gig worker payout fraud
platform payout redirect · tip skimming · ghost driver accounts — interim playbook until DoorDash/Uber parsers ship.
entry point: payment processor subpoena response normalizer stripe. work the primary tools top-down — all local, no upload.
start here · primary tools
ordered. work top-down. the first tool is the suggested entry point for this case type.
- payment processor subpoena response normalizer stripedrop stripe subpoena response · parse merchant + transaction artifacts · runs locally
- payment processor subpoena response normalizer paypaldrop paypal subpoena response · parse account + transaction artifacts · runs locally
- venmo transaction export forensic analyzerdrop venmo download · parse payment timeline + notes · runs locally
- ios venmo artifact forensic extractordrop iOS Venmo database files from the app container · parse payment records and transaction notes · surface audience settings (public/friends/private) · surface social feed likes and comments on transactions · reconstruct Venmo financial and social activity timeline · runs locally
- case report generatorfill in case number · examiner · dates · findings · drop evidence files for auto hash · generates structured forensic report PDF · runs locally
also useful · secondary tools
supporting and follow-up tools. surface as the investigation widens.
- ios cash app artifact forensic extractordrop iOS Cash App database files from the app container · parse transaction records, payment notes, and account artifacts · surface payment amounts, counterparty Cashtags, and timestamps · detect suspicious payment patterns and structured transactions · runs locally
- cross payroll wfm timesheet correlatordrop payroll + wfm exports · correlate paycheck to timesheet · runs locally
- payroll unauthorized adjustment detectordrop payroll export · detect unauthorized pay adjustments · runs locally
- fatcousin multi tool super timeline correlatordrop any fatcousin findings csv/json · unified timestamp-sorted timeline · runs locally
- fatcousin cross export ioc hash correlatordrop hash/ioc csv from any fatcousin tool · shared indicator intersection report · runs locally
- evidence manifest generatordrop evidence files · compute md5 sha1 sha256 · chain of custody manifest · case number · analyst · export pdf and csv · runs locally
proof & methodology
synthetic reference investigations and investigation playbooks for this case type — fixture-locked goldens, local binders, evidence order, and tool paths.
investigation guide: gig worker payout fraud — methodology →
side-by-side: compare case types →
run as a case-kit pipeline
no curated stack for this case type yet. tracked in the forensics rollout — pipelines roll out one case type at a time.