Preserving Evidence of Online Fraud: What to Save and How to Keep It

If you have just realized you were scammed, or someone has taken over one of your accounts, it is hard to think clearly. But what you save in the next few hours often decides how much help you can get later. Scammers delete their profiles, chats can disappear, platforms remove reported accounts, and banking apps only show recent history. Your bank, the platform, and agencies like the FTC and the FBI will all want to see what happened, and they rely on the record you keep.

The short answer: save before you do anything else. Keep messages, emails, and payment records in their original form, take screenshots that show the web address and date, write a dated timeline, and log every report you make. Store the originals somewhere safe, and share copies only with your bank, the platform, or agencies you contact yourself.

Why a clear record matters

Evidence is what turns “I didn’t authorize this” into something a bank, platform, or investigator can act on. It matters in three places:

• Disputes with your bank or card issuer. You’ll need to show which transactions you didn’t authorize and when you found out. For debit cards and other electronic transfers, reporting within 60 days after the statement is sent protects you, and for a credit card billing dispute, your letter must reach the issuer within 60 days after the first bill with the charge (FTC; FTC).
• Platform reports. Screenshots and profile links show a platform exactly which account or message to look at.
• Government reports and investigations. The FBI’s Internet Crime Complaint Center (IC3) tells people “it is important that you keep any evidence you may have related to your complaint,” because an agency that opens an investigation may ask for it directly (IC3).

The types of evidence banks, platforms, and investigators ask for

Most online fraud leaves the same kinds of traces. This table shows what to look for and the best way to save each one.

Evidence	Why it matters	Best way to save it
Payment records	Shows what was taken, when, and how	Download statements and save confirmation numbers, transaction IDs, and receipts
Emails	The full header shows where a message really came from	Keep the original in your inbox and save the full header
Texts and chats	Shows what you were told and asked to do	Export the conversation if the app allows it; screenshot it as a backup
Web pages and profiles	Fake sites and profiles are often taken down quickly	Save as PDF and screenshot, including the web address
Call records	Links a phone number to the scam	Screenshot your call log and save voicemails
Account alerts	Shows when an account was taken over	Keep security and login alert emails; screenshot changed settings
Your timeline and contact log	Ties everything together for anyone reviewing it	Write it down now and add to it after every call or report

IC3’s own list of evidence to keep includes canceled checks, card, wire, money order, cryptocurrency, and prepaid card receipts, phone bills, copies of emails and web pages, and chat transcripts (IC3).

How to preserve evidence of online fraud, step by step

Step 1: Don’t delete anything, and stop engaging

It’s natural to want to delete messages from a scammer, but those messages are your evidence. Save them first. Then stop replying, and don’t send more money, codes, or personal information.

Watch for “recovery” offers. The FTC warns that some scams target people who have already lost money, promising to recover it for an upfront fee, and says government agencies and legitimate organizations “will never ask for money to help you get a refund” (FTC). Don’t send your evidence to anyone who contacts you offering to help.

Step 2: Capture what’s on screen

• Show the address and the time. Include the web address (URL) and, where possible, the date and time on screen. On a phone, note the date in your log if it doesn’t show.
• Capture the whole conversation, not just the worst message, so the context is clear.
• Don’t crop, mark up, or edit the originals. If you need to highlight something, make a copy and mark that up instead.
• Save whole web pages. Your browser’s Print → Save as PDF option keeps the full page, and most browsers print the page address in the header or footer.
• Copy profile links and usernames, not just display names, which can change. Our guide to a fake profile using your photos explains what platforms need.

Step 3: Save messages in their original form

Original files carry details that screenshots can’t, such as where an email really came from. IC3 asks for “printed or preferably electronic copies of emails,” noting that printed copies should include the full email header, and for chat transcripts (IC3).

• Emails: keep the original in your inbox and save the full header. In Gmail, open the message, choose More → Show original, then copy the text (Gmail Help). Other email apps have a similar “view source” or “show original” option.
• Texts and chats: use the app’s export or download option if it has one, and screenshot the conversation as a backup.
• Calls: screenshot your call log showing the number, date, and time, and save any voicemails.
• Hacked accounts: save security alerts and “new login” emails, and screenshot changes you didn’t make, such as a new recovery email or an email forwarding rule (FTC). See our guide to a hacked account with unauthorized charges.

Step 4: Collect payment records

Download records instead of relying on what your banking app shows today, since online history can change or roll off.

• Bank, card, and payment app statements showing the transactions
• Confirmation numbers, transaction IDs, and receipts, including wire, money order, and cryptocurrency receipts
• Gift cards and their receipts, if you paid that way. The FTC says to keep them because you may need them to follow up on your claim (FTC).
• Any account numbers, payment handles, or cryptocurrency wallet addresses the scammer gave you

Step 5: Write a timeline and keep a contact log

Write down what happened in order while you still remember it: when you were first contacted, what you were told, when you paid, and when you realized something was wrong. Then log every call, email, and report, with the date, who you dealt with, and any reference or case number. The FTC advises following up a phone report to your card issuer in writing and keeping a copy (FTC), and the CFPB suggests writing down the dates of follow-up calls and keeping everything together in one file (CFPB).

Our printable Digital Evidence Checklist includes a ready-made contact log and a checklist for each type of fraud.

Step 6: Store it safely

• Keep originals untouched and work from copies.
• Store everything in two places, such as a folder on your computer and a cloud backup or printed set, in case a device is lost or compromised.
• Use a secure account. If your email or cloud account was hacked, secure it before storing evidence there.
• Save before you reset. If a phone or computer was compromised, copy off the messages and records you need before resetting it, and don’t use it for banking in the meantime.
• Keep it until everything is resolved, including any dispute, investigation, or claim.

What evidence different online scams leave behind

Each type of fraud leaves its own trail. Here’s what matters most for the most common ones.

Payment app and bank transfer scams

Save the transaction ID, the recipient’s name, username, or phone number as it appears in the app, the time of each payment, and every message that led you to send it. If the scammer told you to send money to “protect” it, note exactly what they said. Our guide to when a bank denies a scam reimbursement request explains why that detail can matter.

Fake bank, company, or government calls

Screenshot the number that called you and the time, and write down the name and department the caller gave, what they asked you to do, and any “reference number” they used. If they sent texts or emails, keep those in their original form.

Investment and romance scams

These often run for weeks or months, so the full history matters. Export the complete chat, save the profile and any trading website as PDFs, and record every payment with its date, amount, and method, including cryptocurrency transaction IDs and wallet addresses. The FTC suggests a reverse image search of a romance contact’s profile picture to see whether it is associated with another name (FTC). Save the results.

Online shopping and marketplace scams

Save the listing or product page, the seller’s profile, your order confirmation, any tracking number, and every message with the seller. If you paid by credit card, keep the order details for your billing dispute.

Phishing and account takeovers

Keep the phishing email or text in its original form, with its full header, plus every security alert you received and screenshots of anything that changed in your account.

How your bank uses your evidence

For debit cards and other electronic transfers, federal rules set out how your bank handles a reported error:

• The bank generally has 10 business days to investigate after it receives your notice. It can take up to 45 days if it provisionally credits your account within those 10 business days.
• It must report the results within 3 business days after finishing its investigation.
• If you reported by phone, the bank can require written confirmation within 10 business days, and it must tell you so when you call.

Source: 12 CFR 1005.11. For credit cards, the issuer must acknowledge your written dispute within 30 days and resolve it within 90 days (FTC). A clear timeline and copies of the key messages make that investigation easier, and give you something concrete to point to if you ask the bank to reconsider.

A one-page fraud summary to bring to every report

Banks, platforms, and police all ask the same questions. Writing the answers once saves time and keeps your story consistent.

Who to give your evidence to

Where you report	What to have ready
Your bank, card issuer, or payment app	Statements, transaction IDs, dates, and when you first noticed the problem. Follow up in writing.
The platform (social media, email, marketplace)	Profile links, usernames, screenshots, and messages.
FTC, at ReportFraud.ftc.gov or IdentityTheft.gov	Your fraud summary: what happened, dates, amounts, and how you paid.
FBI Internet Crime Complaint Center (ic3.gov)	The details, typed or pasted in, such as email headers. IC3 doesn’t accept attachments, so keep the originals.
Local police	Your timeline, payment records, and copies of key messages, especially if you were threatened.

Report scams to the FTC at ReportFraud.ftc.gov, identity theft at IdentityTheft.gov, and internet crime to the FBI at ic3.gov.

What not to do

• Don’t edit or “clean up” original files. Changed evidence is harder for anyone to rely on.
• Don’t confront the scammer or try to get your money back yourself. It rarely works and can expose you to more fraud.
• Don’t post your evidence publicly. Screenshots often include your account numbers, address, or other people’s details.
• Don’t pay anyone to recover your money. That’s a common follow-up scam (FTC).

If someone opened accounts in your name, see our first steps after identity theft, and consider a credit freeze or fraud alert.

Frequently asked questions

Are screenshots enough evidence of online fraud?

They help, especially when they show the web address, date, and time. But keep the originals too, such as the full email with its header, exported chats, and downloaded statements, because they contain details screenshots don’t.

Should I send my evidence to the FBI’s IC3?

No attachments. IC3 doesn’t accept them. Type or paste the key details into your complaint, such as email headers, and keep the originals somewhere safe in case an investigating agency asks for them.

What if the scammer already deleted the messages?

Save whatever is left, such as notifications, call logs, payment records, and your own sent messages, and write down what you remember with dates. Your bank and the platform may also have records.

What evidence does my bank need for a fraud dispute?

Statements showing the transactions, transaction IDs, the dates you noticed and reported the problem, and the messages or calls that led to the payment. If you reported by phone, your bank may ask you to confirm in writing within 10 business days.

Should I reset my phone or computer after a scam?

If you think a device is compromised, stop using it for banking and get help securing it, but copy off the messages and records you need first.

How long should I keep evidence of a scam?

Keep it until every dispute, report, and investigation connected to it is fully resolved. If you’re unsure, keep it.

Should I share my evidence with a company that offers to recover my money?

No. The FTC warns that recovery scams target people who have already lost money. Legitimate organizations and government agencies won’t charge you to help get a refund.

Sources

• FBI Internet Crime Complaint Center, Frequently Asked Questions
• Federal Trade Commission, What To Do if You Were Scammed
• Federal Trade Commission, Refund and Recovery Scams
• Federal Trade Commission, How To Recover Your Hacked Email or Social Media Account
• Federal Trade Commission, Lost or Stolen Credit, ATM, and Debit Cards
• Federal Trade Commission, Using Credit Cards and Disputing Charges
• Federal Trade Commission, What To Know About Romance Scams
• Regulation E, 12 CFR 1005.11 (procedures for resolving errors)
• Consumer Financial Protection Bureau, How do I dispute a charge on my credit card bill?
• Gmail Help, Trace an email with its full header

This guide is general information, not legal advice. Read how we research and update our guides in our Editorial Standards, and see our Corrections Policy to report an error. More coverage: Scams & Fraud.