AI Cybercrime and Deepfake Fraud Consultant

//Who it is for

Businesses, counsel, and insurers, each with a different question

What should a business do in the first 72 hours after a business email compromise?

Move on the money first, then the evidence. Call your bank the moment the wire is found to be fraudulent and ask for a recall and a freeze on the receiving account; ask them to start the FBI's Financial Fraud Kill Chain. File a complaint at ic3.gov immediately with the full transaction details, because the FBI says its recovery process works when complaints are filed as quickly as possible. Preserve the mailbox, the message headers, and the login records; do not wipe or reset anything. Lock the compromised accounts and change the credentials that matter. Notify counsel and put your insurer on notice under the policy's notice clause. Then bring in someone who can trace the compromise, document it, and keep the claim and the recovery on track.

The FBI's own guidance on the scam is its public service announcement Business Email Compromise: The $55 Billion Scam, and the complaint form is at ic3.gov.

How is cryptocurrency traced and what does the report look like?

Cryptocurrency moves on public ledgers, so stolen funds can be followed from the victim's transaction through the wallets, mixers, and cross chain bridges the thief uses to a point where they are cashed out, usually an exchange that holds customer identity records. The report lists each transaction by its hash, groups the wallets that belong together, names the exchange or service holding the funds at the end of the trail, and states what legal process can reach it. Courts in Florida, California, and New York have accepted Matt Aubin as an expert on cryptocurrency tracing, metadata forensics, and hidden asset location; on these matters he works as the consulting expert behind counsel, and the report is written for the attorney and the insurer to act on.

The expert acceptances are recorded on his FALI member profile. The FBI reports cryptocurrency as the largest transaction type in 2025 fraud losses at $11.37 billion.

How do you work with counsel and the insurer on the claim?

As the consulting expert behind the attorney. Counsel receives a written analysis: how the compromise happened, what was taken and when, what was done to recover it, and what the evidence supports. The insurer's claim needs the same facts in its own shape: a timeline, a loss computation, the compromise vector, and the recovery steps taken, documented so the adjuster can rely on them. Matt Aubin prepares both from one investigation, works under counsel's direction so the analysis stays privileged, and does not adjust the claim or give coverage advice. He has worked cases alongside the FBI, the SEC, the U.S. Secret Service, and the U.S. Marshals Service, and knows what each of them needs from a victim's file.

//Why this person

Seventeen years on the cases that do not leave room for error

Matt Aubin founded Southern Recon Agency in Florida in 2010 and E3 Legacy Intel, its cyber division, to take the cases most firms will not touch: wire fraud, cryptocurrency tracing, dark web work, and unmasking the people behind online crime. He has worked alongside the FBI, the SEC, the U.S. Secret Service, and the U.S. Marshals Service. He holds the Certified Digital Forensics Examiner credential and the Florida Board Certified Investigator designation, and he built the proprietary AI investigation platform his own firms run, which is why the tracing that used to take a team weeks now takes hours.