The undercover investigator: where a lawful pretext ends and entrapment begins
One of the first things that surprises anyone who has never worked with private investigators is this: an investigator has no obligation to identify themselves as an investigator to the person being investigated.
If they had to, a good part of private investigation would cease to exist.
Discreetly observing, requesting information as an ordinary customer, arranging an appointment without revealing the real purpose, entering an establishment open to the public, or asking about an advertised service can all be part of a perfectly lawful investigation.
Going incognito is not, in itself, unlawful deceit. It is an investigative tool.
But there is a decisive line: it is one thing to conceal who I am in order to observe conduct that already exists; it is another to artificially create that conduct in order to use it later against the person under investigation.
Concealing professional status does not make the evidence unlawful
STS 1194/2024, of 24 September, examined a case in which an investigator presented themselves under a cover identity and recorded a conversation in which they personally took part.
The Court rejected the argument that not knowing the true identity and purpose of the meeting, by itself, turned the recording into an unlawful interception.
What is decisive is what the investigator did, what they obtained, how they obtained it, and whether they respected fundamental rights and legal limits.
The lawful pretext: making visible what was already happening
The Canary Islands High Court ruling STSJ 407/2023 offers a clear example. An investigator contacted a real-estate company posing as a potential customer and requested a service the company was already offering publicly.
The employee under investigation spontaneously provided professional advice.
The court rejected the claim of entrapment: the activity existed before the investigation, the investigator had not demanded to be attended to by any particular person, and the conduct arose from the individual's own will.
This is the best definition of a legitimate pretext: creating a normal occasion to verify pre-existing conduct, without creating the conduct itself.
An investigator may create the scenario, not the infringement
An investigator may call a business, ask for a quote, express interest in a product, or hold a meeting.
The question is not "did the investigator intervene?" Of course they did.
The question is: did the conduct they documented genuinely originate from the person under investigation, or was it fabricated by the investigator's own intervention?
When the investigator starts to fabricate
STS 155/2020, of 19 February, draws the line.
A female investigator contacted an employee posing as a possible customer. Up to that point there was no problem. The difficulty arose when she insisted that the meeting be held precisely during working hours, despite the employee's initial reluctance, and the resulting absence was then used to justify the dismissal.
The Supreme Court held the evidence unlawful because the investigator had decisively contributed to bringing about the sanctioned conduct.
Three questions before using a pretext
1. Does the conduct we seek to verify exist independently of us? The desirable answer is yes.
2. Does our intervention cause the infringement to occur? The answer must be no.
3. Does the person under investigation retain a real possibility of acting otherwise? The desirable answer is yes.
Pre-existing conduct: yes. Decisive conditioning by the investigator: no. Real freedom of the person under investigation: yes.
That is the green light.
Cover identity also has its limits
Acting incognito does not mean that any artifice is admissible.
It is one thing to use a cover name or present oneself as a customer. It is quite another to commit document forgery, wrongfully claim a reserved public or professional status, or carry out acts that in themselves constitute an infringement or a crime.
An operational identity is a tool. It is not a licence to break the law.
The report must explain how the situation arose
When we use a pretext, it is not enough to document the outcome.
The process must be documented: who initiated the contact, what was requested, what the person under investigation was already offering, who proposed the place and time, what conditions each party introduced, and what margin of decision the individual retained.
The opposing party's question will be predictable: "Isn't it true that you provoked this whole situation?"
A professional report should make it possible to answer with the objective sequence of events.
Conclusion: create the occasion, not the conduct
Discretion and cover identities are part of certain legitimate operations. But the strength of that evidence depends on what we document genuinely belonging to the person under investigation.
An investigator may call, ask questions, arrange a meeting, and present themselves as a potential customer. What they must not do is fabricate the infringement they later seek to prove.
At Método 3 we sum it up like this:
a good investigator builds the scenario needed to observe reality. They never build the reality they want to prove.
Truth has a method.