How to Preserve Evidence After an Online Scam

Evidence can be critical after an online scam. Organized records may help banks, payment providers, cryptocurrency exchanges, law enforcement agencies, regulators, and legal professionals understand what happened.

The first priority is to stop additional losses. Do not send more money, pay withdrawal fees, or follow new instructions from the suspected scammer.

Some records may disappear after an account is closed, a website is removed, or a scammer deletes a profile. Begin collecting information as soon as you suspect fraud.

• Stop sending money or cryptocurrency.
• Do not pay additional taxes, release fees, security deposits, or verification charges.
• Avoid warning the suspected scammer before important evidence has been saved.
• Secure any financial, email, or social media account that may have been compromised.
• Write down the date and time when you first suspected the scam.

Save every message connected to the incident, including conversations that may appear unimportant. Small details can help establish identities, timelines, payment instructions, and patterns of deception.

• Emails and complete email headers.
• Text messages and messaging application chats.
• Social media messages and profile details.
• Voice messages and call history.
• Video call records when available.
• Customer support conversations.
• Messages containing payment instructions or promises of returns.

Fraudsters may change usernames, delete profiles, or replace account photographs. Record identifying information before it becomes unavailable.

• Usernames and display names.
• Profile page addresses.
• Email addresses.
• Telephone numbers.
• Messaging application identifiers.
• Account photographs and biographies.
• Company names and claimed job titles.
• Dates when accounts were created, when visible.

Payment records are among the most important forms of evidence. Keep the original transaction documents and avoid editing them.

• Bank transfer receipts.
• Card statements and payment confirmations.
• Wire transfer instructions.
• Payment application receipts.
• Cryptocurrency transaction hashes.
• Wallet addresses.
• Cryptocurrency exchange deposit and withdrawal records.
• Invoices, contracts, and payment requests.
• Dates, times, amounts, currencies, and recipient details.

Fraudulent websites and advertisements may be removed quickly. Save information showing how the opportunity was presented.

• The complete website address.
• Screenshots of important website pages.
• Account dashboards and displayed balances.
• Withdrawal error messages.
• Advertisements and promotional posts.
• Claims about licenses, registrations, or partnerships.
• Terms and conditions.
• Customer support contact details.

A written timeline makes it easier to explain the incident consistently. Record events in chronological order and distinguish facts from assumptions.

Keep evidence organized and protected from accidental deletion. Use clear file names and preserve original copies.

• Create a dedicated folder for the incident.
• Use subfolders for messages, payments, profiles, websites, and reports.
• Keep original files in their original format.
• Create a backup on a separate secure device or storage service.
• Do not alter screenshots or transaction documents.
• Record where and when each file was obtained.
• Protect sensitive records with strong passwords.

If the scammer received passwords, identification documents, remote access, or financial account information, take immediate steps to reduce further risk.

• Change compromised passwords.
• Use a different password for every important account.
• Enable two-factor authentication.
• Sign out of unknown devices and sessions.
• Contact your bank or payment provider.
• Review account recovery details.
• Remove unauthorized remote-access software.
• Monitor financial and online accounts for suspicious activity.

Reporting procedures depend on the payment method, platform, and country involved. Contact the relevant institutions as quickly as possible.

• Your bank, card issuer, or payment provider.
• The cryptocurrency exchange used for the transaction.
• The platform where the scammer contacted you.
• Local law enforcement.
• The appropriate national cybercrime or fraud reporting agency.
• A financial regulator when an investment product was involved.
• A qualified legal professional when legal advice is needed.

People who report fraud may later be contacted by individuals claiming they can recover the money. Some are secondary scammers using information from the original incident.

• Be cautious of guaranteed recovery claims.
• Do not pay an upfront cryptocurrency recovery fee.
• Independently verify lawyers, investigators, and recovery companies.
• Do not share wallet recovery phrases or account passwords.
• Be suspicious of people claiming to have already located your funds.
• Verify government and law enforcement contacts through official channels.

• Complete communication history.
• Scammer account and profile information.
• Payment receipts and transaction records.
• Wallet addresses and transaction hashes.
• Website addresses and screenshots.
• Advertisements and promotional materials.
• Contracts, invoices, and payment instructions.
• A chronological incident timeline.
• Copies of reports and complaint reference numbers.

Keep the evidence in a secure and organized location. Provide copies rather than original files when possible, and retain your own complete record of everything submitted.