Financial Crime Investigation Unit · OSINT Division
CASE # INV-2025-0000
Restricted
Investigation in progress — searching public sources
Scanning job listing...
● Evidence Log — Investigation Complete
Investigator Assessment
Human-in-the-loop review — read the evidence above and render your verdict:
FRAUD CONFIRMED
CASE CLOSED · REFER TO FIU
Field manual · read before opening a case
How to use Scamnot
Time: 1–3 minutes per investigation · Limit: 5 investigations per hour per IP address
The five steps
01 · You
Open a case
In Subject of Investigation — Company / Job Listing / URL, enter the most specific identifier you have:
company name + country (Nordvik Capital Ltd, UK), or
the job listing URL, or
the website domain.
In Supporting Evidence (optional), paste what you have: the recruiter's email text, the salary offered, where you found the listing, names mentioned. The more you paste, the better steps 01 and 06 get.Don't paste passwords, ID documents or bank details.
02 · The agent
Run it
Click ▶ Initiate Investigation. The case number at the top of the folder (INV-2026-xxxx) identifies this investigation.
The status line cycles through the areas ("Running personnel OSINT…", "Scanning adverse media…"). The agent is searching the web at this point.
03 · You
Read the evidence
Seven cards appear, 01 → 07. Each has:
a badge: ▲ Flagged✓ Clear or ? Unverified
a one-line summary, details and specific flags
source buttons. Open them. A finding is only as good as its source.
Read ? Unverified as "couldn't find evidence either way", not as "fine".
The overall risk level (HIGH / MEDIUM / LOW) is the AI's opinion, not a score. Use it as a hint.
04 · You — human-in-the-loop
Decide
Under Human-in-the-loop review, pick ✕ Confirm: Scam / Fraud or ✓ Clear: Appears Legitimate.
A stamp shows your verdict. Only click once you've checked the flagged sources yourself.
05 · You
Export
Click ↓ Download Report (PDF) for the evidence file (case number, 7 findings, sources, verdict).
↩ Open New Case resets the form.
Reading the results well
Before you trust a finding
Name collisions: an adverse-media hit may be about a different company with a similar name. Check the country, dates and people.
"Not found in registry" can mean the company is registered in another country. Check the right registry by hand (UK: Companies House; Lithuania: Registrų centras).
Domain age: confirm with a WHOIS/RDAP lookup if it matters to your verdict.
A clean result isn't proof of legitimacy. It means public sources raised nothing.
Troubleshooting
Symptom
Likely cause
"Rate limit: 5 investigations/hour per IP"
Wait an hour, or deploy your own copy
"Investigation timed out after maximum search iterations"
The agent didn't finish. Retry with a more specific subject.
Cards show "? Unverified" everywhere
The subject is too vague, or web search is disabled for the API key
Nothing happens on click
Subject field is empty (focus jumps back to it)
AML Operating System · Layers 3 & 4
Place in the AML OS
Primary layer: 3 · Customer lifecycle (knowing who the counterparty is). Secondary layer: 4 · Control systems (adverse media; sanctions and PEP planned).
See the full map ↗
Where it sits
1GovernancePolicy Reader
2Risk assessmenttouched per entity only (risk level)
3Customer lifecycleSCAMNOT
4Control systemsSCAMNOT — partial
5Investigation & reportingSAR Draft Automation
6Effectivenessnot built
Layer 3 · Customer lifecycle
Element (from the AML OS map)
Status
Honest note
Identify entity, directors & UBOs
⚠ Partial
Directors via web search of registry pages. No UBO / PSC tracing. Planned: Companies House API including PSC, and a KYB mode.
Ownership & control structure
⚠ Weak
Only what search results show
Stated purpose vs public evidence
✓ Built
This is where the AI adds real value (website vs claims)
✱ Risk rating & CDD/EDD call
⚠ Partial
The AI proposes HIGH/MED/LOW. It should become a weighted score with the human making the CDD/EDD call.
✱ Approve · restrict · reject · exit
✓ Binary
Scam / Legitimate verdict. KYB mode would need Approve / EDD / Reject.
Ongoing review
✗ Not built
Planned: re-check with a diff against the last run
Layer 4 · Control systems
Element
Status
Honest note
Sanctions screening
✗ Not built
Not in the code. Planned.
PEP screening
✗ Not built
Not in the code. Planned.
Adverse media
✓ Built
Area 07, via web search
KYB / UBO checks
⚠ Partial
Registry lookup by search; no UBO
Transaction monitoring
— n/a
Not this tool's job; see SAR Draft Automation's planned TM Lab
Source of funds / wealth
— n/a
Not covered
Upstream and downstream
Direction
Link
Upstream
A job offer, an onboarding application or a counterparty name
Downstream → Layer 5
The evidence pack can serve as the OSINT input to a SAR case
Downstream → Layer 2
Planned: the weighted score becomes the counterparty's risk factor breakdown
Human gates (✱ in the map)
Gate 1
The analyst chooses what to investigate and what evidence to supply
Gate 2
The analyst reads the sources
Gate 3
The analyst gives the verdict. The AI never stamps anything.
Why this layer matters
Know who you are dealing with
Every later control depends on knowing who the counterparty is. A solid KYB check means registry checks with a manual fallback, ownership traced down to the people behind the business, everyone behind it screened, and monitoring that continues after onboarding.
Reading adverse media and deciding whether a hit is really about the same entity is one of the places AI helps most, and Scamnot already does that part. The upgrade is adding deterministic registry, domain and sanctions checks underneath it, so the evidence is reproducible.