Digital investigation: what it is and what a licensed agency may do

In brief: digital investigation is the systematic collection, verification, and documentation of information from online and other digital sources to establish facts. In the Netherlands, professional investigation on behalf of others requires a Wpbr licence from the Ministry of Justice and Security. NCRB is such an agency (licence POB 1737) and works exclusively with lawful sources and methods: no hacking, no pretexting, no unauthorized access.

What is digital investigation?

Classic investigation revolves around surveillance, interviews, and physical research. Digital investigation does the same work through the traces that people, companies, and money flows leave online. The core is OSINT (open-source intelligence): research in public and lawfully accessible sources, combined with technical analysis of, for example, emails, domains, metadata, and blockchain transactions.

A digital investigator answers questions such as: who is behind this profile or webshop? Where is this person now? Does this debtor have assets? Where did my money or crypto go? Is this CV, this company, or this claim genuine? The answer is documented with source and time so that it remains verifiable later.

Which sources does a digital investigator use?

• Public registers: the Dutch Chamber of Commerce, the land registry, insolvency and case-law registers, UBO information where accessible, foreign company registers.
• Social media and online platforms: publicly visible profiles, posts, photos, networks, and timelines.
• Web and domains: websites, archived web pages, domain registrations, hosting, advertisements, and marketplaces.
• Technical traces: email headers, metadata of documents and photos, IP and hosting data where lawfully available.
• Blockchain: wallet addresses, transaction hashes, bridges, and exchange touchpoints in crypto cases.
• Specialist databases and commercial sources with a lawful basis.

What is not part of it: breaking into accounts, access to bank data, reading someone's phone without a legal basis, or impersonating someone to obtain information. A licensed agency does not do this and does not need to.

Digital investigation agency, cybersecurity company, or police?

The terms get mixed up in search queries, but they are three different things. A cybersecurity company protects systems against attacks. The police conduct criminal investigations and decide themselves which cases to pursue. A digital investigation agency works on your instruction: it establishes facts, preserves evidence, and delivers a report you can take to the police, bank, insurer, court, or internal decision-makers.

In practice they complement each other. After a hack or data breach, a security firm handles the technical remediation, while an investigation agency finds out who was behind it and what happened to the data or the money.

• Cybersecurity company or digital investigation agency? Article on the difference

What may an investigation agency do, and what not?

• Licence: in the Netherlands, professional investigation on behalf of others requires a Wpbr licence. NCRB holds licence POB 1737. Always check an agency on that number.
• Legal basis: there must be a legitimate interest, such as a claim, a dispute, an appointment, or a suspicion of fraud. Curiosity or wanting to follow an ex-partner is not a legal basis.
• Proportionality: research no more than the question requires, and use the least intrusive method first.
• Privacy: the GDPR and the Dutch privacy code of conduct for private investigation agencies apply in full. The assessment is documented per engagement.
• Refused: locating someone who deliberately avoids contact, research into minors without a legal basis, and any method that breaks the law.

When do you use digital investigation?

• Fraud and scams: online scams, investment fraud, crypto fraud, WhatsApp fraud, fake webshops, invoice fraud.
• Persons: locating someone with a legitimate interest, verifying an identity or fake profile, tracing heirs or witnesses.
• Money and assets: recovery research on a debtor, concealed assets in a divorce or insolvency, origin or destination of crypto.
• Claims: circumstances and social media research in personal injury and disability claims for insurers.
• Business: background checks and due diligence for appointments, investments, acquisitions, and suppliers.
• Evidence: preserving online evidence with timestamp and metadata before it disappears.

• OSINT and person research
• Fraud and scam investigation
• Crypto tracing and blockchain analysis
• Recovery research
• Digital evidence preservation

How does an engagement with NCRB work?

Every engagement starts with a confidential intake: what is the question, what is your interest, and what information already exists. We assess whether an investigation is lawful and worthwhile and say honestly when it is not. You receive a defined scope, timeline, and fixed price or cost ceiling before any work begins.

The investigation itself is done by an investigator, not by an automated tool. Every finding receives a source, time, and confidence rating. You receive a report designed for use by your lawyer, insurer, bank, or management, with screenshots and metadata as annexes.

• Our approach: the four phases of an investigation
• Investigation agency in Limburg: where we are based, working internationally

What does digital investigation cost?

There is no fixed price list, because scope differs per question. The price follows from four factors: how sharp the question is, the number of sources and countries, urgency, and the required reporting depth. A targeted verification is compact; an international recovery investigation or a crypto trace across several blockchains is not. The first conversation and a short feasibility check are free; after the intake you know the cost before you say yes.

• What does an OSINT investigation cost? The pricing factors explained

Frequently asked questions about digital investigation

What is the difference between digital investigation and OSINT?

OSINT is the method: research in public sources. Digital investigation is the profession and the wider process: sharpening the question, applying OSINT and technical analysis, preserving evidence, and reporting. A digital investigation agency such as NCRB uses OSINT as its main, but not only, technique.

May I investigate someone online myself?

Anyone may search public sources, within the GDPR. Professional investigation for third parties requires a Wpbr licence in the Netherlands. The risk of doing it yourself lies in usability: without method, timestamps, and source references, your evidence is easy to contest in proceedings or at the bank.

Can a digital investigator find someone I lost touch with?

Often yes, but only with a legitimate interest, such as a claim, an inheritance, or legal proceedings. When tracing family or an old contact, the person found decides whether contact follows.

How do I check whether an investigation agency is licensed?

Ask for the POB number and verify it with Justis, the screening authority of the Dutch Ministry of Justice and Security. NCRB holds licence POB 1737. An agency without a licence may not perform investigative work in the Netherlands.

Does NCRB work for private clients?

Yes, where there is a legitimate interest: victims of scams, disputes, heirs, verification of an online contact or an investment. At the intake we say honestly whether an investigation is worthwhile and lawful in your case.

Where is NCRB based and where do you work?

NCRB is based in Limburg, the Netherlands, and works digitally for clients across the Netherlands, Belgium, and more than twenty other countries. Most investigations require no visit; everything is handled confidentially by phone, email, or video call.