Deleting the messages was the cheap part.

I recently wrote about sanctions: the adverse-inference instruction, the spoliation finding, the judge with disapproval written all over his face telling the jury it may assume the worst about whatever got erased. That’s a high price to pay for hitting delete. It can cost real money, and sometimes much more. Sometimes it ends up costing the whole case. But the courtroom is not necessarily where the biggest bills come due.

Regulators send a different kind of invoice, and they can send a lot of them.

The three-billion-dollar housekeeping problem

Since December 2021, the SEC and the CFTC have been running a sweep, collecting what they politely call “off-channel communications.” Translation: business talk that happened on personal phones, in texts, in WhatsApp, in Signal, in whatever app someone reached for instead of the monitored work system. The firms were supposed to keep those records. They didn’t. So, the messages weren’t there when the regulators came looking. Toll calls, indeed.

The tab so far is north of $3 billion in combined penalties across more than 100 firms. It started small and almost quaint: JPMorgan, December 2021, a $125 million (okay, not so small to you and me) WhatsApp recordkeeping fine that looked at the time like a warning shot. It wasn’t a warning shot – it was just the opening bid.

And here’s the part attorneys may want to pay close attention to. The enforcement that hit the institutions is now working its way down to individuals. FINRA has picked up the baton and started suspending individual brokers for the same conduct. It’s been often said that all business is personal, but they didn’t mean penalties. Those corporate penalties are becoming personal. That text you fired off from your own phone doesn’t just belong to your employer’s compliance headache anymore.

One fine, for the deletion alone

Now a hop across the pond to Brussels for a clean illustration of the principle in Europe.

In June 2024 the European Commission fined International Flavors & Fragrances €15.9 million for obstructing an antitrust inspection. The underlying investigation into the fragrance industry is a separate matter and is still open as of IFF’s June 2026 filing. What earned the fine was this: during a 2023 dawn raid, while the Commission was reviewing employees’ mobile phones, a senior employee intentionally deleted WhatsApp messages exchanged with a competitor, after being told the inspection was underway.

Very bad timing. Not before. He deleted them after being told an inspection was happening.

It was the first time the Commission ever fined a company for deleting messages off a phone. And note the arithmetic, because it’s the whole thesis of this piece: the fine was set as a percentage of IFF’s total worldwide turnover, then cut in half because the company owned up and helped recover the data. The fine did not depend on proving that the messages established the suspected antitrust violation. The deletion itself was the offense.

“But the messages are gone. How do they even know?”

This is the question many ask, usually with real hope in their voice. It rests on the myth that a deleted message is a deleted event.

It isn’t. A message is not a single object sitting in one place. It’s an event that leaves marks in several places at once, most of them outside the sender’s reach.

Delete a text and the content may vanish from the handset (although it might also be recoverable from there), but the carrier may still maintain transaction records for an SMS or MMS, logging that a message moved from one number to another at a particular minute. That metadata won’t tell anyone what was said but it will tell an investigator that something was said, to whom, and when, and that is often more than enough. For encrypted apps that don’t use the carrier’s messaging service, evidence may exist elsewhere: in an enabled backup, in forensic remnants that may still be recoverable from the device, or on the other person’s phone.

That last one is the reversal worth dwelling on. In my usual line of work, “we have the logs” is what my side says when we’ve preserved the evidence, and the other side is squirming. In these cases it’s turned around. The logs that sink you are the ones the other side kept. Two firms message off-channel; one of them preserved its half of the conversation, and now the gap on the second firm’s system isn’t just a gap, it’s a documented absence with a matching record on the far end. The counterparty becomes the witness. In the fragrance case, the Commission caught the deletion during the raid and the deleted data was recovered through the backup system anyway. The employee erased his handset copy. He did not erase IFF’s backup.

Existence outlives content. That’s the line to remember. Should be the title of a book.

“Isn’t a fine just the cost of doing business?”

Some firms clearly treated the recordkeeping rules that way, right up until the number had ten figures in it. But there’s a subtler trap. When the deletion itself becomes the sanctionable act, the cooperation math changes. IFF’s fine got halved for coming clean and helping recover the data. The deletion still cost them eight figures. Without that cooperation, the Commission’s starting figure was twice as high. There’s no version of that ledger where hitting delete comes out ahead.

“My client isn’t a Wall Street bank or a fragrance conglomerate.”

Well, of course it’s not. But the logic doesn’t live in securities law or EU competition rules. It lives in one idea that runs through all of it: destroying evidence after you’re on notice is a separate wrong from whatever the evidence would have shown, and it carries its own separate price. Regulators call it obstruction. Judges call it spoliation. The custodian who cleaned up their phone the weekend after the litigation hold arrived is standing in the same spot as that senior employee in the fragrance case, minus the corporate turnover to cushion the landing.

So, what to do?

Nothing exotic. The unglamorous stuff, done early.

Preserve on notice. We know this goes without saying, but given that it’s still an issue, we’re saying it anyway. In U.S. civil litigation, the duty to preserve relevant evidence generally arises when litigation is reasonably foreseeable. If auto-delete settings can affect information in scope, suspend them.

Assume the other side kept their copy. Advise clients as though the counterparty preserved everything, because sometimes they did. A story that depends on a message never having existed is a story with a short shelf life. Hope and reality can be two very different things.

Preserve the phones before they’re “cleaned up.” Deleted-but-recoverable data may have a narrow window. It can disappear when the device is wiped, traded in, or overwritten through continued use or backup rotation. Phones also perform their own internal clean-up, so time matters. Preserve the device promptly, then have counsel and a qualified examiner determine the appropriate scope and acquisition method.

Don’t confuse encrypted with gone. Signal and similar apps can make content harder to recover, but encryption does not eliminate every potential source. Depending on the app and its settings, evidence may remain in an enabled backup, a screenshot, or a recipient’s device.

Deleting evidence can create consequences on several legal tracks. A court may impose remedies for spoliation, while a regulator may pursue recordkeeping violations or obstruction. Those categories can overlap, and the available penalties depend on the facts and the forum. What they share is that the deletion can become a problem of its own, apart from whatever the missing messages might have shown.

Ever had a “the messages are gone” case turn out to be nothing of the sort once you looked at the other side’s devices? I’d like to hear how it went.

Burgess Forensics: (866) 345-3345 | steve@burgessforensics.com

Steve Burgess is a digital forensics expert witness with more than 40 years of experience and over 20,000 devices and digital media examined. He is the principal of Burgess Forensics, founded in 1985.

Sources: European Commission press release, IFF €15.9M (June 2024) · Holland & Knight, SEC/CFTC off-channel enforcement totals · Ex-Wells Fargo Broker Fined, Suspended for Off-Channel Texts to Colleague