What Is an OSINT Investigation, and When Do You Need One?

Updated 13 October 2026 by Investigation Bureau

An OSINT investigation is a structured search of open and lawfully licensed sources, run by an investigator to answer a specific question: who is behind a name or an account, where someone might be, whether a person or company is what it claims, or how a fraud was put together. OSINT stands for open-source intelligence. The investigation part means verification, an audit trail and a written judgement, not a list of search results.

Most people have done a little OSINT without calling it that: a name typed into a search engine, a company looked up before a contract is signed. The professional version differs in reach, in method and in what it produces. This guide explains the difference, the limits, and what the work costs in the UK.

If you already have a question that needs answering, the first conversation is free and confidential. Send a confidential enquiry and we reply within one working day.

What OSINT means in practice

OSINT is information anyone could lawfully obtain, collected deliberately and read with care.

What people publish about themselves. Profiles, posts, photographs, usernames, forum history, reviews and CVs.
Public registers. Companies House filings, director appointments, county court judgments and insolvency notices.
Property and electoral data. Land Registry titles, planning applications, and electoral roll data where it is licensed for the purpose.
Imagery. Satellite and street-level photography, and the metadata inside images shared online.
Domain and device data. Who registered a website, where it is hosted, and the technical traces an email or a message carries with it.

None of this is hidden. The value lies in gathering it in a disciplined way, testing each item against the others and recording where every piece came from. An OSINT investigation turns what is publicly available into evidence a court can rely on, and says honestly where the public record runs out.

What an OSINT investigation can establish

Who is behind a name, an account, a number or an email address. A username reused years ago, a photograph that appears somewhere else, a phone number tied to a marketplace listing: small overlaps like these connect a screen name to a real person. More in who is behind an anonymous account.

Leads on where someone is. Open sources rarely hand over a current address, but they narrow the search: a new employer, a relative's town, a business registered at a home address. With licensed data and enquiries on the ground, that becomes a trace. See how private investigators find people.

Whether a person or company is what it claims. Filings, litigation history, property records, sanctions lists, and the gap between what a business says about itself and what the record shows.

How a fraud was put together. Cloned websites, lookalike domains, mule accounts and fake trading platforms all leave technical traces. Mapped into a timeline, they give your bank and your solicitor a clear account of what happened, and they are the groundwork for a cyber investigation.

What is exposed about you. The same method, turned around, shows an executive or a family what an adversary could learn about them, and what to do about it.

What it cannot do

The limits of OSINT are the limits of the law.

Nothing behind a login. Private messages, a locked profile, a mailbox, a cloud account: getting into any of them without authority is an offence under the Computer Misuse Act 1990, whoever asks.
No private data by deception. Ringing a bank while pretending to be the subject is an offence under section 170 of the Data Protection Act 2018.
No interception. Calls, messages and emails in transit are protected by the Investigatory Powers Act 2016.
No bought leaked databases. Breach dumps and broker files with no lawful basis of their own cannot be used in evidence, and buying them is an offence in itself.

There is a practical limit too. A careless operator leaves a wide trail. A careful one, using fresh accounts and a clean device, can leave almost nothing to work with. When the open record runs out, the honest answer is to say so, and the next step is usually a Norwich Pharmacal order, obtained through your solicitor, which requires a platform or a bank to disclose what it holds. Good OSINT builds the evidence for that application.

How an investigation is run

A proper OSINT investigation follows the same shape every time.

Brief and lawful basis. What you need to know, why, and what you will do with the answer. Every instruction has a documented lawful basis under UK GDPR before any search is made, and we decline those that fail the test. We are registered with the ICO as a data controller (ZC259849).
Sources. A plan of which sources are likely to answer the question, and which licensed datasets the purpose permits.
Verification and cross-referencing. Nothing is accepted from a single source. A name match becomes a finding only when a second, independent source points the same way.
An audit log of every search. We run our OSINT work on tools built in-house: an open-source intelligence console logs every search against the case, with the time and the investigator's name, and that record carries a finding's chain of custody from first query to witness box. Read more about the technology behind our casework.
A report that separates what was found from what it means. Findings are cited to their source, captures are timestamped and preserved, and the analysis sits apart from the facts so a reader can test the reasoning. It says how confident we are and what remains unknown.

When OSINT is enough and when it needs fieldwork

Many instructions end at the desk: an identity confirmed, a counterparty checked, a footprint mapped. Others reach a point where open sources can only suggest.

A trace confirmed by a visit. The desk work says a person is probably at an address. A discreet visit establishes whether they live there now.
An attribution corroborated by surveillance. Open sources link an anonymous account to a likely individual. Lawful observation can turn a likely link into one that will stand up.
Due diligence tested by discreet enquiries. The record says a business trades from a given premises. A conversation in the right place says whether it does.

We propose fieldwork only once the desk phase has shown it is needed.

Cost and timescale

As a guide to the UK market, desk-based OSINT work usually starts at a few hundred pounds and is delivered within days. A people trace is typically a fixed fee of £150 to £500. Where fieldwork follows, investigators generally charge £50 to £150 an hour, and covert surveillance runs to £500 to £1,200 per operative per day. Our price guide covers the figures in more detail.

Our own practice is straightforward: after a free, confidential first conversation, every instruction gets a fixed quote in writing before any work begins.

How to choose someone to do it

Ask how they will get the information. A competent investigator can describe the sources and the lawful basis without hesitation.
Ask what the audit trail looks like. If every search is not recorded, the findings cannot be defended later.
Check the basics. A registered UK company, an ICO registration and a named person accountable for the work.
Expect a written fixed quote. And a clear refusal to go behind a login, buy leaked data or deceive anyone.
Look for honesty about limits. Someone who promises to identify any account or find any person is describing a sales pitch, not OSINT.

Read more about how we run OSINT investigations.

Frequently asked questions

Is OSINT legal in the UK?

Yes, when it draws on sources that are public or licensed for the purpose and is processed under a documented lawful basis under UK GDPR. Bypassing an access control, obtaining personal data by deception and buying stolen data are offences, and the Protection from Harassment Act 1997 applies to a client who misuses a finding. That is why we ask what the answer is for before we start.

Can OSINT find someone's address?

Sometimes on its own, and more often in combination with licensed data and enquiries on the ground, because open sources tend to produce leads rather than a confirmed current address. We only trace people where there is a legitimate reason, such as a debt, a legal claim, a beneficiary or a lost relative, and we turn away anything that looks like stalking or harassment.

Do you use AI?

Yes, as an assistant to the investigator, not a replacement. AI tools help sort large volumes of lawfully gathered material, spot patterns and draft summaries. Every finding in a report is checked by a person against its source, and nothing is reported on the strength of a machine's suggestion alone.

How long does it take?

Desk-based work is usually finished within days: an identity check, an attribution, a footprint assessment or the open-source phase of a due diligence report. Larger pieces, such as mapping the infrastructure behind a fraud, are scoped and timetabled individually. Tell us if it is urgent and we will say plainly what is possible in the time.

Put the question to an investigator. The first conversation is free and confidential. Send a confidential enquiry and we will tell you what open sources can and cannot establish.

Sister service: Trace Bureau is our fixed-price address tracing service, for anyone who only needs a current UK address for a lawful purpose. Charged only when we find them. Investigation Bureau is a Bureau Nine company.