Mid-Size Metropolitan Police Department, Financial Crimes Unit
Executive Summary
A financial crimes unit was investigating an account takeover ring targeting elderly residents across multiple zip codes. Suspects used rotating email aliases and prepaid phone numbers, making traditional database lookups ineffective. Fourteen unique aliases had been identified across victim statements and transaction records — but none could be connected to real individuals. Investigators estimated months of additional manual work while the ring continued operating.
The Challenge
Traditional investigative tools — legacy database systems, manual OSINT, and public records searches — could not connect the 14 known aliases to real-world identities. Each alias had been created with minimal personal information and had no direct link to prior records. The financial crimes unit lacked access to breach data, dark web sources, or infostealer intelligence that might reveal overlapping identity attributes across the subjects’ digital histories. The investigation had stalled.
The Solution
The unit’s cyber investigator used Constella’s Hunter platform to run identity attribution lookups against all 14 known aliases. Hunter cross-referenced each alias against Constella’s verified identity data lake — including historical breach records, dark web forum registrations, and harvested credential logs. Constella’s identity enrichment capability connected 11 of the 14 aliases to three real-world individuals by surfacing shared personal information that had appeared across multiple prior data exposure events: physical addresses, device fingerprints, and backup email addresses. Each identity cluster was documented with verified source attribution, providing an intelligence chain that met the department’s evidentiary standards for warrant applications.
The Result
The financial crimes unit prepared warrant applications within 72 hours of beginning their Constella-assisted investigation — a process that had previously taken 6–8 weeks using traditional methods. All three subjects were identified, located, and arrested within 30 days. The investigation further revealed that the ring had victimized residents in two neighboring jurisdictions, allowing the department to share the Constella-generated intelligence package with those agencies and expand the case scope. The verified data pedigree withstood initial legal scrutiny at the warrant stage.
Key Outcomes:
- 11 of 14 criminal aliases attributed to verified real-world identities in a single investigative session
- Warrant preparation timeline reduced from 6–8 weeks to 72 hours
- Three subjects identified, located, and arrested within 30 days
- Intelligence package shared cross-jurisdictionally to expand case scope
- Verified data pedigree supported evidentiary review at the warrant stage