How to preserve evidence of an investment scam
Build a usable fraud evidence pack with payment records, original messages and a timeline while avoiding oversharing and altered files.
Keep original payment records and communications, export chats where possible and make a dated timeline. Preserve the exact website and recipient details. Share copies through verified secure channels, not public posts. A clear evidence pack is more useful than hundreds of unlabelled screenshots.
Evidence preparation should support urgent reporting, not delay it. Call the bank or exchange first if another payment or account takeover may still be stopped. Then organise the records so someone unfamiliar with the situation can understand what happened.
You do not need specialist forensic software for a first report. The aim is to preserve reliable originals, connect the representations to the payments and identify what is known versus what still needs investigation.
Save originals before creating a summary
Download statements and receipts from the real payment provider. Export conversations using the app’s available function, and retain emails with their original details where possible. Screenshots are helpful, but a cropped image can remove the sender, timestamp or surrounding explanation.
Keep an untouched copy of each original and use copies for annotations. Note when and how you obtained material. Do not rewrite a conversation to make it clearer, and do not delete messages that appear inconvenient; a complete sequence is easier to assess.
Connect promises, identities and payments
For each transfer, identify the message or instruction that led to it. Save the recipient details exactly as supplied, including any unrelated company name or changed wallet address. Record the website URL, profile username, email address and phone number used by the person contacting you.
Capture any claims about authorisation, guaranteed returns, early withdrawals or release fees. Save the registration number they quoted without assuming it belongs to them. A copied genuine firm number can itself be evidence of impersonation.
Write a timeline and loss ledger
Use a simple sequence: first contact, investment pitch, account opening, each payment, withdrawal attempt, additional fee demand and discovery. Approximate dates should be labelled approximate. Keep direct quotations separate from your recollection of a call.
In a payment ledger, list real money sent, genuine money returned and the currency. Keep fictitious dashboard profits in a separate field. Avoid adding amounts in different currencies without explaining the conversion method. Your bank or investigator needs to see the underlying transactions, not just one headline loss figure.
Share deliberately and keep a backup
Store a backup somewhere the suspected scammer cannot access. If your device is compromised, use a trusted device or qualified assistance rather than continuing to handle sensitive evidence on it. Use official police, bank or regulator submission channels and follow their attachment instructions.
Redact unrelated personal details in public warnings and general inquiries. Never include passwords, one-time codes, private keys or seed phrases. Maintain a record of what you submitted, to whom, and the case reference so later updates can be connected to the same matter.
A short checklist
- Keep untouched originals and a backup.
- Export chats and save complete emails where available.
- Link each payment to its instruction.
- Write a dated timeline and currency-aware ledger.
- Submit securely and retain reference numbers.
Common questions
Should I keep a fake certificate?
Yes, as evidence of what you were shown. Label it as an unverified document rather than evidence that the company was genuinely authorised.
Can I delete the app once I have screenshots?
First check whether you can safely export relevant records. Removing remote-access or malicious software may be urgent; get security help if necessary. Do not postpone protecting your accounts just to preserve a screen.
References
- What to do if you are a victim of fraudCanadian Anti-Fraud Centre · Canada
- Cryptocurrency investment fraudFederal Bureau of Investigation · United States; international scam patterns
- Clone firms and individualsFinancial Conduct Authority · United Kingdom
- What to do if you've been scammedASIC Moneysmart · Australia
- How to recognize and avoid phishing scamsFederal Trade Commission · United States; security guidance
