OSINT Intelligence Report:
People Search, Due Diligence & Background Checks

1. Legal Framework & Compliance

Before deploying any OSINT tool or technique, practitioners must establish a lawful basis for their investigation. The regulatory environment varies significantly by jurisdiction, target type, and intended use of the data gathered. This section outlines the key frameworks governing OSINT investigations in the US, EU, and UK.

1.1 FCRA Compliance (US)

The Fair Credit Reporting Act (FCRA) is the primary federal law governing the use of consumer reports in the United States. It applies whenever consumer information is used for employment screening, tenant screening, credit decisions, or other "permissible purposes" defined under the Act.

Key FCRA Provisions

• Scope: Governs "consumer reporting agencies" (CRAs) and the use of "consumer reports" for credit, employment, insurance, housing, or other permissible purposes.
• FCRA-Compliant CRAs (for employment/housing screening): Checkr, Sterling, HireRight, First Advantage. These are not covered in this report as they require separate employer agreements.
• Non-FCRA tools (BeenVerified, TruthFinder, Intelius, Instant Checkmate, Spokeo, CocoFinder) are explicitly not consumer reporting agencies and prohibit use for employment or tenant screening.
• Civil Liability: Statutory damages of $100–$1,000 per violation; actual damages; punitive damages; attorney's fees.
• Criminal Penalties: Knowing violations can result in criminal prosecution.
• Adverse Action Requirements: If using an FCRA report to deny employment/housing, you must provide pre-adverse action notice, copy of the report, and Summary of Rights.

1.2 GDPR (EU/UK)

The General Data Protection Regulation (GDPR) governs the processing of personal data for individuals located in the EU and UK. Its extraterritorial reach means that processing data about EU/UK persons — regardless of where the investigator is located — may trigger GDPR obligations.

• Sparse data landscape: UK and EU people search data is significantly sparser than US equivalents due to GDPR restrictions on public data aggregation and data broker operations.
• Legitimate interest: Processing personal data requires a lawful basis; "legitimate interest" may apply for fraud prevention or journalism, but must be documented and balanced against individual rights.
• Right to erasure: Data subjects can require data brokers to delete their records. Most major brokers maintain opt-out/removal processes.
• 192.com (UK): Pulls data from Companies House and the Electoral Roll — both official public registers with established lawful bases under UK GDPR. Still requires legitimate purpose for investigative use.
• Enforcement risk: The ICO (UK) and EU supervisory authorities can impose fines up to 4% of global annual turnover or €20M (whichever is greater).

1.3 Permissible Use Cases

1.4 Ethical Guidelines

2. Investigation Type 1: People Search

2.1 Overview

People search investigations aim to locate, identify, and profile private or semi-public individuals using publicly available records, data broker aggregations, and social media footprints. The US has the richest ecosystem of people search tools due to the relative openness of public records (court filings, voter registration, property records, death records), while UK and EU investigations are more constrained by GDPR but still possible through legitimate sources like Companies House and the Electoral Roll.

The optimal strategy combines free primary sources (public records) with paid aggregators where depth or comprehensiveness is needed — not the reverse. Most investigations can be significantly advanced using only free tools before any paid subscription is considered.

2.2 Paid Data Broker Comparison Table

2.3 Free People Search Tools

2.4 Step-by-Step People Search Workflow

1. 1
   Define Your Target
   Gather all known identifiers before beginning any search. Essential: full legal name, known aliases or nicknames, approximate age or date of birth, last known location (city/state/country). Helpful: associated phone numbers, email addresses, known employers, vehicle license plates, social media handles.
2. 2
   Start With Free Tools First (US)
   Begin with the free tier: TruePeopleSearch → FastPeopleSearch → ZabaSearch → That's Them. Goal: establish current address, known relatives, phone number(s), and any associated email addresses. Cost: $0. These tools often provide sufficient data for most use cases.
3. 3
   Expand to Social Media & Web Presence
   Search LinkedIn (name + known employer), Facebook search (name + location), PeekYou for username search across platforms, WebMii for general web presence. Look for corroborating data points that match the address and contact information found in Step 2. Note: stay logged out or use a dedicated investigation account.
4. 4
   Cross-Reference With Public Records
   Access primary sources directly:

   • PACER for federal court records ($0.10/page; free if under $30/quarter)
   • State court websites (many are free via state judiciary portals)
   • JudyRecords (judyrecords.com) for 600M+ US court records — free
   • County property records via county assessor website — almost always free
   • Voter registration records (availability varies by state)
5. 5
   Use Paid Aggregator If Needed
   If free tools leave significant gaps, use BeenVerified or TruthFinder for comprehensive criminal/court/property/vehicle history. Verify the value before committing to a subscription — use the $1 trial offer (BeenVerified). Always cancel auto-renewal if not needed beyond the trial period. Remember: these tools are NOT FCRA-compliant and cannot be used for employment or housing decisions.
6. 6
   UK-Specific Path
   For UK subjects: 192.com (20 free searches/day with registered account) → BT Phonebook (listed numbers) → UK Phonebook → Electoral Roll records (via 192.com credits for premium access). Company connections: Companies House free API. Note: all UK searches are subject to UK GDPR requirements.
7. 7
   Verify Findings
   Cross-check every significant finding: verify address via Google Maps Street View and county property records; verify phone number via reverse lookup (That's Them, Google); confirm social profiles are active and belong to the correct person; do not rely on a single data broker's unverified data for consequential decisions.
8. 8
   Document Your Findings
   Screenshot all findings with visible timestamps and URLs. Note the data source, date accessed, and search parameters for every data point. Create a structured evidence dossier that maintains chain of custody. This documentation is essential for legal defensibility and for distinguishing verified from unverified claims.

2.5 Tool Pros/Cons Detail Cards

3. Investigation Type 2: Company Due Diligence

3.1 Overview

Company due diligence OSINT is used to verify the legitimacy, financial health, and risk profile of a business entity before entering into contracts, partnerships, or investment relationships. The free public record ecosystem for companies is remarkably rich — Companies House (UK), SEC EDGAR (US public companies), OpenCorporates (global), and the OCCRP Aleph investigative database collectively provide a powerful free toolkit that rivals or exceeds many expensive commercial products for most due diligence needs.

Critical use cases include: fraud prevention (verifying a company is real and legally registered), partnership vetting (checking directors, ownership structures, and litigation history), investment decisions (financial health, adverse media, sanctions exposure), and supply chain compliance (sanctions screening for business relationships). Skipping sanctions screening for any significant business partner is a serious compliance failure in many jurisdictions.

3.2 Free Company Research Tools

3.3 Step-by-Step Company Due Diligence Workflow

1. 1
   Identify the Entity
   Obtain the full legal company name, company registration number (if known), jurisdiction of incorporation, and any trading names or DBAs (doing business as). Disambiguation is critical — verify you have the correct entity before proceeding, as common names may have multiple registrations.
2. 2
   Verify Registration
   Confirm legal existence and status via official registries:

   • UK: Companies House (find-and-update.company-information.service.gov.uk) — free, authoritative
   • US public companies: SEC EDGAR (sec.gov/edgar) — free
   • US private companies: State Secretary of State business registry — usually free
   • Global: OpenCorporates (opencorporates.com) — 140+ jurisdictions, 200 free req/mo

   Confirm: legal status (active/dissolved/struck off), registered address, incorporation date, registered agent.
3. 3
   Check Directors and Officers
   Identify all current and historical directors, officers, and significant shareholders:

   • Companies House (UK): Director history, resignations, disqualifications
   • SEC EDGAR Proxy (US): Executive bios, compensation, ownership stakes
   • OpenCorporates Officers module: Cross-jurisdiction director networks

   Cross-reference each director name against other company registrations to identify networks of control or shell company patterns.
4. 4
   Sanctions and Watchlist Screening
   Non-negotiable for any financial or significant business dealing:

   • OpenSanctions (opensanctions.org): 200+ global lists, free, updated daily
   • OFAC SDN List: sanctionssearch.ofac.treas.gov — free, US Treasury
   • UN Consolidated List: un.org/securitycouncil/content/un-sc-consolidated-list — free
   • EU Sanctions Map: sanctionsmap.eu — free

   Screen both the company name and all identified directors/beneficial owners.
5. 5
   Beneficial Ownership Investigation
   Identify the ultimate beneficial owner (UBO) — who ultimately controls or benefits from the company:

   • OpenOwnership register (openownership.org): For jurisdictions participating in BOT standard
   • Companies House PSC register (UK): Persons with Significant Control — free, mandatory filing
   • OCCRP Aleph (aleph.occrp.org): For complex offshore structures (Panama Papers, FinCEN Files)

   Red flags: nominee directors, shell company chains through offshore jurisdictions, opaque ownership structures.
6. 6
   Financial Health Assessment
   Review financial data:

   • UK: Companies House annual accounts (free); Endole for credit risk analysis (freemium)
   • US public companies: SEC EDGAR 10-K (free) — audited annual financials
   • Global: Dun & Bradstreet credit reports (paid, most comprehensive globally)

   Key metrics: revenue trends, profitability, debt levels, going concern notes in auditor's report, any qualified opinions.
7. 7
   Adverse Media and Litigation
   Search for negative news, court proceedings, and regulatory actions:

   • OCCRP Aleph: Full-text search of leaked documents and investigative databases
   • PACER (pacer.uscourts.gov): Federal court litigation, $0.10/page
   • Google News: "[company name] lawsuit fraud investigation"
   • LittleSis: For corporate-political connections and power network analysis
   • Regulatory databases: FCA (UK), SEC enforcement actions (US)
8. 8
   Digital Footprint Analysis
   Assess online presence and reputation:

   • Domain WHOIS: whois.domaintools.com — registration date, registrant, name servers
   • SSL certificate transparency: crt.sh — certificate history and subdomain discovery
   • LinkedIn company page: Employee count trends; recent departures can signal instability
   • Glassdoor: Anonymous employee reviews; patterns of management or financial instability
   • Web Archive: web.archive.org — track website changes and historical claims
9. 9
   Final Risk Assessment
   Compile findings into a risk tier classification:

   • Green: Clean registration, clear ownership, no sanctions hits, positive financial indicators, no material adverse media
   • Amber: Minor concerns requiring clarification — e.g. dormant periods, nominee directors, limited financial history, isolated adverse media
   • Red: Do not proceed — sanctions hits, dissolved/struck off status, fraudulent indicators, serious litigation, opaque beneficial ownership with no explanation

   Document all sources with URLs and access dates for audit trail.

3.4 Company OSINT Tool Detail Cards

4. Investigation Type 3: Background Checks

4.1 Overview

Background checks fall into three distinct categories that require very different tools and legal frameworks: (1) Employment background checks — legally regulated by the FCRA; require written consent and FCRA-compliant CRAs. (2) Personal background checks — informal research on individuals you are entering into personal or business relationships with; permissible using non-FCRA tools but cannot be used to make employment or housing decisions. (3) Tenant screening — like employment, regulated by the FCRA; requires FCRA-compliant CRA and specific process.

4.2 Background Check Tools Comparison

4.3 Step-by-Step Background Check Workflows

4.4 Public Records Sources Quick Reference

5. GitHub OSINT Toolboxes

5.1 Overview

GitHub hosts a rich collection of curated OSINT resource lists and automated toolboxes maintained by the investigative community. These range from simple curated HTML pages of useful links (valuable as organized starting points) to sophisticated multi-agent Python frameworks (valuable for automation and scale). The GitHub OSINT ecosystem is valuable for three reasons: it is entirely free, it aggregates community knowledge about which tools are currently working, and it often includes guidance on OPSEC and legal compliance that commercial tools omit.

5.2 Toolbox Comparison Table

5.3 Detailed Repository Cards

6. AI-Powered OSINT Agents

6.1 Overview

Artificial intelligence is transforming OSINT by enabling automated data collection, intelligent correlation of disparate signals, and AI-generated investigation reports that previously required significant manual analyst time. The current generation of AI OSINT tools ranges from open-source multi-agent frameworks (like OSINT_AI_Agent) to commercial platforms with proprietary AI-powered entity resolution (Maltego, ShadowDragon), and from AI-augmented traditional tools (SpiderFoot HX) to purpose-built fraud detection AI (SEON).

For most investigators, the most practical immediate application of AI in OSINT is as an analyst assistant: using GPT-4o or Claude to generate targeted Google dork queries, summarize lengthy documents, draft investigation reports from structured data, and identify patterns across multiple data points. Building a full AI pipeline with LangGraph is the next step for those with technical capability.

6.2 AI OSINT Tools Comparison

6.3 Building Your Own AI OSINT Pipeline (Technical Guidance)

For technically capable investigators, a custom AI OSINT pipeline offers maximum flexibility and can be tailored to specific investigation workflows. Below is a five-step architectural approach, using OSINT_AI_Agent as the reference implementation:

1. 1
   Choose LLM Backend
   Select based on capability, cost, and privacy requirements:

   • OpenAI GPT-4o: Best general capability; cloud-hosted; requires API key (~$0.01-0.03/1K tokens)
   • Anthropic Claude 3.7 Sonnet: Excellent for long document analysis and structured output; cloud-hosted
   • Local via Ollama: Privacy-preserving; models like Llama 3, Mistral, or DeepSeek-R1; free after hardware cost; no data leaves your system
   • DeepSeek API: Significantly lower cost than OpenAI; strong reasoning; OSINT_AI_Agent default
2. 2
   Use LangGraph or AutoGen for Multi-Agent Orchestration
   Reference the OSINT_AI_Agent architecture: a Supervisor agent routes tasks to specialized sub-agents (Recon, Shodan, Fingerprint) via a LangGraph state machine with checkpointing. This pattern scales to any OSINT use case — swap recon agents for people search, company lookup, or social media monitoring agents.
3. 3
   Connect OSINT APIs
   Key APIs to integrate based on investigation type:

   • Domain/Infra: Shodan API, VirusTotal API, Censys API, SecurityTrails
   • People: FullContact People API, Hunter.io (email), ContactOut API
   • Companies: OpenCorporates API (free 200 req/mo), Companies House API (free), SEC EDGAR API (free)
   • Sanctions: OpenSanctions API (free)
   • Courts: PACER API (federal, pay-per-use)
4. 4
   Implement Structured Output with Pydantic
   Use Pydantic models with LangChain's structured output capabilities to ensure consistent, machine-readable results from each agent. This enables downstream agents to reliably parse and act on upstream agent outputs, and produces clean structured data for final report generation.
5. 5
   Add Evidence Capture and Chain-of-Custody Logging
   Integrate Hunchly (desktop browser extension) for automated web evidence capture with SHA-256 hashing and timestamping. Supplement with programmatic logging: record every API call, response hash, timestamp, and search parameter in a structured investigation log. This maintains defensible chain of custody for any findings used in legal or compliance contexts.

7. Free Public Records & Open Data Sources

The most accurate and legally defensible OSINT findings come from primary public record sources — not commercial aggregators. These free sources are authoritative, regularly updated, and carry no FCRA compliance concerns for legitimate research purposes.

7.1 US Public Records Quick Reference

7.2 UK Public Records Quick Reference

8. Common Mistakes & Anti-Patterns

8.1 The 10 Most Common OSINT Mistakes

1. 1
   Using Non-FCRA Tools for Employment Decisions
   BeenVerified, TruthFinder, Intelius, Instant Checkmate, and Spokeo explicitly prohibit use of their data for employment screening, tenant screening, or credit decisions. Violating FCRA exposes you to civil liability of $100–$1,000 per violation plus actual damages and attorney's fees. Class action risk is real — multiple class actions have been filed against employers for this exact violation. Always use Checkr, Sterling, or another certified CRA for employment screening.
2. 2
   Trusting a Single Source
   Data brokers aggregate from public records that may be years out of date, or may have been erroneously attributed to the wrong person (common with same-name confusion). Always cross-reference critical information — address, phone, criminal records — from at least 2 independent sources before acting on findings. A single data point from a paid aggregator is a hypothesis, not a fact.
3. 3
   Confusing Preview Results With Actual Data
   Most data broker sites show enticing "previews" — name match, approximate city, indication of "criminal records found" — to hook you into subscribing. The actual report you receive after paying may contain significantly less detail than the preview implied, or the "criminal records" may be minor civil infractions. Never subscribe based solely on what the preview promises.
4. 4
   Ignoring Opt-Out and Removal Rights
   If you are the subject of an investigation and want your data removed, most major data brokers (BeenVerified, Spokeo, Intelius, TruthFinder, Instant Checkmate, TruePeopleSearch, FastPeopleSearch) offer opt-out/removal processes. The People-Search-OSINT GitHub repository includes a Privacy Opt-Out Repository with instructions for each major platform. Conversely, investigators should be aware that subjects may have already opted out, resulting in incomplete profiles.
5. 5
   Not Documenting the Investigation Chain
   OSINT findings are only useful if you can prove where they came from and when you obtained them. Screenshot all findings with visible timestamps and URLs. Note the search parameters used. Create a structured evidence log for every investigation. Without documentation, findings cannot be acted upon in legal or compliance contexts — and you cannot defend yourself against allegations of fabrication.
6. 6
   Tipping Off the Subject
   Visiting a subject's LinkedIn profile while logged in will generate a "profile viewed" notification. Similarly, joining Facebook groups or following accounts may alert the subject. Use logged-out browser sessions, Google cache, or a dedicated OSINT browser profile. For sensitive investigations, use a VPN and a completely separate browser identity. The web.archive.org Wayback Machine provides historical snapshots without alerting the target.
7. 7
   UK/EU GDPR Violations
   Collecting, storing, or processing personal data about EU/UK individuals for non-legitimate purposes violates GDPR — even if the investigator is based outside the EU/UK. "Legitimate interest" must be established and documented before any investigation of EU/UK data subjects. The ICO (UK) and EU data protection authorities can impose fines up to 4% of global annual turnover. UK Electoral Roll searches via 192.com require legitimate purpose documentation.
8. 8
   Assuming Free = Less Accurate
   Free public records (PACER, Companies House, SEC EDGAR, NSOPW, OpenSanctions) are often more accurate than paid aggregators because they come directly from authoritative primary sources with no intermediate processing, interpretation, or attribution errors. Paid aggregators add convenience but also add a layer of potential inaccuracy. Always verify against free primary sources for consequential findings.
9. 9
   Skipping Sanctions Screening for Business Partners
   For any significant business relationship — new supplier, customer, partner, investor — OFAC/UN/EU sanctions screening is a legal compliance requirement in many jurisdictions, not an optional step. Using OpenSanctions (free, 200+ lists, daily updates) takes minutes and can prevent catastrophic legal exposure. A business relationship with a sanctioned entity can itself constitute a sanctions violation, regardless of intent.
10. 10
    Not Using VPN and OPSEC
    Many data broker and OSINT platform websites log visitor IP addresses. If the subject of your investigation has allies or access to the site's logs, they could identify your IP address — potentially identifying your organization or location. Use a commercial VPN for all OSINT investigations (especially against potentially hostile subjects). Use a dedicated browser profile with no personal login sessions active. Consider Tor for particularly sensitive investigations.

8.2 OSINT Investigation Anti-Patterns

9. Final Recommendations Matrix

9.1 By Investigation Type

9.2 By Budget

9.3 Tool Scoring Matrix

Ratings are 1–5 stars (★ = 1, ★★★★★ = 5). Scores reflect typical investigative use; individual results may vary. N/A = not applicable for that dimension.