Resource
Digital Evidence Checklist
What to save after an account takeover, a payment scam, impersonation, or identity theft, so you can report it, dispute charges, and follow up with a clear record.
Before you start
- Save originals. Keep emails, files, and statements as they are. Make copies to mark up, not the originals.
- Store everything in one safe place, such as a folder on your computer and a printed copy.
- Keep a contact log from day one (template below).
- Don’t send your evidence to anyone who contacts you offering to help. Fake “recovery” services target fraud victims. Share it only with your bank, the platform, or official agencies you contact yourself.
For every situation: your contact log
Each time you call, email, or file a report, write down:
| Date and time | Who you contacted | How | Reference or case number | What they said or will do |
|---|---|---|---|---|
Follow up important phone calls in writing, and keep a copy.
Payment scams and unauthorized charges
- Bank or card statements showing the transactions
- Confirmation numbers, transaction IDs, and receipts for each payment
- Gift cards and their receipts, if you paid that way. The FTC says you may need them to follow up on a claim.
- Emails, texts, and chat messages with the scammer, saved as files where possible
- The scammer’s details: names used, phone numbers, email addresses, usernames, website addresses, and any account or wallet numbers they gave you
- Your dispute or fraud report to the bank or card issuer, with its date and case number
Deadlines matter
For debit card and other electronic transfers, report unauthorized transactions within 60 days after the statement showing them is sent. For a credit card billing dispute, your letter must reach the issuer within 60 days after the first bill with the charge. See our guide to a hacked account with unauthorized charges.
Hacked or taken-over accounts
- Security alerts and “new login” emails or texts
- Screenshots of changes you didn’t make, such as a new recovery email, phone number, or email forwarding rule
- Charges, orders, or ads placed from the account
- Messages sent from your account to your contacts
- Your reports to the platform, with dates and any case numbers
Impersonation and fake profiles
- The profile link (URL) and username
- Dated screenshots of the profile, its photos, and its bio
- Messages the account sent to you or to people you know
- Your original photos, or where you first posted them
- Report confirmations from the platform
See our guide on a fake profile using your photos.
Identity theft
- Credit reports showing accounts or inquiries you don’t recognize
- Letters, bills, or collection notices for accounts you didn’t open
- Your FTC identity theft report from IdentityTheft.gov
- A police report, if you filed one
- Copies of every dispute letter you send and every response you get
Choosing between a credit freeze or fraud alert? Our guide compares them.
Where to report
- Your bank, card issuer, or payment app, right away, for any money taken.
- The platform for hacked accounts and fake profiles.
- The FTC at ReportFraud.ftc.gov for scams, or IdentityTheft.gov for identity theft.
- The FBI’s Internet Crime Complaint Center at ic3.gov for internet-enabled crime. IC3 doesn’t accept attachments, so keep your originals in case an investigating agency asks for them.
About this checklist
This checklist draws on guidance from the Federal Trade Commission, the FBI’s Internet Crime Complaint Center, and federal rules on electronic transfers and credit card disputes. We review it when that guidance changes. See our Research & Methodology.
Sources
- FTC, What To Do if You Were Scammed
- FTC, Refund and Recovery Scams
- FTC, How To Recover Your Hacked Email or Social Media Account
- FTC, Lost or Stolen Credit, ATM, and Debit Cards
- FTC, Using Credit Cards and Disputing Charges
- FBI Internet Crime Complaint Center, Frequently Asked Questions
General information, not legal advice. Last checked: November 3, 2026