Capstone: reviewing the Whitford fraud investigation

On October 20, 2026, Jordan Pike pleaded guilty to five counts of fraud over 5,000 dollars and one count of attempted fraud for his role in the collections from five Port Ardent-area victims and the attempt at Harold Mercer's door. The agreed statement of facts read in court relied almost entirely on digital evidence: the messages with 'Mav', the photos and their location data, the payments on his second phone, the bank branch video and the carrier records. Sentencing is scheduled for January 2027, and the Crown has said it will seek restitution for the five victims. Pike's case is connected to Grace Whitford's through the calling account, but no one has been charged with defrauding her, and her money has not been recovered.

For the final lesson, Desjardins and Park set the class the same task that Park's unit carries out at the end of every major file: a structured review. The question is not whether the investigation succeeded, which by the usual measures it partly did, but what was done well, what was not, and what should change. The class divides into groups, each taking part of the file, and then scores the whole investigation against ten elements, each worth 0, 1 or 2 points.

The review framework

The ten elements follow the course. First contact and the treatment of the victim, from lesson 6. Completeness of the report, also from lesson 6. Speed of action on the money, from lesson 3. Preservation of records held by others, from lessons 8 and 11. Seizure and handling of devices, from lessons 7 and 8. Legal authorizations, from lesson 10. Forensic examination and reporting, from lesson 9. Linking cases and sharing intelligence, from lessons 1 and 6. International cooperation, from lesson 11. And communication with victims and prevention, from lessons 3 and 6. A score of 2 means the element met good practice, 1 means it was partly met with a significant gap, and 0 means it was not met.

Group 1: the first days

Linh Tran's group reviewed the first contact, the report and the money. They scored first contact 1. The call-taker's comment that 'there's really not much we can do' was discouraging and inaccurate, and Grace almost hung up; but a report was taken, a file number given and the file assigned the next day. They scored the report 1: the call times were recorded, but the displayed numbers and the wire reference numbers were not, and were collected only when Park visited on February 12. They scored the money 1. Park called Grace's bank and the receiving bank as soon as she had the file, but the wires had gone to a foreign bank and the money had moved within hours. The group concluded that faster action would probably not have saved Grace's money, but that the service had no way of knowing that at the time, and that a call-taker who knew to tell Grace to call her bank immediately, and to ask her bank to contact the receiving bank, would have given the best chance.

Group 2: the courier arrest and the evidence

Marco DiSanto's group reviewed the arrest and everything that followed from it. They scored preservation 2: requests to the calling service, the messaging app, the marketplace and Mercer's bank went out within a day, and nothing was lost. They scored device handling 2: Rourke photographed only what was displayed, isolated and powered the first phone, and recorded every step on camera; Whyte left the second phone off, recorded its identifiers and sealed it, and the continuity log had no gaps. They scored legal authorizations 2: each request had the right authority, the warrant to search the phones was limited by subject matter and date, and none of the applications was challenged at the plea stage. They scored the forensic examination 2: Lam stayed within the warrant, validated key findings in the raw data, reported the limits of the location data, and her report was peer reviewed.

Marco's group noted one point that did not affect the score but deserved discussion. Pike's first phone was in airplane mode for the whole period before extraction, which was right, but nobody had recorded whether it had been connected to a Wi-Fi network at Mercer's house before the switch. Lam said it made no difference to her findings, but a defence lawyer could have asked, and the answer should have been in Rourke's notes.

Group 3: linking and the wider network

Priya Sandhu's group reviewed linking cases, international cooperation and communication. They scored linking 2. The collections were connected through the phone, the carrier records connected Grace's calls to the same calling account as Mercer's, Mensah's research connected the courier advertisements, and the file was entered in the national cybercrime and fraud reporting system, which later linked it to cases elsewhere. Two victims who had never reported learned they were victims and got support. They scored international cooperation 1. The mutual legal assistance request for the foreign bank went out in April, seven weeks after Grace's loss, and the bank's records may by then have been incomplete; an urgent preservation request through the 24/7 network in February might have helped. They scored communication and prevention 1. The public warnings and bank branch training were strong, and Mercer's teller stopped his loss, but Grace heard nothing for six weeks after her first interview, and nobody told her that her case was connected to the courier arrest.

# Adding up the review scores
scores = {
    "first contact and victim treatment": 1,
    "completeness of the report": 1,
    "speed of action on the money": 1,
    "preservation of records held by others": 2,
    "seizure and handling of devices": 2,
    "legal authorizations": 2,
    "forensic examination and reporting": 2,
    "linking cases and sharing intelligence": 2,
    "international cooperation": 1,
    "communication with victims and prevention": 1,
}
total = sum(scores.values())
print("total:", total, "of", 2 * len(scores))
gaps = [k for k, v in scores.items() if v < 2]
print("elements below good practice:", len(gaps))
for k in gaps:
    print("  -", k)

total: 15 of 20
elements below good practice: 5
  - first contact and victim treatment
  - completeness of the report
  - speed of action on the money
  - international cooperation
  - communication with victims and prevention

The file scored 15 of 20. Desjardins points out the pattern in the scores. Everything that depended on specialists working under legal authority scored 2: the preservation, the devices, the warrants, the forensics and the linking. Everything that depended on the first hours and on communication scored 1: the first contact, the report, the money, the international request and keeping the victim informed. That pattern, he says, is common in cybercrime files, and it is why so much of this course has been about the first officer.

Root causes

A review should not stop at scores. For each gap, the class asked why it happened. The first contact went badly because call-takers had no script for fraud reports and some believed, wrongly, that fraud reports were pointless. The report was incomplete for the same reason: nobody had told call-takers which details mattered most. The money could not be recovered because the network used a foreign bank, which no local action could have changed, but the service had no standing arrangement with local banks for urgent recalls before Grace's case. The international request was late because the unit's practice was to wait until a case was 'ready', rather than preserving first. And the silence after the first interview happened because no one owned the job of updating victims when the investigation's focus moved to another victim's case.

Recommendations

The class agreed on five recommendations, which Park says are close to the changes her unit actually made. First, a short fraud script for call-takers and front-desk staff, built around listen, preserve, report and refer, with the first instruction being to call the bank immediately, and the specific details to capture: call times, displayed numbers, payment references and receiving accounts. Second, standing contacts at every local bank branch and at the main carriers, with a protocol for urgent recall requests and alerts like the one that saved Mercer's money. Third, a rule that preservation requests, including international ones through the 24/7 network, go out within a day of a file being assigned, whatever stage the investigation is at. Fourth, a named victim contact on every fraud file, with a scheduled update at least every three weeks, and a duty to tell victims when their case is connected to another. Fifth, continued public warnings that describe the current scripts, with a focus on older adults and their families, and on the code word and call-back advice.

What the course has shown

Desjardins ends the course by returning to the first lesson's question. A cybercriminal, in this file, was not a teenager in a dark bedroom. It was a network: callers working from scripts, a calling service paid for in cryptocurrency, money mules recruited through job advertisements, a courier who wanted easy cash, and organizers in another country. Investigating it took a call-taker, a patrol officer, a detective, an exhibit officer, an examiner, an analyst, banks, carriers, platforms and foreign governments. Most of the key evidence was digital, and most of it was obtained by ordinary police work done carefully: listening to victims, recording details exactly, keeping devices safe, writing honest warrant applications and asking companies to preserve records before they disappeared.

Park adds the last word. She visited Grace after Pike's guilty plea to explain what it meant for her case. Grace's money is gone, and Park told her so plainly. But Grace said that knowing her report had helped connect the network, and that two other people had been warned because of it, mattered to her. She has since spoken at two community sessions for older adults about the grandparent scam, using her own name.

What a patrol officer can take from the file

Park asks each student to write down one thing they will do differently on their first cybercrime call. Jesse Morningstar writes that he will tell every fraud victim to call their bank before he finishes taking the report. Amara Okafor writes that she will photograph screens rather than retype identifiers. Linh writes that she will never again think of fraud reports as paperwork. Marco writes that he will narrate on camera every time he touches a device. Priya, the former bank analyst, writes that she will ask every older victim whether anyone else has been helping with their money, because sometimes the fraud is not the only problem. Park collects the cards and says that if each of them does just that one thing, the next file like this one will score better than 15.