Evidence & Documentation
Learn how to preserve messages, transaction records, account details, cryptocurrency information, screenshots, and other important evidence after online fraud.
Evidence helps banks, payment providers, cryptocurrency exchanges, regulators, law-enforcement agencies, and professional advisers understand what happened, when it happened, who was involved, and how money or information was transferred.
Fraud-related websites, social media accounts, messages, advertisements, and payment instructions can disappear quickly. Preserving information early can prevent important details from being lost.
Save every relevant conversation between you and the suspected scammer, broker, platform representative, recruiter, seller, romantic contact, or other person involved.
When possible, preserve the original conversation in addition to screenshots. Screenshots are useful, but exported chats, original emails, or platform records may contain additional information.
Financial records are often among the most important pieces of evidence because they help establish when funds were transferred, how much was sent, and where the payment was directed.
Cryptocurrency cases require accurate blockchain and account information. Small errors in wallet addresses or transaction hashes can make later review more difficult.
Fraudulent websites and online profiles may be changed, suspended, or removed after victims begin asking questions. Record important online information as early as possible.
Screenshots should ideally show enough context to identify the website, account, or conversation rather than capturing only a small isolated section.
Keep copies of documents sent to you or presented through the fraudulent scheme.
Keep the original file whenever possible rather than saving only a screenshot of the document.
A chronological timeline can make a complex fraud case easier to understand. Record the major events from first contact through the discovery of the fraud.
Evidence should be organized and protected from accidental loss or modification.
After preserving the available evidence, consider the payment method and organizations involved. Contact the relevant bank, card issuer, payment provider, cryptocurrency exchange, or platform promptly if funds or accounts may be at risk.
Appropriate reporting and recovery procedures vary between countries and transaction types. Organized evidence can help when submitting reports, requesting transaction reviews, or obtaining professional assistance.
Checklist
Use this checklist to organize the most important records before contacting a bank, payment provider, regulator, law-enforcement agency, or professional adviser.
Pitfalls
Practical missteps that can weaken records or create new risk after suspected fraud.
Victims sometimes block or delete suspected scammers immediately and accidentally lose important messages or account information.
Avoid:Do not delete chats, emails, profiles, or account records before evidence has been preserved.
Better approach:Save or export the relevant records first, then secure your accounts and block suspicious contacts when appropriate.
Small screenshots may remove important context such as dates, usernames, URLs, or account information.
Avoid:Avoid relying only on tightly cropped images.
Better approach:Capture enough context to identify the conversation, website, transaction, or account involved.
Annotations, image editing, or rewritten records can make it difficult to distinguish original information from later additions.
Avoid:Do not overwrite or alter original files.
Better approach:Keep the original evidence unchanged and create separate working copies if notes or annotations are needed.
A payment screenshot without a reference number or destination information may be less useful during later review.
Avoid:Do not record only the amount sent.
Better approach:Preserve dates, amounts, currencies, beneficiary details, transaction IDs, and payment reference numbers whenever available.
Victims may mistakenly include passwords, private keys, seed phrases, or authentication codes when preparing evidence.
Avoid:Never share credentials that can provide access to financial or cryptocurrency accounts.
Better approach:Provide transaction and account evidence without disclosing passwords, private keys, recovery phrases, or one-time codes.
Channels
The following official resources provide additional guidance about fraud reporting, evidence retention, and immediate actions after a scam.
External source
The FBI Internet Crime Complaint Center explains what evidence may support an internet crime complaint and advises complainants to retain original documents securely.
FBI Internet Crime Complaint Center · Accessed 2026-08-08
External source
The U.S. Federal Trade Commission provides guidance on contacting payment providers, protecting compromised accounts, and reporting scams.
Federal Trade Commission · Accessed 2026-08-08
Official resources are provided for reference and may change over time. Always verify current procedures directly with the relevant authority, financial institution, payment provider, or platform before taking action.
Related Patterns
Fraud patterns where evidence preservation is often especially important.
Related Guides
Additional practical articles that may help after suspicious online contact.
Practical Guide
Learn how cryptocurrency transactions can be traced after a scam, including transaction hashes, wallet addresses, blockchain networks, fund movements, exchange identification, and evidence preparation.
13 min read
Read articleFAQ
Cautious answers about screenshots, messaging and recovery expectations.
Confidential Case Review
Read related guides or submit your case for confidential assessment. Do not send passwords, authentication codes or full banking card details.
Submitting a request does not create an attorney-client relationship and does not guarantee representation, recovery, or any specific outcome.