The communication appeared credible and the business partner seemed genuine. Yet it was a scam. What should you do when goods or money disappear and someone else is hiding behind a familiar name? Using a real case, we will show how the investigation unfolds, which digital traces help reveal connections, and how OSINT can be used to verify identities and reconstruct the sequence of events. We will then demonstrate how Threat Intelligence can help detect the misuse of a company’s brand, lookalike domains, fake profiles and leaked credentials at an early stage. From the first steps after discovering the fraud to measures that can help prevent it from happening again.