When fraud investigations collide with legal privilege