How to preserve evidence after a scam

If a website is part of the incident, save the exact URL before it changes or disappears. You can also run the ScamMark Website & Domain Risk Checker to capture current public technical signals, while remembering that its result is not a forensic record or a verdict.

Preserve what can disappear

Scam accounts, ads, websites and messages can be deleted quickly. Save the evidence that identifies who contacted you, what they claimed, what they asked you to do and where money or information went.

Useful items include:

• original emails and messages;
• full email headers when available;
• profile names and direct profile URLs;
• phone numbers and caller details;
• website URLs and the exact page used;
• screenshots showing the surrounding context;
• payment receipts and transaction/reference numbers;
• recipient account details or cryptocurrency wallet addresses;
• QR codes or payment instructions;
• order confirmations, invoices and contracts;
• dates and approximate times of calls or actions.

Build a short timeline

A simple chronological note is often more useful than a folder of unexplained screenshots. Record what happened, when, through which channel, what you did, how much was involved and who you contacted afterward.

Keep originals where possible

Do not crop away identifying details unless you are making a separate privacy-safe copy for sharing. Keep the original file or message if possible. If you need to redact personal information before sending something to a third party, preserve an unredacted original privately.

Protect sensitive evidence

Evidence may contain account numbers, IDs, addresses, intimate messages or authentication information. Store it securely and share only what a legitimate bank, platform, regulator, lawyer or law-enforcement contact actually needs.