When sextortion victims hired Digital Forensics Corporation LLC, they paid between $1,499 and $20,000 for investigative services the company allegedly never delivered. The FTC's lawsuit reveals a pattern: fake chat transcripts, made-up investigative data, and employees in India writing positive reviews for services they'd never used. The company collected at least $60 million before the FTC filed its complaint in the U.S. District Court for the Northern District of Ohio.
You can't prevent every scam, but you can reduce your organization's exposure to fraudulent vendors in high-stakes situations. This checklist helps you evaluate crisis response providers before your team needs them.
Purpose of the Checklist
Use this checklist to vet cybersecurity incident response firms, digital forensics providers, breach notification services, and other crisis vendors before you sign a contract. It focuses on vendors who market to organizations under duress, where verification pressure is high and time feels short.
This isn't a replacement for your standard vendor risk assessment. It's an additional layer for providers who promise urgent, specialized services during incidents when your team is least equipped to spot deception.
Prerequisites
Before using this checklist:
- Identify your crisis vendor categories. Map which services you might need under pressure: forensics, breach counsel, notification vendors, crisis PR, ransomware negotiators.
- Establish a pre-incident vendor list. Evaluate providers before an incident occurs. Don't wait until you're responding to a breach to start vetting.
- Assign accountability. Designate who on your team reviews responses and validates claims. This should sit with procurement, legal, or your Computer Security Incident Response Team lead.
If you're already in crisis and evaluating a vendor for the first time, use the validation steps section to prioritize the highest-risk claims.
The Checklist
Copy this template into your vendor assessment workflow. Require documentation for every "Yes" answer.
Service Claims Verification
- Does the vendor provide specific, measurable deliverables? Look for concrete outputs, not vague promises like "we'll track down the perpetrator." Digital Forensics allegedly promised detailed investigative reports but delivered fabricated data.
- Can the vendor show you a redacted sample of their deliverable? Ask for a sanitized forensic report, notification template, or incident timeline from a real engagement.
- Do their marketing claims align with technical feasibility? If a vendor promises to "identify perpetrators with a high degree of success," ask how they bypass Tor, VPNs, and jurisdictional limits.
- Does the vendor advise actions that contradict law enforcement guidance? The FTC complaint noted Digital Forensics told victims not to block sextortionists, contrary to FBI recommendations. Compare vendor advice to CISA, FBI, and Secret Service guidance for your incident type.
Regulatory and Legal Standing
- Is the vendor registered in jurisdictions where they claim to operate? Verify business registrations, not just website claims.
- Do they have relevant professional certifications? For forensics: GIAC, EnCE, or similar. For legal services: bar admissions. For breach notification: compliance with state-specific requirements.
- Have they been named in regulatory actions or lawsuits? Search the FTC's case database, state attorney general actions, and PACER for the vendor and principals.
- Do they comply with Gramm-Leach-Bliley Act requirements if handling financial data? The FTC alleged Digital Forensics violated GLBA by collecting financial information under false pretenses.
Review and Reputation Validation
- Can you verify reviews with actual customers? Ask for references you can contact directly, not just names on a website.
- Do reviews describe specific outcomes? Generic praise ("great service!") is easier to fake than detailed descriptions of deliverables.
- Are negative reviews addressed substantively? Check BBB, Trustpilot, and Google. The FTC alleged Digital Forensics suppressed negative reviews and generated thousands of fake positive ones.
- Do review patterns show red flags? Clusters of reviews posted on the same day, reviews from accounts with no other activity, or reviews that use identical phrasing suggest manipulation.
Contract and Refund Terms
- Does the contract specify deliverables with measurable criteria? "We will provide a forensic report" is vague. "We will provide a report documenting artifacts recovered, chain of custody, and analysis methodology" is specific.
- Are refund terms clearly documented? The FTC complaint alleged Digital Forensics failed to honor its own refund policy.
- Does the contract include service level commitments? Define response times, escalation procedures, and communication frequency.
- Are pricing structures transparent? Be cautious of vendors who push "Phase 2" upsells before completing Phase 1 work.
Sales and Telemarketing Practices
- Do sales calls focus on technical capabilities or emotional pressure? The FTC alleged Digital Forensics used scare tactics tailored to victims' "pain points," warning military members about dishonorable discharge or married victims about threats to spouses.
- Does the vendor discourage you from seeking second opinions? Legitimate providers don't pressure immediate decisions.
- Can you review the contract before payment? Avoid vendors who demand payment before providing contract terms.
Customizing the Checklist
Adapt this checklist to your organization's risk profile:
If you're a financial institution regulated by NYDFS Cybersecurity Regulation: Add a requirement that vendors demonstrate how their services support your 72-hour notification obligation and Board reporting requirements.
If you're subject to HIPAA: Verify vendors will sign a Business Associate Agreement before handling any protected health information. Confirm they understand HIPAA Security Rule requirements for electronic protected health information.
If you operate critical infrastructure under NERC CIP: Ensure vendors understand reporting obligations and can work within your CIP-008 Incident Reporting and Response Planning requirements.
For organizations with SOC 2 commitments: Document how vendor services support your trust services criteria and how vendor access will be logged and monitored.
Validation Steps
If you're evaluating a vendor during an active incident:
Verify the single highest-risk claim first. If the vendor promises to "stop the attack," ask for their technical methodology and success metrics. If they can't explain how, stop the evaluation.
Check regulatory databases immediately. Search the FTC's enforcement actions, your state attorney general's consumer protection division, and federal court records (PACER). This takes 15 minutes.
Contact one reference directly. Ask about specific deliverables: "What did the forensic report include? How long did analysis take? Did they meet their SLA?"
Compare their advice to official guidance. If you're responding to ransomware, check their recommendations against CISA's Ransomware Guide. If they contradict federal guidance, ask why.
Document everything. If the vendor relationship fails, your documentation supports recovery efforts and potential regulatory inquiries.
The FTC's action against Digital Forensics shows how crisis vendors exploit urgency. Your best defense is evaluating providers before you need them, when you have time to verify claims instead of trusting promises.
