How to organize evidence after an online scam

Step 1

Write a short incident summary

Start with five facts:

• what happened;
• when contact began;
• when money or information was sent;
• how much was lost; and
• how the problem was discovered.

Use plain language. Separate what you directly observed from what you later inferred.

Step 2

Build a chronological timeline

Record one event per line. Include the date and time, communication channel, account or phone number used, what was requested, what you did, and what happened next.

Do not edit original messages to make the timeline look cleaner. Keep originals and use the timeline as an index.

Step 3

List every transaction separately

For each payment, record:

• date, time, amount, and currency;
• payment method;
• safe sending and receiving account labels;
• transaction, receipt, or confirmation reference;
• the provider contacted afterward; and
• case number, response, and follow-up date.

Step 4

Preserve original evidence

Keep receipts, emails, message exports, screenshots, web addresses, phone logs, account names, and technical records in their original form when possible.

Create an evidence index that says what each file is, where it is stored, when it was created or received, and which timeline event it supports. A clear list is easier to review than an unstructured folder of screenshots.

Step 5

Track every report and contact

Record the organization, date, channel, person or department, report or case number, requested action, response, and next follow-up date.

The IC3 complaint information asks for identities, financial-loss and transaction details, subject information, and a description of what happened. A single organized record reduces repeated reconstruction.

Step 6

Keep official help first

These government resources are free. A private organizer should not replace them or promise a recovery result.

• FTC: What To Do if You Were Scammed
• FTC: ReportFraud
• FBI IC3: Complaint information and FAQ
• IdentityTheft.gov: Recovery plan