Last updated: November 05, 2026

Key Takeaways

• A scam evidence packet is the smallest set of records that lets another person trace the scam without guessing.
• Save screenshots that prove identity, contact, and request before anything disappears.
• Keep the full chat log with timestamps, sender names, and message order intact.
• The payment receipt is the most important proof because it ties the scam to one transaction, amount, and destination.

Quick Answer

Save 5 core items before you report a scam: screenshots, the chat log, the payment receipt, the email header if email was involved, and the URL or profile details. Those five records usually give investigators enough context to trace what happened without guessing.

Save a scam evidence packet before you file the report. The packet should hold the screenshots, payment receipt, email header, chat log, and URL that show who contacted you, what they asked for, and what changed after you sent money or information. In the topic of What Evidence to Save Before You Report a Scam, the goal is to keep the original records together before they disappear.

What belongs in a scam evidence packet?

A scam evidence packet is the smallest set of records that lets another person trace the scam without guessing. Start with the message, the money trail, and the place where contact happened. If those three pieces are missing, a report turns into a story with no proof.

The core items are simple: screenshots of the conversation, the transaction receipt, the full message export, the email header if email was involved, and the profile URL or website URL tied to the scammer. Keep each item in its original form when possible. A screenshot shows what you saw on the screen at one moment. A receipt shows the payment method and reference number. A message export can preserve timestamps that a screenshot trims off. A header can reveal routing details that the visible email body hides.

Do not wait until after you report to gather this. Once you block, delete, or mute someone, you can lose the thread order, profile name, and contact details that make the packet useful. A report filed with only a vague memory often gets stuck in follow-up questions.

What this packet is not: a place to write your whole life story. If the scam involved a gift card, wire transfer, or bank transfer, keep the focus on the exact transaction, the exact account, and the exact messages around it. If the scam involved identity details, save the evidence first, then think through the next steps with a qualified professional if needed.

The point is to preserve the facts in the form they appeared, not to interpret them. That is why the packet matters more than a single screenshot.

What screenshots should I save first?

Save the screenshots that prove identity, contact, and request before anything disappears. The first captures should show the scammer’s profile, username, phone number, email address, website page, or payment request as it appeared on the screen. If the conversation spans multiple screens, capture the thread in order so the reader can follow the setup, the ask, and the payoff.

Here is the order that usually works best:

1. Capture the profile or sender details first. Take a full-screen screenshot of the profile page, sender card, or email summary line. The result should show the display name, handle, number, or address exactly as it appeared.
2. Save the message that introduced the scam. Screenshot the first pitch, offer, warning, or claim. If the scam started with a 2-factor code request, a “refund” offer, or a fake support message, that opening line is often the strongest clue.
3. Capture the payment demand. Save the screen where the scammer asks for a bank transfer, card payment, gift card code, crypto transfer, or login code. The result should show the amount, destination, or instructions.
4. Screenshot every payment confirmation. Include the confirmation page, pending status, reference number, or digital wallet confirmation. If the page refreshes after 30 seconds, save it before it changes.
5. Capture the last contact before the block. If the scammer threatens, stalls, or disappears, preserve the final message on the same day.

Do not crop away names, timestamps, or URLs. Cropping saves space and loses context. Do not edit the image to “clean it up.” A report can use an ugly screenshot; it cannot use a polished image that hides the original details. If the conversation is long, take overlapping screenshots so there is no gap in the chain.

A practical rule: if a detail could help connect one message to another, save it now. You can sort it later.

How do I preserve a chat log as evidence?

Preserve the full chat log by exporting it or saving it in a way that keeps timestamps, sender names, and message order intact. A plain screenshot is useful, but a text export or PDF is often stronger because it shows the whole thread, not just one or two frames.

If the app offers an export chat or download conversation option, use that first. Choose the format that keeps date and time stamps visible, such as a PDF, TXT, or HTML export. If the platform lets you export from a settings menu, do it before deleting the app or clearing data. Save the file with a clear name like 2026-10-25_chat_export.pdf so you can find it later.

If there is no export tool, build a manual record:

• Scroll through the conversation slowly and take screenshots in sequence.
• Keep each image anchored to a date or time marker when the app shows one.
• Include the sender name, profile photo if visible, and any files or voice notes attached to the thread.
• Save the media files separately if the app lets you download them.

A chat log matters because it proves pattern, not just content. A single “send money now” message may look isolated. A 20-message thread can show pressure, urgency, impersonation, or repeated requests for payment codes. That context is often what turns a weak report into a useful one.

Do not rely on memory once the thread is gone. Screenshots can miss deleted messages, edited texts, and replies that came between two images. Do not assume the platform keeps everything forever. Many services limit what a user can recover later, and some views stop showing older posts after a thread is removed. Save the record while the thread is still open.

If the scam happened over SMS, email, direct messages, or a marketplace inbox, use the same rule: preserve the thread in the native app first, then back it up somewhere separate.

What payment proof matters most?

The payment receipt matters most, because it ties the scam to a specific transaction, amount, and destination. Save every record that shows money leaving your account or a payment being requested, even if the payment did not complete.

Keep these items together:

• Receipt or confirmation page
• Transaction reference or confirmation number
• Amount and currency
• Date and time
• Recipient name, account, wallet address, or merchant descriptor
• Partial card number if visible on the statement
• Bank transfer details, ACH reference, wire reference, or wallet hash if available

If you paid by card, keep the receipt and the statement line. If you paid by transfer, keep the transfer confirmation and any bank-generated reference. If you paid with a gift card, save the card photo, receipt, and any message where the code was requested. If the payment used crypto, save the wallet address, transaction hash, and exchange confirmation page. Each of those details can help match one payment to one scam path.

A generic “sent money” note is too weak. The actual receipt tells a report writer where the money went, when it moved, and how it was sent. That is why the receipt belongs in the packet even if the amount was small. A $25 transfer and a $2,500 transfer are handled differently in practice, but both need proof.

Do not delay while you wait for a statement cycle. Many apps and banks show a receipt immediately, but some details disappear from the front end after the transaction posts. Save the PDF, take a screenshot, or download the record as soon as it appears.

One caution: do not write the full card number or account number into a plain text note if you can avoid it. Store the original receipt file instead. If the packet will be shared, redact anything not needed for the report while keeping the transaction reference visible.

Which URLs, headers, and profile details should I keep?

Keep the exact URL, the profile page, and the full email header because those details help show where the scam came from. A display name alone is easy to fake. The link behind it is harder to ignore.

Save the following:

• The full website URL where the scam offer appeared
• The profile URL for the account or seller
• The landing page URL if the scam led to a form or checkout page
• The email header, not just the visible sender line
• The message permalink if the platform provides one
• The exact domain name, including misspellings and extra words

If you are dealing with email, open the message source or “show original” view and save the header as text or PDF. The visible “From” name can be misleading; the header carries the routing and authentication trail that the inbox hides. If the scam arrived through a social or marketplace profile, copy the profile URL and save a screenshot of the page before it changes. If there is a phone number involved, keep the number as shown in the thread or caller log.

The web address matters in a different way. Scam pages often move, redirect, or vanish quickly. A screenshot shows the page layout; the URL shows the exact location. Save both. If the page has query strings, short links, or a cloned brand name in the path, keep the full string exactly as it appears.

Do not trust a homepage if the scam happened on a specific product page, checkout page, or login page. The route matters. A report that names the wrong URL can point investigators away from the source instead of toward it.

This is one of the few places where a tiny detail can matter a lot. A missing hyphen, subdomain, or email domain can be the difference between a useful lead and a dead end.

How should I organize the packet before I report?

Organize the packet into a single folder with a timeline so a reporter can follow the scam in under 5 minutes. Keep the order simple: contact, request, payment, aftermath. That sequence makes it easier to explain what happened without hunting through 40 loose files.

A clean structure looks like this:

• Folder 1: profile screenshots and URLs
• Folder 2: chat log or message export
• Folder 3: email header or email source files
• Folder 4: payment receipt and transaction proof
• Folder 5: follow-up messages, blocks, or deletion notices

Name files clearly. Use the date first, then the type of evidence, then a short label, such as 2026-10-25_screenshot_profile.png or 2026-10-25_receipt_transfer.pdf. That naming style keeps files in order even if they move between devices.

Before you send anything, check three things:

1. The timestamps line up across screenshots, messages, and receipts.
2. The names match across the chat, the payment destination, and the URL.
3. The packet shows a sequence, not a pile of random images.

If something is missing, make a note now. For example, “No export available from app” or “Profile deleted after capture.” That note can save a reviewer time later. Do not rewrite the facts to make them prettier. A gap noted honestly is better than a gap disguised as certainty.

Store a copy in two places if you can, such as a local folder and a secure backup, and if you are unsure how to do that safely, consult a qualified professional or your bank’s guidance on secure record keeping. If one device fails, the packet should still exist. For a report that may be reviewed by a bank, platform, or investigator, a tidy file set is easier to use than a long explanation. See also the FTC’s advice on reporting fraud and keeping records, and your bank’s own fraud guidance.

This page supports the broader scam reporting and recovery paths hub, but the job here is narrower: build the evidence file first. For related next steps, see how to report a scam and what to do after a scam payment.

What should I avoid saving, and what is a common mistake?

Avoid saving only one screenshot, because a single image often leaves out the chain that makes the scam clear. A lone picture can show a request, but not the lead-up, the payment, or the follow-through. That costs you context and can slow the report.

Common mistakes include:

• Cropping out timestamps. That hides the sequence and can make the evidence harder to verify.
• Deleting the thread too soon. That can erase the exchange and leave you without the full record.
• Saving only a screen recording. Video can help, but it is awkward to search and hard to quote.
• Relying on memory for URLs or handles. Small spelling differences matter.
• Putting all evidence in a notes app with no backups. If the phone is lost or reset, the packet is gone.

What to do instead: keep the original file types when you can, save the material before blocking or deleting, and preserve the exact spelling of names, domains, and references. If the scam used a cloned brand or impersonation account, capture the profile before it disappears. If the app shows a date stamp, keep it visible. If the bank or payment app offers a downloadable receipt, save that file, not just a screenshot of it.

One honest limitation: not every piece of evidence will be available in every scam. Some platforms hide headers, some apps delete messages, and some payments cannot be reversed into a clear receipt. When that happens, save whatever the system still shows and make a note of the missing piece. A partial packet is still better than nothing.

If the scam involved sensitive personal data, the evidence packet can become sensitive too. Keep it private and share it only with the recipient who needs it. A report works best when the packet is complete, readable, and trimmed to the facts that matter.

What screenshots should I take before deleting anything?

Take the screenshots that show the scammer, the request, and the payment trail before you clear the app. Start with the profile or sender details, then the key message, then any payment screen or receipt. If the thread has dates, usernames, or URLs, keep those visible. Cropping them out makes the record less useful.

How do I preserve a chat log as evidence?

Use an export feature if the app has one, because it preserves message order and timestamps better than a few pictures. If there is no export, take overlapping screenshots from top to bottom and save the files in sequence. Include sender names, dates, and any attachments so the thread still makes sense later.

Do I need the scammer’s email address or phone number?

Yes, if you have it, save both the email address and the phone number exactly as shown. Those details can be changed or masked later, but the original contact info helps connect the thread, the profile, and the payment trail. If you only have one of them, keep that and the message source that shows how the contact started.

Drafted with AI; not yet reviewed by a person.

Admin