Almost every route open to a fraud victim — a card dispute, a bank recall request, a police report, a regulator complaint, independent legal advice — runs on evidence. The people reviewing your case were not there when it happened. They can only act on what you can show them.
Fraudsters know this too. Scam websites are taken down, chat accounts are deleted, and "account dashboards" showing your supposed balance vanish within days or hours of a victim asking difficult questions. Evidence you do not capture early may simply stop existing.
This guide explains what to keep, how to capture it well, and how to store it so it stays usable.
What counts as evidence, by payment type
Different payment methods leave different trails. Collect everything in your category, even items that seem trivial now.
Card payments. Card statements showing the transaction, the merchant name exactly as it appears on the statement, payment confirmation emails, receipts or invoices, and any refund promises made in writing. If you paid through a payment page, capture the page itself, including its web address.
Bank transfers. The transfer confirmation, the recipient's account name, account number, and bank, the payment reference you were told to use, and any instructions you received about where and how to send the money. Those instructions often show that you were deceived, which matters in a dispute.
Cryptocurrency. Transaction IDs (hashes), the wallet addresses you sent funds to and from, the name of the exchange or wallet service you used, withdrawal confirmation emails, and screenshots of the platform where you were told to send funds. A transaction hash is the single most useful item: it lets anyone verify the transfer on the public blockchain.
E-wallets and payment apps. Transaction records inside the app, the recipient's username or handle, linked email addresses or phone numbers, and the in-app conversation if one exists. Export these promptly; some apps limit how far back you can view history.
Across every payment type, also preserve the surrounding communication: emails, chat threads, phone numbers, social-media profiles, job adverts, investment brochures, contracts, and identity documents you were shown. Context is evidence too.
Capturing screenshots properly
A good screenshot answers three questions: what was shown, where it was shown, and when. To get all three:
- Capture the full screen, not a cropped section, so the browser address bar and the page are visible together.
- Make sure your device's date and time are visible where possible.
- For long pages or chat threads, take overlapping screenshots from top to bottom, or use your browser's full-page capture feature.
- Photograph a second device's screen only as a last resort — a native screenshot is clearer and carries file metadata.
Screenshot entire conversations, not just the incriminating lines. A message taken out of context is easier for the other side to dispute.
URLs, email headers, and hashes
Some of the strongest evidence is plain text, and it is easy to miss.
Web addresses. Copy the complete URL from the address bar and paste it into a text file. Do not rely on the screenshot alone; long addresses get cut off, and the exact address helps investigators link cases.
Email headers. Every email carries hidden routing information — the full header — that can indicate where a message really came from. Most email services have an option such as "Show original" or "View source". Save the complete text, not just the visible message.
Transaction hashes. For cryptocurrency, copy each transaction ID as text and record which payment it belongs to. Verify that the hash resolves on a public block explorer, then save a screenshot of that page as well.
Originals first, annotations never
Keep every original file exactly as captured. Do not crop, highlight, circle, or add text to it — an edited image invites the question of what else was changed, and some review processes may give altered files less weight.
If you want to point something out, make a copy, annotate the copy, and keep both, clearly named. A simple naming pattern works well:
2026-06-02_website-dashboard_original.png2026-06-02_website-dashboard_annotated.png
The same rule applies to documents: never retype a contract or a bank letter when you can keep the file or a photograph of the original.
Store it with redundancy
One copy is no copy. Keep your evidence in at least two independent places — for example, a folder on your computer plus a reputable cloud storage service, or a USB drive kept somewhere safe. If your device was compromised during the fraud (for instance, if you installed remote-access software at someone's request), make your backup copy from a clean device.
Organise the folder simply: one subfolder per category (payments, communications, website captures, official reports), with dated filenames. You will hand this material to your bank or the police more than once; being able to find things quickly reduces stress and delays.
Chain-of-custody thinking for civilians
Police and courts use the phrase "chain of custody" to describe an unbroken, documented record of who handled evidence and when. You do not need a forensic laboratory to borrow the idea. Keep a plain evidence log — a simple text file or spreadsheet — recording for each item:
- what it is,
- when and how you captured it,
- which device you captured it on, and
- where copies are stored.
Add a line whenever you share material with your bank, the police, or an adviser, noting the date and the reference number of the case. This log costs minutes to maintain and makes your file markedly easier for any official body to work with.
What not to do
- Do not delete anything, even messages that embarrass you. Gaps weaken a file.
- Do not go back to the scammers to "collect more evidence". Renewed contact risks further manipulation and further loss.
- Do not assume a platform will keep records for you. Report content to the platform after you have captured it, since reported accounts are often removed.
- Do not share your evidence file publicly while a dispute or report is active; discuss disclosure with the body handling your case.
Good evidence does not guarantee any particular outcome — no honest person can promise that. What it does is keep every legitimate option open, and it lets the institutions that can act, act on solid ground.
This article is educational information, not legal or financial advice. For decisions about your specific situation, contact your bank, the police, your national regulator, or an independent lawyer.