Why Investigators Should Learn SQL

For years, my investigations depended on whatever reports the data team had time to build. Every hypothesis came with a queue: great question, we'll get to it next sprint.

Learning SQL ended that dependency — and changed the kind of investigator I am.

From requester to explorer

With direct query access, exploratory analysis becomes part of the investigation itself:

Notice an anomaly → query it immediately → find three more like it → escalate with evidence, not vibes.

That loop, which used to take weeks, now takes an afternoon.

What I'd tell any Trust & Safety professional

1. Start with your own caseload. Query the cases you've already worked. You know the ground truth, so you'll trust and understand the results.
2. Learn joins before anything fancy. Fraud hides in the relationships between tables — accounts, transactions, devices, disputes.
3. Pair SQL with a scripting language. Python takes you from "here's a table of results" to "here's an automated workflow."

The bigger point

Technical curiosity isn't a detour from operations work — it's a multiplier on it. Domain expertise tells you which questions matter. Technical skills let you answer them at the speed the adversary moves.