How to Build a Fraud Timeline in 20 Minutes

You don't need to remember everything. You need a structure.

I learned this during my years inside bank fraud investigations. The victims who got the best outcomes were not the ones with the most detailed memories. They were the ones who sat down, wrote out what happened in order, and handed the investigator a clean, dated, factual sequence.

That's a fraud timeline. And you can build yours in 20 minutes.

Your bank, the FTC, the police, and the credit bureaus all ask for the same thing: what happened, when, and how. The FTC's own reporting guide tells consumers to gather the business or person involved, what was promised, the dates and amounts, how payment was made, and the communication method used — then write a short timeline so the report remains clear.

This guide walks you through building that timeline. No legal training required. No special software. Just a pen, paper, or a blank document and 20 minutes.

“Write down the timeline before you make the next call.”

— Rebecca Harlow

Key Takeaways

• A fraud timeline is not a diary. It is a working document for investigators. Keep it factual, dated, and organized.

• 20 minutes is enough if you use a structured template instead of free-writing.

• Six required fields cover every timeline: date/time, what happened, who contacted you, what you shared or paid, what promises or pressure were used, and how the contact ended.

• The timeline serves three audiences at once — your bank's fraud department, the FTC or IC3, and law enforcement. Each needs the same core information.

• Never include passwords, full SSNs, one-time codes, or complete account credentials in your timeline. The FTC explicitly warns against uploading unrelated sensitive documents or credentials in your report narrative.

Why Your Bank Actually Needs This

Let me tell you what it looks like from the other side of the desk.

When a fraud dispute lands in a bank's investigation queue, the investigator sees a transaction record: a date, an amount, a payee, a channel. That's it. What they do not see is context. They don't know you received a text from a number you didn't recognize. They don't know the caller claimed to be from the fraud department. They don't know you were pressured to stay on the phone while you logged in.

Your timeline gives them that context. It answers the questions they are required to ask: Was this unauthorized or authorized? Did the consumer share credentials? Was there evidence of coercion? Did the consumer act promptly after discovery?

The Electronic Fund Transfer Act requires banks to investigate disputes and determine whether a transfer was unauthorized or not within 45 days of notification. Without your timeline, that investigation starts from zero. With it, the investigator has a map.

AARP interviewed law enforcement professionals who confirmed this: preserving evidence, preparing a timeline, and asking for a financial-crimes specialist can improve interactions with law enforcement and help authorities spot patterns. The Oklahoma County Sheriff's Office coordinator put it simply: "We cannot solve a problem that we don't know exists."

Your timeline is how you make the problem visible.

The 20-Minute Build: Step by Step

Here is the process. Set a timer. Work through each step in order.

Minutes 1-3: The First Contact

Start at the beginning. How did the scammer reach you?

Write down:

• The date and time (or your best estimate) of the first contact

• The platform or method — phone call, text message, email, social media DM, dating app, pop-up ad, website

• The name or identity the scammer used — the name they gave, the company they claimed to represent, the username or profile name

• The contact information they used — phone number, email address, username, website URL

The IC3's guidance for filing complaints emphasizes that the two most important categories of information are transaction information and scammer contact information. Extensive narrative about the scam itself is less useful. Start with the contact details.

Example entry:

June 3, 2026, 2:15 PM — Received text message from (555) 123-4567. Message claimed to be from [Bank Name] fraud department, stating suspicious activity on my account. Callback number provided: (555) 987-6543.

Minutes 3-6: The Building

Scammers rarely strike in one message. They build trust, create urgency, and gradually move you toward the payment.

Write down:

• Each subsequent contact — dates, times, and what was said

• The main promises or claims — what did the scammer say would happen?

• The pressure tactics used — urgency, threats, fear, isolation, romance, authority impersonation

A useful timeline usually contains each major promise, explanation, or pressure tactic, not just the payment events themselves.

Example entries:

June 3, 2026, 2:20 PM — Called the number. Person identifying as "Agent Michael Torres" said my account was compromised and I needed to move funds to a "safe account" to protect them. He said if I didn't act within the hour, the funds would be seized.

June 3, 2026, 2:35 PM — Torres stayed on the phone while I logged into my banking app. He told me to add a new payee and transfer $4,800. He said this was a temporary holding account and the funds would be returned within 24 hours.

Minutes 6-10: The Money Trail

This is the section your bank will read most carefully. Payment evidence deserves its own dedicated section because it often becomes the most important part of the file.

For each payment, record:

• Date and time

• Amount

• Payment method — debit card, credit card, wire transfer, Zelle, Venmo, Cash App, gift card, cryptocurrency

• Recipient information — payee name, account number (last four digits), wallet address, gift card brand

• Transaction confirmation number or reference ID if available

Example entry:

For cryptocurrency, include the wallet addresses, amount and type of cryptocurrency, date and time, and transaction ID (hash). These unique identifiers are the most critical information for law enforcement.

Minutes 10-13: The Discovery

When did you realize it was a scam? This moment matters because it establishes when your dispute clock started.

Write down:

• Date and time you discovered the fraud

• How you discovered it — a call from your real bank, a suspicious feeling, a failed attempt to withdraw funds, a family member's warning

• What you did immediately — who you called, what you reported, what accounts you froze

Minutes 13-16: The Aftermath

Document every action you have taken since discovery.

• Calls made — to your bank, the payment app, the FTC, police. Include dates, times, the name of the person you spoke to, and any reference numbers

• Reports filed — FTC report number, IC3 submission ID, police report number

• Accounts secured — passwords changed, cards canceled, credit freeze placed

This section proves you acted promptly. Promptness matters for your legal protections. Under Regulation E, reporting within two business days limits your liability to $50 for unauthorized transactions. Waiting 60 days can push that liability to $500. After 60 days, it may be unlimited.

Minutes 16-20: Clean Up and Format

You now have the raw material. Here's how to make it useful.

Separate facts from assumptions. The FTC reporting guide reminds consumers to write a short timeline so the report remains clear. One way to keep it clear is to distinguish what the records clearly show, what the other party claimed, and what you suspect but cannot yet prove.

Format it consistently. Use a table or a numbered list. Every entry should have a date, a description, and a source (what evidence supports it — screenshot, bank statement, call log).

Review the language. Remove emotional language. Replace "he was so convincing and I felt terrified" with "he stated that my account would be seized within the hour if I did not transfer funds." Investigators respond to facts, not feelings.

Add a one-paragraph summary at the top. Before the detailed timeline, write 3-4 sentences that summarize the entire event: who contacted you, what they claimed, how much you lost, and what you've done since.

Your Timeline Template

Here is a fill-in-the-blank structure you can copy into any document:

FRAUD TIMELINE — [Your Name] — [Date Created]

Summary: On [date], I was contacted by [scammer identity] via [method]. They claimed [what they said]. I sent [amount] via [payment method]. I discovered the fraud on [date] and have taken the following steps: [brief list].

Detailed Timeline:

Financial Loss Summary:

Evidence Index:

The Evidence Folder

Your timeline is the map. Your evidence is the territory. Keep them together.

Identity theft recovery guides recommend maintaining two physical or digital folders: one labeled "ORIGINALS" for original documents, and one labeled "COPIES" for everything you send out. Never send your original documents to anyone.

In your evidence folder, include:

• Screenshots of all communications with the scammer (full-screen, showing dates, names, and context)

• Bank statements showing the fraudulent transactions

• Transaction confirmations and reference numbers

• The FTC report confirmation page and report number

• IC3 submission ID (if filed)

• Police report number (if filed)

• Your completed timeline

The IC3's guidance specifically notes that the confirmation page contains your submission ID — the reference number for your complaint — and that you should print or save it immediately, because once you close the form window, you cannot reopen it. Save that reference number in your evidence folder.

What NOT to Put in Your Timeline

This is important. Your timeline will be shared with institutions and potentially with law enforcement. The FTC's guidance explicitly warns against including passwords, verification codes, or complete account credentials in your report narrative.

Do not include:

• Full Social Security numbers (last four digits only)

• Full account numbers (last four digits only)

• Passwords or PINs

• One-time codes or two-factor authentication codes

• Full debit or credit card numbers

• Cryptocurrency seed phrases or private keys

If an investigator needs full account numbers, they can get them from the bank. Your timeline is for context, not for credential disclosure.

Common Mistakes That Weaken a Timeline

Writing a novel. A 12-page emotional narrative does not help. The IC3's own guidance states that it is not helpful to include extensive narrative about the scam. Focus on transaction information and contact details.

Estimating vaguely. "Sometime in May" is less useful than "May 14 or 15, likely in the afternoon." If you genuinely don't remember, say so — but provide the closest estimate you can. AARP notes that one common mistake in police reporting is omitting key times or amounts, with victims saying things like "a few months ago" or "a few thousand dollars."

Mixing facts and feelings. "He was so aggressive and I felt trapped" belongs in a victim impact statement, not a fraud timeline. "He told me not to hang up and said my account would be frozen if I did" belongs in the timeline.

Forgetting follow-up actions. The timeline doesn't end when the scam ends. It continues through every report you file, every call you make, and every reference number you receive.

Leaving out the platform. The IC3 asks victims to provide where and how they first encountered the scammer, what domain names or applications the scammer instructed them to use, and any two-factor authentication or one-time passcode information involved. Platform details help investigators connect your case to broader patterns.