Preserving records after a suspected scam
Keep original communications and transaction records in context.
Preserve the original context
Keep the original files, messages, emails with headers, platform correspondence and payment confirmations. Record the exact website or profile used. Screenshots can supplement the originals, but should not replace the underlying records when those remain available.
Organize a dated chronology
Create a simple timeline of contact, representations, deposits, withdrawal requests and later demands. Distinguish a confirmed date from an estimate. Keep transaction hashes and wallet addresses exactly as recorded. A similar name or partially copied address may identify the wrong party.
Share records deliberately
Do not send passwords, seed phrases, private keys or verification codes. Limit the initial enquiry to a concise account. Preserve sensitive originals securely and ask for an appropriate sharing route before transmitting further evidence.
Official reference
The IC3 FAQ explains its evidence guidance. This guide is general information and does not determine the legal steps for an individual matter.