After a scam, the instinct is to delete everything and try to forget. Resist it. The messages, receipts and account details you still have are what your bank, platform and police need to act, and they are easiest to collect in the first hours, before chats vanish, accounts are deleted or you lose track of what happened when.
What to Save, and Why It Matters
| Evidence | What to capture | Who uses it |
|---|---|---|
| Payments | Transaction or reference IDs, amounts, dates and times, recipient account, UPI ID or wallet address, bank statement lines, receipts | Bank, card issuer, police |
| Messages and chats | Screenshots of the whole conversation, plus an export if the app offers one | Police, platform |
| Identity of the scammer | Phone numbers, profile names and profile links, email addresses, usernames, company names claimed | Platform, police |
| Emails | The original message with full headers, not only a screenshot | Email provider, investigators |
| Websites and ads | The full web address as text, screenshots showing the address bar, the ad or post that led you there | Platform, hosting abuse teams |
| Calls | Call-log screenshots with numbers, times and durations; notes of what was said | Carrier, police |
| Your device | Names of apps installed at the scammer’s request, any files downloaded, remote-access tools used | Security professionals, police |
How to Capture It Well
- Screenshot the whole screen. Show the contact name or number, the date and time if displayed, the full message and, for websites, the address bar. Scroll and capture the entire thread, not just the worst message.
- Copy identifiers as text too. Paste phone numbers, profile links, account numbers and wallet addresses into a note, because a typo in a hand-copied number can make a report useless.
- Export what can be exported. Many messaging apps include an option to export a chat. Email programs let you open the original message source; in Gmail, “Show original” displays the full headers. Save these files unchanged.
- Record each payment precisely. From your banking app or statement, note the reference number, the exact date and time, the recipient details and how you paid. Download the statement as a PDF if possible.
- Build a timeline. Write down, in order: how the scammer first contacted you, what they said, what you did, what you paid and when. Include times as best you remember them and mark anything uncertain.
- Store copies in two places. Keep one on your device and one somewhere separate, such as an email to yourself or an external drive, so closing an account or losing a phone does not lose it.
A Simple Incident Timeline
A short, factual log is more useful than a long emotional account. Use something like this (illustrative values only):
12 Oct, 6:40 pm — Received text from +00 000 000 0000 claiming my courier parcel was held; link to a web address (copied below).
12 Oct, 6:46 pm — Entered card number and the code that arrived by SMS on that page. 6:52 pm — Bank alert for a payment I did not make; reference ABC123 (fictional).
12 Oct, 7:05 pm — Called the number on the back of my card, blocked the card, filed a dispute (case number noted). 7:30 pm — Saved screenshots and the text; did not click the link again.
What Not to Do
- Do not delete chats, emails or apps before you have saved evidence — but do uninstall a malicious or remote-access app once you have recorded its name.
- Do not crop, annotate or filter screenshots; save an unedited original and make a marked-up copy separately if you want to point things out.
- Do not keep talking to the scammer to “collect proof.” It risks further loss and rarely adds anything you do not already have.
- Do not open malicious links again to take screenshots; copy the address as text and capture where you found it.
- Do not pay anyone who offers to “retrieve” evidence or funds. Genuine reporting channels are free; see The Scam After the Scam.
- Do not wipe or factory-reset the device before reporting if you suspect it was compromised; ask the police or a reputable security professional whether to preserve it first.
Who Needs What
- Your bank or card issuer needs transaction details and a clear time of events. Call first through an official number.
- The platform (social network, marketplace, email provider) needs the account links and messages to remove accounts and warn others.
- National authorities need your timeline, payment details and identifiers. India: cybercrime.gov.in and helpline 1930. United States: reportfraud.ftc.gov and ic3.gov. Elsewhere, your national police cybercrime unit.
Rules about what counts as admissible proof, and about recording phone calls, vary by country and sometimes by state. Do not record calls unless you know the rules where you live; written records and call logs are safer. Evidence helps, but it does not guarantee a result — investigators and banks decide what they can do.
If you are still working out what to do first, start with Been Scammed? What to Do in the First Hour, and for account-specific steps see Account Hacked? What to Do and what to do after sharing an OTP.
Key Takeaways
- Preserve before you delete: unedited screenshots, text copies of identifiers, exports and original emails.
- Record payments exactly, with reference numbers, amounts, dates and times.
- Write a short timeline while memories are fresh.
- Keep copies in two places and do not keep engaging the scammer.
- Report through official channels only; reporting is free.
Keep a record of the suspicious message
If something looks wrong, screenshot it first, then scan the text or screenshot with ScamSense for a risk assessment. It is an extra check, not a guarantee — keep the original for your report.
Start 3-Day Free TrialFrequently Asked Questions
Should I delete the scam messages?
Are screenshots enough?
Should I confront the scammer to get more proof?
Can I record a phone call with a scammer?
How long should I keep the evidence?
What if I already deleted some messages?
Note: This guide is general information, not legal or financial advice. Procedures, deadlines and refund rights differ by country, bank and payment method. Always use contact details from your bank’s official app, website or the back of your card. ScamSense helps you assess suspicious content but cannot guarantee that any message, link or caller is safe or unsafe.