources: Newspapers, magazines, trade publications, broadcast transcripts, press releases, and their online archives.
3. Internet and social media: Websites, blogs, forums, professional networking sites, photo and video platforms, online marketplaces, and review sites.
4. Commercial databases: Subscription services that aggregate public records and proprietary data into searchable profiles (addresses, phone numbers, relatives, assets, liens, judgments, corporate affiliations).
5. Grey literature: Academic papers, conference presentations, technical reports, government studies, and annual reports that are public but not widely indexed.
6. Geospatial and technical data: Satellite imagery, mapping services, domain registration (WHOIS) data, IP address information, website archives, and file metadata.

It is equally important to know what OSINT is not. Information held by banks, telecommunications carriers, employers, medical providers, or credit bureaus is non-public. Obtaining it generally requires consent, subpoena, court order, or another lawful mechanism. Using deception (pretexting) to extract it is unethical and, in the case of financial institution records, specifically illegal under the Gramm-Leach-Bliley Act in the United States. The exam frequently tests this boundary.

How OSINT Works: The Process

Step 1: Define the objective. Good OSINT begins with a clear question: identify hidden assets, confirm an address, map business relationships, verify a résumé, or establish a lifestyle inconsistent with reported income. Unfocused browsing wastes time and generates noise.

Step 2: Plan the search and manage risk. Decide what sources are relevant, in what order, and what operational-security precautions are needed. Examiners should consider whether visiting a subject's profile could alert them (some platforms notify users of profile views) and whether to use a dedicated, non-attributable research account and device. Creating a fake identity to befriend a subject and gain access to private content is widely regarded as deceptive, likely violates platform terms of service, and conflicts with the ACFE Code of Professional Ethics; examiners should obtain legal advice before any such approach and generally avoid it.

Step 3: Collect. Common techniques include:
- Advanced search operators (exact phrase, site:, filetype:, exclusion terms) to narrow results.
- Reverse image searches to find other uses of a photograph or to identify a person or location.
- Username and e-mail pivoting: a handle reused across platforms links accounts to a single person.
- Domain and website research: registration records, hosting data, historical versions via web archives, and linked sites that reveal undisclosed business interests.
- Social media analysis: posts, check-ins, photographs, friends and followers, groups, and geotags that reveal lifestyle, associates, travel, and assets.
- Public-record searches: property, court, corporate, licence, and lien indexes, either directly from the custodian or through aggregators.
- Metadata examination: documents and images may contain author names, software, timestamps, and GPS coordinates.

Step 4: Verify and corroborate. Open sources vary wildly in reliability. Information may be outdated, mis-attributed (common names), deliberately false, satirical, or generated by automated accounts. The examiner should confirm identity using multiple identifiers (date of birth, address history, middle name, associated persons) and corroborate significant facts with a second independent source, ideally a primary record such as the original court filing or deed rather than an aggregator's summary.

Step 5: Analyse. Raw data becomes intelligence when it is organised into timelines, link charts, asset summaries, and relationship maps and then compared against the subject's known or claimed position. A subject who reports modest income but posts photographs of luxury vehicles, foreign travel, and a newly purchased second home has given the examiner a classic lifestyle red flag worth pursuing.

Step 6: Document and preserve. Web content can be deleted or edited at any time. Examiners should capture evidence contemporaneously with full-page screenshots or forensic web-capture tools, record the URL, date and time, time zone, and the method used, and preserve files with hash values where possible. The source of every fact should be logged so the examiner can later testify to how and when it was obtained. Undocumented OSINT is of little evidentiary value.

Step 7: Respect legal and ethical limits. Key points the exam expects you to know:
- Publicly available does not always mean freely usable for any purpose; consumer-report data governed by the Fair Credit Reporting Act in the US cannot be used for employment decisions without compliance steps, and data-protection regimes such as the GDPR regulate processing of personal data even when it is publicly posted.
- Accessing content behind authentication by guessing passwords or exploiting weaknesses is unauthorised access, not OSINT.
- Pretexting to obtain financial, telephone, or medical records is prohibited.
- Examiners should avoid interacting with subjects online (liking, messaging, friend requests) without a deliberate, approved strategy.
- Searches should be proportionate and relevant to the examination objective; collecting unrelated sensitive data (health, religion, sexual orientation) creates privacy and reputational risk.

Strengths and Limitations

Strengths: low cost, speed, breadth, no requirement for legal process, covert from the subject's perspective, and excellent for generating leads and corroborating other evidence.

Limitations: unreliable or stale data, identity confusion, incomplete coverage (not all jurisdictions digitise records), geographic variation in what counts as a public record, risk of misinformation, content volatility, and the fact that OSINT findings often need to be confirmed through formal channels before they can support disciplinary, civil, or criminal action.

Exam Tips: Answering Questions on Open-Source Intelligence

1. Anchor on the definition. If a question asks whether something is open-source, ask: is it publicly available and lawfully accessible without compulsory process or deception? Bank statements, phone records, and credit reports are not; property deeds, court dockets, and corporate filings are.

2. Remember that open does not mean free. A commercial database that charges a fee can still be an open source. Do not eliminate an answer simply because it involves payment.

3. When a question involves deception, the answer is almost always that the technique is improper. Fake profiles, pretext calls to banks, and impersonating officials fall outside acceptable practice and may be illegal. Choose the option that reflects honesty, legality, and the ACFE Code of Professional Ethics.

4. Order of operations questions. The exam favours the sequence: start with non-intrusive public sources, then move to records requiring consent or legal process, then to interviews of neutral third parties, and finally to the subject. OSINT belongs at the beginning.

5. Verification is the examiner's duty. If an answer choice treats a social media post or aggregator result as conclusive proof, it is likely wrong. The correct option will stress corroboration with primary records or independent sources.

6. Documentation questions. The best answer will include capturing the content, recording URL, date, time, and method, and preserving it in a form suitable for later authentication. Simply bookmarking a page is insufficient.

7. Watch for jurisdiction qualifiers. What is a public record in one country or state may be restricted in another. Answers that acknowledge this variation are usually more accurate than absolute statements.

8. Distinguish OSINT from other collection methods. Information from an interview is human-source intelligence; information from a subpoenaed bank is a non-public record; information from a hard-drive image is digital forensics. The exam may present these alongside OSINT to test whether you can categorise them correctly.

9. Privacy and data-protection law can apply even to public data. Do not assume that because information is online the examiner may use it for any purpose. Look for answers that reference relevance, proportionality, and compliance with applicable laws such as FCRA, GLBA, or GDPR.

10. Eliminate extreme language. Options stating that online information is always reliable, that examiners never need to verify public records, or that any publicly accessible data may be collected without restriction are typically distractors.

11. Think like the Fraud Examiners Manual. The ACFE presents OSINT as a lead-generating, corroborating, cost-effective tool used within a disciplined, legal, and ethical framework. When in doubt, select the answer that best matches that philosophy.

Quick Review Summary

- OSINT = intelligence from publicly available, lawfully accessible sources; may be free or fee-based.
- Core sources: public records, media, internet and social media, commercial databases, grey literature, technical and geospatial data.
- Process: define objective, plan, collect, verify, analyse, document, stay within legal and ethical limits.
- Never use pretexting, fake identities, or unauthorised access; non-public records require consent or legal process.
- Always corroborate and preserve; online content is volatile and often unreliable.
- On the exam, favour answers that stress legality, ethics, verification, documentation, and OSINT's role as the first, least intrusive step in gathering information.