When a ticket is marked as resolved, it only means that there is no immediate response required from Support. If there was a status I could use called "Investigation" or something similar, I would. Otherwise, it would be increasingly difficult to distinguish between tickets that require our immediate attention and those that are under investigation. Instead, they are set to resolved and a tag is placed on them with the name of the scamming vendor. This way, we can simply search for all tickets with that tag once the investigation is complete or we have further communication to relay.