They know you will panic. They know you will call your bank, text your family, and maybe search online for answers. What they are betting on is that you will also block their number, delete their messages, and close the browser tabs. The moment you do, the evidence they left behind — the exact words they used, the phone number they called from, the fake website you sent money through — disappears.
I spent 17 years inside bank fraud investigations. The cases that moved forward were almost never the ones with the most money at stake. They were the ones where the victim handed the investigator a folder: screenshots, transaction records, a written timeline, and a list of what happened in order. The cases that stalled were the ones where the victim said, “I deleted the messages because I didn’t want to see them again.”
This guide is about building that folder. Not someday. Today. In the next hour, you can create the one document that will matter more than anything else you do this week.
“Preserve the evidence before you block anyone.”
— Rebecca Harlow
Key Takeaways
Do not delete anything. Not the texts, not the emails, not the browser history, not the fake website. The evidence disappears the moment you clean up.
Screenshots are your fastest tool, but they are not enough alone. Save full-screen captures with sender names, dates, and URLs visible. Export original files where possible.
Payment records deserve their own section. Bank statements, transaction confirmations, wallet addresses, and TXIDs are the backbone of any bank dispute.
A written timeline turns scattered evidence into a story. Investigators need to see what happened, when, and in what order.
Store everything in one place. Physical folder or digital folder, but one system. Scattered screenshots in your camera roll do not help anyone.
Why Evidence Disappears — and How Fast
Scammers do not leave their trail intact for long.
Bitdefender’s research on scam evidence notes that scam messages, profiles, and websites may vanish once criminals receive money or sense suspicion. They block the victim, delete the chat, rename the profile, and take the fake site offline. A crypto scammer who receives a wallet transfer will often delete the Telegram account, wipe the support chat, and rotate to a new domain within hours.
This is not accidental. It is operational security. The faster they erase, the harder it is for exchanges, regulators, or law enforcement to trace what happened.
The FBI’s Internet Crime Complaint Center (IC3) advises victims to keep original documents securely and lists transaction receipts, emails, web pages, chat logs, and telephone logs as potentially relevant evidence. The IC3 also asks complainants to include full email headers when available, because headers contain routing details that a screenshot may omit.
The window between “I think I was scammed” and “the evidence is gone” is measured in hours, not days. You have to move now.
What to Save: The Complete Evidence Checklist
Here is what belongs in your evidence folder. Gather what applies to your situation. Do not worry if you cannot get everything — partial evidence is still evidence.
1. Communications: What Was Said and Who Said It
Save the full conversation, not just the last message.
Text messages and chat logs:
Screenshot the entire conversation thread, including the scammer’s name or number at the top
Capture dates and timestamps for each message
If the conversation is on WhatsApp, Telegram, or another messaging app, use the app’s export function to download the full chat before blocking anyone
Do not crop the screenshots. A cropped image of one message may look dramatic, but it proves very little without the sender, date, and surrounding context.
Emails:
Save the original email, not just a screenshot. Export it as a .eml or .msg file if possible
Capture the full email headers. These show the true sending address and the servers the message passed through. The IC3 specifically asks for headers when available. Headers reveal misalignment among the From, Return-Path, and SPF/DKIM results, and the “Received” chain shows where the email actually came from.
If the scammer sent attachments, keep them. Do not open suspicious attachments, but preserve the files
Phone calls:
Save your call log showing the scammer’s number and the time of the call
If you have voicemails, save them. Do not delete them
If you recorded the call, keep the recording. If you did not, write down what was said while it is fresh
Social media and dating apps:
Screenshot the scammer’s profile page, including their username, profile photo, bio, and any posts
Capture the full URL of their profile
Save all direct messages
2. Payment Records: The Money Trail
This is the section your bank will read most carefully. Payment evidence deserves its own dedicated folder.
Bank and card transactions:
Download or screenshot the transaction record showing the date, amount, recipient, and reference number
Save bank statements that include the fraudulent transaction
For card payments, save the transaction reference and the merchant name as it appears
Wire transfers:
Save the wire confirmation, including the receiving bank, account number, and any reference number
Keep the receipt or confirmation page from the wire transfer
Payment apps (Zelle, Venmo, Cash App, PayPal):
Screenshot the transaction detail page showing the recipient, amount, date, and status
Save any confirmation emails or in-app receipts
Gift cards:
Keep the physical gift cards and the store receipts
Screenshot any photos of the card numbers if you sent them
Save the activation receipt
Cryptocurrency:
Save the wallet address you sent funds to
Save the transaction hash (TXID) — this is the unique receipt code for the transfer. The IC3 asks for cryptocurrency addresses, amount and type, and transaction date and amount.
Keep screenshots of the exchange withdrawal confirmation
Save any communication where the scammer provided the wallet address
The IC3’s guidance lists transaction receipts, electronic emails, web pages, and chat or telephone logs as potentially relevant evidence. Payment records are the backbone of that file.
3. The Scammer’s Identifiers: Who They Were and How They Contacted You
Investigators connect cases by matching phone numbers, email addresses, wallet addresses, and website URLs. This section helps them do that.
Save:
Phone numbers the scammer used — the number they called from, any callback numbers, and any numbers they provided later
Email addresses — all of them, including reply-to addresses
Website URLs — copy the full URL, not just the domain name. Save the page as a PDF if possible
Usernames and profile names on social media, dating apps, or messaging platforms
Cryptocurrency wallet addresses — copy and paste them exactly into a plain text file. Do not retype them
Any documents the scammer sent — fake invoices, contracts, investment statements, or identity documents
Bitdefender’s checklist recommends capturing the handle, profile URL, biography, posts, listings, and adverts for any profile involved in the scam. For websites, copy the full URL and capture the address bar, page content, payment instructions, and contact details.
The IC3 also asks for details about where and how you first encountered the scammer, what domain names or applications the scammer instructed you to use, and any two-factor authentication or one-time passcode information involved.
No comments yet.