[EDRM Editor’s Note: This article was first published here on October 21, 2026, and EDRM is grateful to Trusted Partner HaystackID for permission to republish.]
HaystackID Editor’s Note: Trade fraud has moved from the customs broker’s desk to the prosecutor’s docket. With a dedicated DOJ and DHS task force, a new enforcement resource guide, reverse False Claims Act theories, and whistleblower awards that extend even to participants in the misconduct, companies that import goods face exposure that many compliance programs were never built to address. This article draws on HaystackID’s recent webcast, “Trade Fraud Investigation Best Practices,” which brought together perspectives from white-collar defense, forensic accounting, and eDiscovery. It follows a trade fraud matter from the first red flag through compliance testing, data collection, and the decision to self-report, and it explains why counsel, forensic accountants, and eDiscovery specialists need to work together from the start. Legal technology professionals supporting importers, multinational supply chains, or investigations involving customs data will find practical guidance on what to ask, what evidence matters, and how to prepare before the government comes calling.
Double invoicing is an old trick, but the stakes around it have changed. The scheme commonly works like this: a supplier ships a container of electronic components to a U.S. importer, and two invoices travel with it. The one that reaches U.S. Customs and Border Protection lists the goods at $50 a unit. The one that reaches the importer’s accounts payable team lists them at $100, and finance pays that amount. Neither department sees the other document, and the duty owed on the difference disappears.
For years, a discrepancy like that might have ended in a customs penalty and a corrected entry. Today, tariffs have climbed, the incentive to shave declared values and reroute goods has grown with them, and federal prosecutors increasingly treat customs paperwork as a source of fraud cases.
For legal technology teams, trade fraud matters now arrive with the same demands as any other high-stakes investigation: multilingual data, scattered systems, tight disclosure decisions, and a government counterpart that may already know more than the company does.
The recent HaystackID® webcast, “Trade Fraud Investigation Best Practices,” took that problem apart from three angles. Ashish Prasad, HaystackID’s Vice President and General Counsel, moderated a panel that paired Kevin Harnisch, Head of White Collar Defense and Investigations for the United States at Norton Rose Fulbright, with Andrew Bayer, Senior Director of Global Investigations and Dispute Resolution at Hilco Global, and Michael Sarlo, HaystackID’s Chief Innovation Officer and President of Global Investigations and Cyber Incident Response Services.
Prasad set a practical goal for the discussion.
We’re not going to try to cover every customs rule, but rather we’re going to try to help you understand what to ask, what types of evidence matter, and how to organize an effective response to a government investigation or an effective effort in an internal investigation.
Ashish Prasad, Vice President and General Counsel, HaystackID.
“We’re not going to try to cover every customs rule, but rather we’re going to try to help you understand what to ask, what types of evidence matter, and how to organize an effective response to a government investigation or an effective effort in an internal investigation,” he said during the program.
Together, the panelists traced a trade fraud matter from the first anomaly to the decision about whether to walk into the U.S. Department of Justice (DOJ).
The Government Built a Machine for This
Harnisch tied the enforcement surge to three forces:
- An administration focused on protecting American interests and keeping foreign companies from gaining an unfair advantage over American competitors.
- Higher tariffs that increase the incentive to evade or improperly minimize duties.
- A natural extension of sanctions and export controls enforcement, which has grown over the past several years.
He also noted that forced labor now falls squarely within the trade fraud picture. The machinery behind that focus is real.
In August 2025, DOJ and the Department of Homeland Security (DHS) launched a Trade Fraud Task Force (TFTF) that brings prosecutors from offices nationwide into a coordinated effort. In July, the agencies published “A Resource Guide to Trade Fraud Enforcement,” linking trade fraud to money laundering, wire fraud, securities, and RICO theories, and announced the task force had passed $1 billion in recoveries, penalties, forfeitures, and publicly charged losses. That figure deserves a closer read.
Charged losses remain allegations, and the largest single piece, a $549.5 million settlement with Perfectus Aluminum resolving allegations that aluminum extrusions were declared as pallets, involved conduct that had already led to related criminal convictions years before the task force existed, Newsline by HaystackID reported. The DOJ also made the effort permanent by creating a Global Trade & Commerce Enforcement Section within its National Fraud Enforcement Division.
The False Claims Act, the federal government’s primary tool for recovering money lost to fraud, sits at the center of that strategy.
“Normally, people think of the False Claims Act as applying to schemes to obtain money from the US government improperly, but there is another aspect of that statute that applies to failing to pay money owed to the US government. It’s known as a reverse false claim,” Harnisch said.
With treble damages and penalties attached, an underpaid duty can grow into a nine-figure problem.
Prosecutors aren’t waiting for referrals, either. Harnisch noted that DOJ has set up a group dedicated to finding cases through data analytics. Its October 1 directive points to the National Fraud Detection Center as the hub for that work.
DOJ has also expanded its whistleblower program to cover trade fraud, and it will pay awards even to whistleblowers who took part in the misconduct they report. A company that discovers a problem should assume someone else may find it too.
What Was It, What Was It Worth, Where Was It Made?
The Resource Guide catalogs 16 trade fraud typologies, but Bayer argued that most collapse into a handful of border questions:
- What the goods are,
- What they were worth,
- Where they were made,
- How much came in, and
- How they were produced.
Those questions map directly onto classification, valuation, and country of origin, the three fields where most schemes live.
Classification fraud can look almost comical once someone spots it, such as honey entering the country as syrup. The example isn’t hypothetical: the Resource Guide highlights a honey importation prosecution involving 27 defendants and roughly $260 million in losses, which it calls the largest criminal antidumping and countervailing duty prosecution in U.S. history. Bayer acknowledged that complex products could involve legitimate judgment calls. Still, the risk arises when the same product suddenly carries a different tariff code for no business reason. Valuation fraud brings back the double invoice.
“So if your customs value is quoted at $50, but then your finance or accounting teams pay $100, that’s a red flag,” he said.
Origin fraud usually takes the form of transshipment, which Bayer called a substantial, pervasive problem that the DOJ is focusing heavily on, with public estimates of potential tariff evasion running into hundreds of billions of dollars. When goods that historically came from China start arriving from Vietnam or Mexico right after a tariff change, Bayer wants one answer: “So did manufacturing actually move, or did only the shipping route change?”
He also flagged offshore shell companies acting as importers of record, leaving the government with nothing to collect once an investigation starts. The pattern extends well beyond U.S. ports. In April 2026, the European Anti-Fraud Office reported an alleged scheme that moved Chinese textiles, footwear, and e-bikes into the EU through Poland using falsified transit documents and shell companies, evading about €118 million in customs duties, a case whose mechanics resemble several typologies in the U.S. guide.
Whatever the scheme, the method stays the same.
“So you compare what was represented to what the evidence actually shows,” Bayer said. Investigations often begin in the gap between what a company declared and what its records show.
Customs filings and transaction records only take investigators partway there, though. Sarlo pointed out that the real story usually surfaces somewhere else: in emails, mobile devices, and secure messaging apps, often across multiple languages and countries.
The initial data sources can be very data-driven as far as forms and transactions, but the story in these situations is obviously going to come from the communications.
Michael Sarlo, Chief Innovation Officer and President of Global Investigations and Cyber Incident Response Services, HaystackID.
“The initial data sources can be very data-driven as far as forms and transactions, but the story in these situations is obviously going to come from the communications,” he said.
Fix It Quietly or Pick Up the Phone?
Not every discrepancy is a federal case. A misclassified shipment may reflect a broker’s honest mistake, and companies need some way to tell the difference before deciding whether to correct the error internally or self-report. Harnisch admitted there is no formula.
“I wish I could say there is a bright line, easy answer. As I like to tell folks, it’s much more of an art than a science,” he said.
Prosecutors do weigh predictable factors, though. Harnisch listed evidence of intent, such as falsified documents or efforts to hide activity from supervisors and compliance; how pervasive the conduct is; whether senior executives took part; and whether the misconduct reflects people circumventing a well-designed program or a program that never worked. Weigh those factors together, he said, and a company can usually tell whether it has an internal fix or real exposure. DOJ has separately put its own version in writing.
On October 1, 2026, the National Fraud Enforcement Division (Fraud Division) named tariff evasion one of four corporate enforcement priorities and listed factors that carry great weight in charging decisions, starting with management’s complicity in the scheme and efforts to conceal it from regulators or auditors.
Testing the Program, Not Admiring It
That last factor puts the compliance program itself on trial. Harnisch recommended reading the Resource Guide alongside DOJ’s guidance on effective compliance programs and building a risk-based approach around a fresh assessment of the supply chain, source countries, and highest-dollar imports. Resourcing, he said, goes beyond budget and headcount to the experience of the people running the program. But he saw the biggest gap elsewhere.
“You can have all the greatest designs in the world for a compliance program,” Harnisch said. “How are you testing it to make sure that things are working appropriately in practice, right?”
Bayer has seen plenty of companies with strong anti-bribery, sanctions, or data privacy programs that never put trade fraud or forced labor on the risk heat map, because they treated customs as a U.S. Customs and Border Protection (CBP) issue rather than an enterprise one. His fix starts with adding those risks to the assessment and benchmarking against the 16 typologies at the control level, not the policy level. If the company relies on supplier certifications, someone should know what supports them and whether anyone has ever exercised the audit clause in the supplier contract.
Then comes transaction testing. Bayer described analytics that flag sourcing shifts after a new tariff, sudden Harmonized Tariff Schedule (HTS) code changes, and gaps between customs values and actual payments. From there, the team pulls purchase orders, invoices, payments, and shipping records for the riskiest suppliers and products, and supplements them with external shipping and corporate data. If the documents hold up, the company gains real comfort. If they don’t, it knows where to dig.
Data That Was Never Meant to Connect
None of that testing works if the data stays locked in silos. Sarlo said the first step is mapping the systems, from ERPs to logistics platforms, along with their owners, and then setting retention to match the risk.
Elements and indicators of fraud may appear for old transactions. So having probably a little bit of a longer tail end on this type of data than you typically would is going to be fairly critical.
Michael Sarlo, Chief Innovation Officer and President of Global Investigations and Cyber Incident Response Services, HaystackID.
“Elements and indicators of fraud may appear for old transactions. So having probably a little bit of a longer tail end on this type of data than you typically would is going to be fairly critical,” Sarlo said.
Trade fraud data rarely arrives clean. Suppliers in transit countries may still run paper-heavy operations, so companies need dependable, regular third-party data feeds, and they need to know where communications live on personal devices and contractor platforms. Sarlo noted that vision AI now handles scanned and mixed-format records far better than OCR-dependent tools, though he cautioned that processing large volumes of images can add cost. Used well, it lets teams pull customs filings, invoices, ledgers, and receipts into a single data lake that clearly signals where to look.
Retention carries legal weight as well. Importers must keep entry records for five years, and for multinational supply chains, collecting supplier and personnel records from EU entities for a DOJ production can trigger GDPR transfer rules, a conflict that Newsline recommends working through before a subpoena arrives.
Pulling the Thread
When a credible concern surfaces, Harnisch starts by agreeing on the mandate with the client, because a whistleblower complaint, an audit anomaly, and a government inquiry each call for a different plan, and public company calendars can compress the timeline. He warned repeatedly against tunnel vision and confirmation bias. Nobody needs to boil the ocean, but the team must eventually answer a hard question for the government and the board: how confident is the company that the problem doesn’t exist elsewhere?
Bayer treats the first allegation as the tip of the iceberg. He tests it by asking what the records should show if it’s true and what evidence would point the other way. Then he reconstructs every transaction from purchase order to payment and identifies the people at each step. He triangulates documents against each other and outside sources, such as trade data and ownership records, to trace a product back through two or three countries to its real manufacturer. If one bad shipment reveals ignored warnings or untested supplier claims, he runs a look-across the same supplier, products, and countries.
On the preservation side, Sarlo focuses on known actors, legal holds, mobile devices, messaging apps such as Signal and Telegram, and third-party records at risk of deletion. Import records carry a specific risk of their own: under 18 U.S.C. § 551, destroying them to suppress evidence of fraud is a separate federal crime. That’s why HaystackID’s trade fraud experts recommend sending preservation requests to customs brokers and freight forwarders who may hold filings the importer never possessed. AI can surface key actors and events without collecting everything; however, Sarlo flagged a trap specific to these matters.
“It’s not uncommon to have scans and paper documents that may have technical upload dates and certain types of metadata that are out of sync with what’s actually on that document,” he noted.
AI-assisted allegations and data miners are compressing timelines, Bayer noted, but he refused to trade rigor for pace, arguing that “the speed shouldn’t come at the expense of the well-documented investigation records.”
That tension peaks when the company decides whether to cooperate.
“Speed is incredibly important. So you’ve got to make your decision fast because if you’re going to self-report and get that full cooperation credit, you’ve got to go to them before they find the information on their own,” Harnisch said.
The reward for moving first can be substantial. Harnisch explained that DOJ’s cooperation framework offers companies pathways to reduced charges or even outright declinations. The same clock runs at CBP, where reduced penalties for a prior disclosure under Section 1592 generally require the company to come forward before, or without knowledge of, a formal investigation. Earning that credit often means deciding before the internal investigation finishes. It also means committing to full transparency about what individuals did and how far up the organization the conduct reaches, a point of emphasis for the current DOJ that often makes corporate clients uneasy.
Companies should also check their insurance early. Harnisch noted that coverage for government investigations depends heavily on the policy. Some policies exclude investigative inquiries until formal allegations are made, while broader, often more expensive policies cover the cost of responding to the government.
Three Legs of the Stool
Prasad closed the webcast by challenging the assumption that hiring a law firm settles everything.
My impression from this webinar is that it is of critical importance that there be coordination between the law firm, the forensic accounting firm, and the eDiscovery service provider, because without that type of coordination, I don’t know how the right questions are asked, the right questions are answered, and the right information is provided in the right way to the government.
Ashish Prasad, Vice President and General Counsel, HaystackID.
“My impression from this webinar is that it is of critical importance that there be coordination between the law firm, the forensic accounting firm, and the eDiscovery service provider, because without that type of coordination, I don’t know how the right questions are asked, the right questions are answered, and the right information is provided in the right way to the government,” he said.
Harnisch agreed, noting that lawyers can’t apply the law without the facts, and that finding them takes forensic work and large-scale data testing. Bayer urged companies to stop treating the Resource Guide as background reading and start using it as an action plan.
“I just wouldn’t wait for a wave of enforcement cases before determining whether their controls actually work. I would just start the work right now,” he said.
Sarlo pushed for a living playbook with a built-in data collection strategy and a standing bench of counsel and vendors who meet regularly to test the program. In practice, the eDiscovery provider often anchors that bench as a data hub, working under outside counsel to deliver ERP and customs entry data to the forensic accountants and policy and training evidence to compliance experts.
For legal technology professionals, that bench is the practical takeaway. A company that has already mapped its supplier data, reconciled its customs values against its payments, and lined up its investigators will likely spend the first week of a trade fraud matter answering questions. A company that hasn’t will spend it figuring out who to call.
Read the original article here.
Source: HaystackID
Assisted by GAI and LLM Technologies per EDRM’s GAI and LLM Policy.
