Act fast to preserve critical evidence. Scammers delete accounts, websites vanish, and messages disappear.
Before you report, before you tell anyone, before you do anything else - preserve evidence. This checklist covers the most time-sensitive items.
Scammer's profile/account page (username, profile picture, bio)
All chat/message history with timestamps visible
Any phone numbers, email addresses, or contact info shared
Transaction confirmations (bank, exchange, payment apps)
Wallet addresses provided by scammer
Website pages before they go offline
Any documents or files received from scammer
Caller ID/phone records showing their number
| Evidence Type | Typical Lifespan | Action Required |
|---|---|---|
| Telegram accounts | Hours to days | Screenshot immediately, export chat |
| WhatsApp messages | Can be deleted anytime | Export chat, screenshot everything |
| Scam websites | Days to weeks | Archive.org, PDF print, screenshots |
| Social media profiles | Hours to days | Full profile screenshots, friend lists |
| Email addresses | May be abandoned quickly | Save full headers, archive emails |
| Phone numbers | Burner phones discarded frequently | Record all numbers, check caller ID apps |
Blockchain transactions are permanent, but the context around them is not. Properly documenting crypto transactions is essential for investigation and potential recovery.
| Data Point | Where to Find It | Why It Matters |
|---|---|---|
| Transaction ID (TXID/Hash) | Wallet app, exchange history, blockchain explorer | Unique identifier for the transaction |
| Sender address | Your wallet, transaction details | Proves funds came from you |
| Receiver address | Transaction details, chat with scammer | Identifies scammer's wallet |
| Amount | Transaction details | Quantifies your loss |
| Timestamp | Block explorer, transaction receipt | Establishes when theft occurred |
| Block number | Block explorer | Permanent reference point |
| USD value at time | Calculate from historical data | Establishes dollar loss amount |
Block explorers provide permanent, verifiable records of transactions:
After your transaction, trace where the scammer moved the funds:
If you sent funds through an exchange:
Download complete transaction history
Save withdrawal confirmation emails
Export account statements if available
Screenshot the specific withdrawal with all details
Note the exchange's support ticket number if you reported it
Chat logs are often the most valuable evidence, showing exactly how the scam unfolded. Different platforms require different preservation methods.
| Platform | Export Method | Notes |
|---|---|---|
| Discord | No native export - screenshot or third-party tools | Request data download for your messages only |
| Instagram DMs | Data download request, screenshots | Download takes time - screenshot immediately |
| Facebook Messenger | Settings > Your Information > Download | Can take hours/days - screenshot first |
| Twitter/X DMs | Data archive request, screenshots | Archive can take days |
| Signal | No export - manual screenshots only | Designed for privacy, harder to preserve |
These tools help capture and preserve evidence in formats useful for investigation and legal proceedings.
Submit URLs to create permanent archived copies of scam websites before they disappear.
Alternative archiving service that captures pages including JavaScript-rendered content.
Print web pages to PDF using browser's built-in print function (Ctrl/Cmd + P > Save as PDF).
Captures content as it appeared, with date stamp.
Windows: Win + G for Game Bar recording
Mac: Cmd + Shift + 5 for screen recording
iOS: Control Center > Screen Recording
Android: Varies by device, usually in Quick Settings
Professional-grade screen recording for capturing long sessions or video calls.
Use chain-specific explorers to document transactions with permanent links.
Bitcoin: blockchain.com | Ethereum: etherscan.io
Set alerts on scammer wallet addresses to track where funds move.
Etherscan and similar explorers offer email alerts for address activity.
Tools to parse email headers and identify true origin:
Store evidence copies in multiple locations:
Understanding what investigators look for helps you collect and present evidence effectively.
| Evidence Type | Priority | Why It Matters |
|---|---|---|
| Wallet addresses | Critical | Can be traced, linked to exchanges where scammer may be identified |
| Transaction IDs | Critical | Permanent proof of fund movement |
| Complete chat logs | High | Shows modus operandi, may contain identifying info |
| Email headers | High | Can reveal sender's real IP address and location |
| Phone numbers | High | Can be subpoenaed for subscriber info |
| Website URLs | Medium | WHOIS records, hosting provider info |
| Profile screenshots | Medium | Pattern matching, image searches |
| Documents received | Medium | Metadata, templates used in other scams |
FBI IC3 (ic3.gov) - Primary for cyber/crypto crimes
FTC (ReportFraud.ftc.gov) - Consumer fraud database
State Attorney General - Consumer protection division
Local police - Creates official record, may refer to specialized units
SEC - If securities/investment fraud involved
CFTC - Commodity/forex fraud
Well-organized evidence is more useful to investigators and attorneys. Use this structure to make your case easy to understand.
Scam_Evidence_[YourName]_[Date]/
├── 00_SUMMARY.pdf (1-page overview)
├── 01_Timeline/
│ └── Chronological_Events.pdf
├── 02_Communications/
│ ├── Telegram_Export/
│ ├── Email_Messages/
│ ├── WhatsApp_Export/
│ └── Screenshots/
├── 03_Transactions/
│ ├── Bank_Records/
│ ├── Exchange_History/
│ ├── Blockchain_Evidence/
│ └── Payment_App_Records/
├── 04_Scammer_Identity/
│ ├── Profile_Screenshots/
│ ├── Phone_Numbers.txt
│ ├── Email_Addresses.txt
│ └── Wallet_Addresses.txt
├── 05_Websites/
│ ├── Screenshots/
│ ├── Archive_Links.txt
│ └── PDF_Copies/
└── 06_Documents_Received/
└── [Any files from scammer]
Create a 1-page summary (00_SUMMARY.pdf) containing:
Your name and contact information
Date range of scam (first contact to last)
Total amount lost (in USD)
Cryptocurrency types and amounts
Payment methods used
Scammer identifiers (usernames, emails, phone numbers)
Wallet addresses used by scammer
Platforms used (Telegram, WhatsApp, website names)
Brief description of the scam (2-3 sentences)
Create a chronological list of events:
Example format:
| Date/Time | Event | Evidence | Amount |
|---|---|---|---|
| 2024-01-15 14:30 | First contact via Telegram from @CryptoSignalsVIP | 02_Communications/Screenshots/first_contact.png | - |
| 2024-01-18 09:15 | Sent first payment to wallet 0x1234... | 03_Transactions/Blockchain/tx1.pdf | $5,000 (0.5 ETH) |
Use consistent, descriptive names:
After discovering you've been scammed, time is critical. Scammers routinely delete Telegram accounts, take down websites, and clear chat histories within hours. The evidence you preserve in the first few minutes may be the only proof that exists. Well-documented evidence increases your chances of law enforcement action and potential recovery.
Organized evidence is actionable evidence. Create a clear folder structure, write a one-page summary of key facts, and build a chronological timeline. Include transaction IDs, wallet addresses, and all scammer identifiers prominently. Submit reports to FBI IC3, FTC, and local law enforcement with your evidence package. Your thorough documentation may be the link that connects your case to a larger investigation.