How to Prepare a Financial-Fraud Incident Record

An incident record is a written account made as close to the event as possible, containing times, amounts, what was said, what was done and what is uncertain. The record is the only version of the event that will still exist in six months, so it is worth building even when nothing is recovered.

Underneath that sits one observation about how a person remembers a bad hour, and everything that follows depends on it. Memory of an event like this comes apart in a particular order. The times go first. Then the order of things goes, and two events quietly swap places. Then the exact wording goes, replaced by the sense of what was meant. The feeling stays, undimmed, for years. So a household one month on has a powerful and completely sincere account of what happened, and almost nothing in it that anybody else can use.

The mismatch is the whole of the problem: the part of the event that survives in memory is the part that is of least use to anybody who has to act on it, and the part that is of most use to them is the part that goes first. Nobody is warned about this. Decay of that kind does not feel like forgetting. It feels like remembering. A person will be able to say, with real confidence, that the call came in the late morning and that the money went within a few minutes. The same person will not be able to say 11:38, or that the first transfer was at 11:42 and the second at 11:47, or which of two similar sentences the caller actually used.

What is an incident record for, and who is it for?

An incident recordA written account of an event made as close to the event as possible, and then kept as it was first written rather than tidied up later. is a plain written account of one event, made as close to that event as can be managed, and then left alone. An incident record is not a complaint. It is not a report to anybody, and it has no form, no format and no official standing of its own. The record is the raw material out of which every complaint, report, statement and answer that may later have to be given will be built, and its entire value comes from having been written while the material was still there.

Think about how a small workshop handles a damaged consignment. The moment the crate comes off the vehicle with a crushed corner, somebody writes down the vehicle number, the time it arrived, who signed for it, and which two boxes inside were wet. Nobody yet knows whether there will be a claim, an argument with the transporter, or nothing at all. The note is not made because a dispute has started. The note is made because the crate will be unpacked, the boxes will be moved, the vehicle will leave, and in a fortnight the only thing left will be four people with four different recollections of a Tuesday.

The record is written for whoever asks next, and who that is or what they will ask is not yet known. The next reader may be the institution holding the account, somebody at a statutory reporting arrangement, a form that wants the events in order with times, or a person three weeks later who asks the same question a second time and expects the same answer. The record is also written, and this part gets forgotten, for the household itself. Left with a feeling and no facts, a household slowly builds a version of the morning that fits the feeling.

The household itself is the reader nobody expects. Six months on, a household that kept no record does not have a blank space where the event used to be. The household has a story: smooth, complete, told the same way each time, grown into the space the details left behind. Some of it is right. Some of it is not. The story feels exactly the same either way, so the household has no way of telling which is which.

Twenty minutes is the honest estimate, and it is worth stating plainly because the cost is the reason the thing does not get done. Nobody judges the record to be worthless. On the evening of the worst financial day of a year, twenty minutes spent writing about the morning that just ended is close to the least appealing use of twenty minutes available anywhere. Reluctance of that kind is not weakness but an ordinary response to a distressing day, and the only counterweight to it is knowing exactly what those twenty minutes buy.

Why do the times go first, and what is actually left after a month?

The word decayThe way a memory loses detail over time. It is not uniform: some kinds of detail go within hours and others hold for years. makes this sound gentle and gradual, like paint fading. Memory does not work like that. Different kinds of detail have completely different lifespans, and the ones that go fastest are the ones that were never anchored to anything meaningful in the first place.

Here is why. A time such as 11:42 is a bare number attached to nothing. The number has no story around it, nothing follows from it, and nothing about it connects to anything else already known. Numbers of that kind survive for hours, not weeks. Sequence is at least a relationship between events, so the order in which two things happened lasts a little longer. Exact wording lasts longer again, but it converts into gist: what stays is what the sentence was for, and the mind then honestly and unknowingly reconstructs a sentence that would have served that purpose. Feeling, on the other hand, is not stored as a detail at all. Feeling is closer to a state that can be re-entered. Three years later a person can still walk back into the ten seconds where what had happened became clear, in full.

So the ranking of what survives is almost exactly the reverse of the ranking of what is useful, and no amount of effort or care changes the order. Somebody who has to act on the account needs times, amounts and sequence, in that order. Times, amounts and sequence are the three things that will be gone in a week. The feeling is still being carried a week later, and the feeling is the part they cannot do anything with at all.

Frederic Bartlett showed the second half of this nearly a century ago, in work on how people retell a story they have heard once. The retold story was not a shortened version of the original. The retold story was tidier: the odd details dropped out, the gaps closed, and each retelling made more sense than the one before. He called the pull behind it the effort after meaning. Elizabeth Loftus later showed how readily that same tidying absorbs material that was never there, until a person ends up sincerely certain of something they never saw.

The fourth strip is the one that surprises people. Uncertainty does not survive as uncertainty. Uncertainty does not fade to a blank that can be recognised as a blank. It closes. Where there were two possible versions of a sentence and no way of choosing between them, in a month there is one version and complete confidence in it, and nothing in the experience of remembering flags the difference. A gap left open in memory does not stay open, and this single fact is the reason step five of the record exists.

At thirty days the record view still says a great deal, and that is the setting that matters most. Somebody reading this a month after the event has not missed the chance to write anything. The times are gone and no writing can bring them back, but the amounts are in a statement, the destinations as they appeared are in a statement, what was done is partly in the sent messages, and a present certainty about a sentence that was once uncertain is itself worth writing down, dated today, with a note that says so. A record written a month late is a smaller record, and it is not a worthless one, and the difference between a smaller record and no record is the whole of what is available now.

What goes in first, and why is it the times?

The steps are ordered by decay speed, not by importance. The detail that will vanish first is written first. Decay speed is the entire logic of the sequence, and it is why the order feels wrong on first sight: what feels most important on the evening is what was said and how it happened, and what actually needs writing in the first three minutes is a list of six numbers.

Step one: the times, before anything else

Write the times before a single sentence of narrative. Not approximate times. The actual times, taken from wherever they still exist while they still exist: the call log, the message that confirmed a transfer, the sent folder, the screen not yet closed. A device will keep a time for a while and memory will not, so anything that can be read off a device belongs in the record before it belongs anywhere else.

The times worth writing are these: when contact was made and by what means, when each movement of money happened, when what had happened became clear, when the institution was contacted, and when any statutory report was made. Write them as a bare list. No sentences yet. Six lines is normal and eight is common, and where there are eleven, write eleven.

The reason this goes first is that every other part of the record can be partly rebuilt later and the times cannot be rebuilt at all. If in three weeks the exact words of the caller cannot be recalled, that can at least be said honestly and the record will still be usable. If in three weeks nobody can say when anything happened, the record has lost the spine that every other line hangs on, and a sequence of events with no times attached is an anecdote.

Step two: the amounts, and where they appeared to go

Next, the money. Each amount separately, never a total on its own. Rs 12,000/- and Rs 6,000/- are two facts. Rs 18,000/- is a summary of them, and summaries are what memory produces on its own, so the record should hold the thing memory will not.

Then the destination, written exactly as it appeared on screen, including any part that looked odd, any part that could not be read properly, and any name that appeared alongside it. The wording matters: the record captures the destination as it appeared, not the destination as it was. Nobody on that side of the screen can know what it was, and what it appeared to be is the whole of what was acted on. A record that claims more than can be known is weaker than one that claims exactly what was seen.

Write also how the movement happened, in ordinary words. Whether it was one instruction or several. Whether anything was approved on a device. Whether an amount was typed in or presented already filled in. None of this is technical and none of it needs a term of art, and all of it is material that stops existing in usable form within a couple of days.

How is what was said written down without improving it?

Step three: what was said, in the words used

Step three is the longest, takes about six of the twenty minutes, and is where the strongest instinct has to be resisted. The instinct is to write what the call was about. The task is to write what the call contained.

Write it as fragments, in the order they come back, without joining them. Put actual remembered phrases in quotation marks and everything else outside them. A reader can then see instantly which is which. If what comes back is the caller using a particular word rather than the obvious synonym, that word goes in, and it goes in even if it seems trivial. If what comes back is the sound of the call, whether there were other voices, whether there was a pause before an answer, that goes in too.

Write what the caller already knew when the call began. Prior knowledge of that kind is almost always the part that gets flattened later into the caller knew a lot about me. Which specific things. The name, in what form. What part of an account number. Which product or arrangement. Whether they knew a recent amount or date. Each of those is a separate line and each of them is the sort of detail that turns into a vague impression within a week.

And write the other half of the conversation. The household's own half gets skipped almost every time, and it is half the call. Write what was confirmed, what confirmation was asked for, what questions were put and what answers came back, and at what point the questions stopped. A record of a call that contains only the caller is not a record of the call, and the part left out is the part that will most need to be accurate later.

Step four: what was done, with times

Then the second half of the day, in the same plain style: what was done once the position was clear, in order, with times. Who was contacted, by what means, whether anybody answered, what instructions came back, what reference or acknowledgement was given, and what could not be done because a line was engaged or a screen would not load.

The last item matters more than it looks. The things that did not work feel like failures rather than facts, and so they are the first thing to be dropped from the record. They are facts. An attempt that could not be completed belongs in the record exactly as much as what was completed, and it is a line about the day rather than a line about the person.

Step four is also the only half of the whole event where the household is the only source. The institution has its own note of when it was contacted. A statutory arrangement has its own note of a report. Nobody anywhere has a note of the twenty minutes in between, or of the two attempts that went nowhere, except the household, and only if it writes them down.

How do I record something I am not certain about?

The uncertainty itself goes in, as a fact about the record, in the record. Step five takes about three minutes, costs nothing, and separates a record from a story.

Marked uncertaintyA gap recorded as a gap. The record says what is not known, rather than quietly filling it with the most plausible version. means writing a line that says, in ordinary words: I am not sure whether it was this or that, and I am recording that I am not sure. Not the more plausible of the two. Not a hedge in the middle that covers both. The two candidates, named, and a plain statement that neither can be chosen over the other.

Everybody finds this uncomfortable, and the discomfort has a cause worth naming. A record with holes in it feels like a weak record, and a weak record feels like it will be less use to whoever reads it. The opposite is true, and it is true for a reason that has nothing to do with honesty as a virtue. The alternative to a marked gap is not an account with fewer gaps. The alternative is an account with the gaps filled in by something that arrived later and does not know it arrived later, so an account that is uncertain in the places where there was actual uncertainty is the only kind that stays true over time.

Here is the household's own line, and it is the single most valuable sentence in twenty minutes of writing. Ashok Bhosale could not remember whether the caller had said the deposit was blocked, or that it was about to be blocked. Two versions. Different meaning. He could not choose, so he wrote both down, wrote that he could not choose, and left it there.

Think about what happens to that line if it is not written. A month later he does not have two candidates and a gap. He has one of them, held with complete confidence, and no sense at all that it was ever in doubt. The surviving version will feel exactly like the memory of his own name. The feeling is not lying and it is not carelessness. It is what a manufactured memoryA firm recollection of something that was never certain, assembled without the person noticing and felt as strongly as a real one. is: an ordinary, universal repair job that the mind performs on gaps, without informing anybody it has done so.

A second cost lands later and hurts more. Suppose he is asked in week one and again in week four. In week one he says he is not sure. In week four he gives one version, firmly. Now his account has changed, in a way he cannot explain, on a point he cannot support, and he has no way of showing that the earlier version was ever the honest one. The marked line, written on the evening, makes both answers consistent: he was unsure then, he is recorded as unsure, and he can say so today without any of it looking like a shift.

What do I keep, and where does it go?

Step six is the shortest to describe, takes about two minutes, and is worth more than the other six put together on the days when it is hardest to do. The step is this: keep what exists, and delete nothing.

The material that exists is more than most people think. The call log entry with its duration. Any messages, in either direction, including the ones that arrived afterwards. Any confirmation of a movement of money. The statement line itself. A screenshot, if one was taken. The acknowledgement of a report, in whatever form it came. Any email. Any note somebody scribbled on the back of a bill while the call was going on. Everything on that list has one property in common: it exists outside memory, and material that sits outside memory is the only category that does not decay overnight.

To preserveTo keep material that exists outside memory, in a place where it will not be tidied away by accident. it, do the least possible. Do not organise it. Do not rename it into something tidy. Do not consolidate the six screenshots into one image. Put the whole lot somewhere separate, in one place, and leave it exactly as it is. A folder on a device, a second copy somewhere else, and a note in the record saying where both are. The whole task is those three moves, and they take two minutes.

What happens when the record changes later?

Step seven takes no time at all and it is what makes the other six worth anything. Put a date on the record, and never change it silently.

A contemporaneousWritten at the time. It is the property that gives a record its weight, and it is the one property that cannot be added afterwards. record is one written at the time, and being written at the time is the property that gives it whatever weight it has. Contemporaneity lives entirely in the date. Without a date, a sheet of careful detail written on the evening looks exactly like a sheet of careful detail written in November, and nothing in the document itself can tell the two apart.

Then the harder half. New things will come back later, and this is normal rather than suspicious. Something surfaces in week two. A phrase returns in the middle of something else. A forgotten message turns up. All of that belongs in the record, and there is exactly one way to add it: append it, and date the addition.

Write the new material as a fresh entry at the bottom. Note the date it was added. Note, in one line, what prompted it. Leave the original text exactly as it stands, including any part the new material contradicts. If the addition means the earlier line was wrong, write that the earlier line was wrong and leave it there.

Editing the original instead is called silent revisionChanging what a record says without dating the change, so that no reader can tell the original from the later version., and it does not damage the line that was changed, it damages every other line in the record. From the position of somebody reading the record cold: if any line might have been altered afterwards with no trace, then no line can be relied on more than any other, and the twenty minutes of detail written on the evening are worth what a sheet written last week is worth. One undated change costs the whole document its standing, a steep price for tidying a sentence.

What did that evening's record actually look like?

Here is the Bhosale household's, as it stood on the evening of 14 September. Meghna Bhosale works on a payslip and Ashok Bhosale runs a tailoring counter, they have one daughter, Ira, and until that morning the household had put nine months of ordinary arithmetic into a buffer of Rs 31,320/-. At 11:38 a call came. By 11:47 the buffer was Rs 13,320/-. The household and the morning are set out in full under what to do in the first hour.

Notice what is not in it. There is no explanation of how it happened. There is no account of why he believed the caller. There is no assessment of whether he should have. He could write all three in November as easily as in September, and that is precisely why none of them earns space on the evening. The record contains only the material that stops being available, and everything that will still be available next month is deliberately left out.

Notice also that the record is not neat. Two lines about the call sit oddly against each other: he was calm and never told me to do anything quickly, and yet the money left in five minutes. The tension is not tidied up and it is not explained. The two lines are left exactly as they were written. They are true, and a sentence that resolved the tension would have been written by a calmer man some weeks later.

Should the record read cleanly?

No. Everything ordinarily taught about writing pulls the other way, and that makes a rough record the hardest instruction of the seven to follow. The training is to organise before writing, to cut what does not fit, to make the thing readable. Every one of those habits is destructive here.

SmoothingMaking an account coherent by closing gaps and dropping what does not fit. It produces a better document and a less true one. happens anyway, without being asked, on the timetable in the strips above. Doing it on purpose as well, on the evening, with a pen, performs a month of decay in twenty minutes and throws away the only advantage that writing on the evening ever had.

Consider two versions of the same twenty minutes. One is organised under clear headings, each section reading as a complete thought, with no loose ends. The other has fragments, two lines that do not agree, one line in capitals saying NOT SURE, and a phrase that is written down without any idea of why it seemed worth writing. The first is a better document. The second is a better record. Every quality that makes the first version pleasant to read was bought by deleting something that the second version still holds.

What is the record worth when nothing is recovered?

Warmth and dishonesty are easy to combine here, so this part has to be exact.

The Rs 18,000/- did not come back. Not because the household did anything wrong, not because it was slow, and not because the record was inadequate. The household reported within an hour, in writing, twice, and the money did not return. Non-recovery is the ordinary outcome. A version of this story that ends in a recovery would be a comfort written at the expense of every reader whose money did not come back. Most of the time it does not come back. A record does not produce a recovery. Nothing in these twenty minutes changes what happens to the money.

So what did the twenty minutes actually buy? Three things, and vague comfort is worse than none, so they are worth naming precisely.

First, the household was able to report accurately. When it contacted the institution at 12:20 and made the statutory report at 12:35, it had times, amounts and a destination as it appeared, rather than an approximation. Times, amounts and a destination are what a report should contain, and that report is the only version the household will ever be able to give.

Second, it could answer consistently three weeks later. On 5 October, asked again, it gave the same times, the same two amounts in the same order, and the same honest statement that one sentence in the call could not be pinned down. Not because anybody remembered any of it. Because it had been written on the evening and was still sitting there. An account that stays the same is worth more than one that improves, and without the record the household would have given a different and more confident answer, sincerely, and would have had no idea it had done so.

Third, and least expected, the household knows what actually happened to it. The third return has no external audience at all. Ashok Bhosale can read that record in two years and find out what took place on 14 September, rather than what he had come to believe took place. He can see that he asked twice. He can see that the caller never told him to do anything quickly. He would not have guessed that later, and the line quietly answers a question he might otherwise have gone on asking himself. Knowing that much is not a small thing to own in a household where the loss took out most of a buffer.

What do the Indian reporting arrangements add, and what has to be confirmed at the source?

The seven steps are craft rather than law. The steps hold anywhere, for any event, and none of them depends on the country. The country decides which arrangements exist for reporting, what each of them requires, and what periods apply to any of it.

A wrong period or a wrong rule is far worse than none. A household that reads a number, believes it, and shapes what it does around it has been handed something that looks like certainty and is not, and the entire cost of that lands on the household. A household told to confirm at the source has been handed one extra task and no false confidence. The second trade is better every single time, and it is better by a wide margin on a subject where the stakes are somebody's buffer.