How to Preserve Evidence After a Scam
Scammers delete messages and accounts fast. Here is what evidence to save after a scam, how to capture it properly on a phone or computer, and how to store it safely.
After a scam, the natural reaction is to delete everything and never look at it again. Please wait. The messages, numbers and receipts are exactly what your bank, the police and the platform need to act, and scammers often delete their side of the conversation within hours. A few minutes spent saving evidence now can make a real difference to your claim.
Save first, block second. On some apps, blocking, reporting or deleting a chat removes the messages or hides the scammer's profile. Capture everything before you do any of those.
What to keep
Think of it as answering four questions: who contacted you, what they said, what you did, and where the money or information went.
| Evidence | Why it matters |
|---|---|
| The scammer's contact details: phone numbers, email addresses, usernames, profile links | Lets platforms remove the account and lets investigators link your case to others. |
| The messages themselves, from the first contact to the last | Shows how the scam worked and what you were told. Banks look at this when deciding claims. |
| Website addresses and adverts | Fake shops and login pages can be reported and blocked. |
| Payment records: transaction references, receipts, the account, wallet or card you paid to, and dates and amounts | The single most important evidence for stopping or disputing a payment. |
| Call logs with dates, times and durations | Confirms when you were pressured and by which number. |
| Anything you were sent: documents, "contracts", fake receipts, QR codes | Fake paperwork is often reused across many victims. |
| Your own notes of what happened, written while it is fresh | Memory fades quickly under stress. A timeline helps every report you make. |
How to capture it properly
Screenshots on a phone
- Make sure each screenshot shows the sender's number or name and the date or time. Scroll to show the date divider in the chat if the time alone is shown.
- Open the scammer's profile and screenshot that too, including the number or username.
- Capture the whole conversation in order, even the friendly early messages. They show how trust was built.
Exporting a chat
Many messaging apps let you export a conversation as a file. In WhatsApp, for example, open the chat and look for "Export chat", which is under the contact's name on iPhone and under the menu and "More" on Android. An export keeps the full text with dates and times, which is more complete than screenshots. Save it somewhere you control, not only on the phone.
Emails
Do not just screenshot a scam email. Keep the original in a folder, and if you can, save it as a file (many email apps offer "download message" or "show original"). The hidden technical details, called headers, show where the email really came from. Report it as phishing afterwards, not before.
Websites
Screenshot the page with the address bar visible, and copy the full web address into your notes. Do not enter any more details on the site.
Payments
Download or screenshot the transaction from your banking or mobile money app, including the reference number, and keep any confirmation texts or emails. If you paid with a gift card, keep the physical card and the till receipt.
Write a simple timeline
While it is fresh, write down what happened in order. It does not need to be polished. For example:
- It shows exactly when control passed to the scammer and when you acted.
- Every report you make afterwards can be copied from it.
Where to store it
- Keep two copies: one on your phone or computer and one somewhere else, such as a cloud folder or a USB stick.
- Make sure the accounts holding it are secure. If your email or cloud account might be compromised, secure it before you store evidence there.
- Name files clearly, for example by date and what they show, so you can find them when someone asks.
- Keep everything until your claims are closed, and preferably for a year or more.
Who to share it with, and who not to
Share evidence with your bank or payment provider, the police or your national reporting service, the platform where the scam happened, and your employer if it involved work. Our country-by-country guide to reporting a scam lists where to go.
Do not share it with anyone who contacts you out of the blue offering help to get your money back. That includes people claiming to be lawyers, hackers or government "recovery units". They want your details and a fee.
Still deciding whether it was a scam? CyberWatch AI Scan can check a message or link for free. Save the evidence first either way.
Evidence is one part of the response. If you are still in the first hour, start with our first-hour checklist, and for the whole process read our complete guide on what to do if you have been scammed.
Frequently asked questions
Are screenshots enough evidence?
They are a good start, and banks and police accept them. Make sure each one shows the sender's number or username and the date and time. Where you can, also keep the original messages, emails or an exported chat, which carry more detail than an image.
Should I block the scammer before saving evidence?
Save the evidence first, then block. On some apps, blocking or reporting can remove the conversation or hide the other person's profile.
How long should I keep scam evidence?
Keep it until your bank claim, police report and any dispute are fully closed, and ideally for a year or more. Identity fraud in particular can resurface months later.
Can I send the evidence to a recovery company?
Only send evidence to your bank, the police, an official reporting service or the platform. Companies that contact you offering to recover money for a fee are very often running a second scam.
Sources
- What To Do if You Were Scammed, US Federal Trade Commission
- Suspicious email actions, UK National Cyber Security Centre
- How to block and report someone, WhatsApp Help Center
