Professional & investigative
Most of what you need about a scammer, a company or a claim is already public. The skill is finding it and proving where it came from.
The phone number on a fake trading app, the domain behind a phishing page, the director of a shell company, the photo on a matrimonial profile: each has a trail in public sources. This course teaches a repeatable method for the Indian context, with the legal and ethical limits, and the documentation that lets a finding be used in a complaint, a story or a report.
- Duration
- 2 days
- Format
- Online / Onsite
- Language
- English
- Level
- Intermediate
- Group size
- 8 to 25
- Certificate
- Completion certificate
- For
- Investigators, journalists, due-diligence teams
What participants can do afterwards
- Run a structured investigation from a single starting point (phone number, email, username, domain, company name, image) using a documented method
- Use Indian public records effectively: MCA company and director data, court records, GST and trademark lookups, land and vehicle records where lawfully accessible, and regulator databases (SEBI, RBI)
- Investigate domains, hosting, lookalike sites and phishing kits, and link them to other infrastructure
- Verify images and videos: reverse search, metadata, geolocation basics, and spotting AI-generated material
- Trace crypto addresses on public explorers to the point where an exchange request is needed
- Document every finding with source, time and capture so it survives scrutiny, and stay within the IT Act, DPDP Act and platform terms
Modules
Day 1: method, ethics and the law
The investigation cycle, hypothesis-driven search, operational security, what is lawful to collect and use in India, and documentation from the first search.
Day 1: people and accounts
Phone numbers, emails, usernames, social accounts, breach-data awareness, and the pivot from one identifier to the next. Exercises on fake-recruiter and trading-group accounts.
Day 1: companies and public records
MCA, directors, charges, court records, GST, trademarks, tenders, regulator lists, and building a corporate profile for due diligence.
Day 2: domains, infrastructure and phishing
WHOIS and history, DNS, hosting, certificates, lookalike detection, phishing kit analysis, and mapping a scam's infrastructure.
Day 2: images, video and crypto
Reverse image search, metadata, geolocation, deepfake indicators, and following crypto on public explorers to an exchange.
Day 2: capstone
Teams investigate a prepared scam operation from one phone number to its infrastructure, people and money, and present a sourced report.
Who should attend
- Police and cyber cell investigators
- Journalists and fact-checkers
- Due-diligence, KYC and fraud teams at banks, NBFCs and fintechs
- Corporate investigators, lawyers and private investigators
- Trust-and-safety and brand-protection teams
Included
- Two days of hands-on instruction with Indian case material
- A method worksheet and a documentation template for findings
- A curated list of Indian public-record sources and free tools, with notes on reliability and legality
- An operational-security checklist for investigators
- Completion certificate
Frequently asked questions
Does the course use paid tools or data brokers?
No. Everything in the course uses free sources, public records and free tiers of tools, because findings must be reproducible by a colleague, a lawyer or a court. We discuss paid tools and what they add, and we are explicit about sources that are unlawful or unreliable in India, such as leaked databases and unauthorised lookups of Aadhaar, telecom or banking data.
What are the legal limits of OSINT in India?
The course spends a full session on this. Public data can be collected and analysed; accessing accounts, systems or data without authorisation is an offence under the IT Act, and the DPDP Act and platform terms constrain how personal data is used and retained. Journalists and private investigators have different exposures from the police, and we cover each.
Is it suitable for journalists with no technical background?
Yes. The course assumes only comfort with a browser and a spreadsheet. The infrastructure and crypto modules are taught from first principles with worked examples. Journalists usually get the most from the companies, images and verification modules, and the capstone can be weighted towards a verification scenario if the group is mainly from newsrooms.
Can this be combined with the investigation fundamentals course?
Yes. OSINT is covered briefly in the investigation course; this one goes much deeper. For police departments and fraud teams we offer the two as a five-day programme, with the OSINT days first so that the investigation case can use the open-source leads participants have already found.
Request this program
Tell us the audience, headcount, city and preferred dates. We reply with an outline and quote.