While you were gathering information as part of security assessments for one of your clients, you were able to gather data that show your client is involved with fraudulent activities. What should you

A penetration tester who uncovers evidence of criminal activity such as fraud is legally obligated to stop the engagement immediately to avoid becoming complicit in the ongoing illegal activity. Continuing work or handling the data improperly could expose the assessor to legal liability, and reporting to proper legal authorities ensures that evidence is handled correctly within the chain of custody and that the illegal activity is addressed through proper legal channels.

Ignoring evidence of fraud and continuing the assessment makes the assessor potentially complicit in the illegal activity and violates professional ethical standards.

Directly confronting the client about fraudulent activity could compromise evidence, create a hostile situation, and expose the assessor to personal risk - this is a matter for legal authorities, not informal confrontation.

Copying potentially illegal data to removable media without legal authorization could itself be illegal, violate evidence handling protocols, and compromise the chain of custody needed for any subsequent legal proceedings.