Evidence that is complete, timestamped, and unaltered is the difference between a traceable case and an untraceable one. Capture it before anything else disappears.
The core rule
Never alter an original. Work from copies. Do not crop screenshots, edit exports, or "tidy up" a chat log. An investigator would rather have a messy complete record than a neat partial one, and altered material undermines the whole set.
Blockchain evidence
This is the most important category, because it is independently verifiable.
- Transaction hashes (TxIDs) for every payment you made — full string, copied as text, not typed from a screenshot.
- Your sending addresses and the destination addresses you were given.
- The exact chain and token for each payment. USDT on Ethereum and USDT on Tron are different assets with different trails.
- Date, time, and time zone of each transfer.
- Exchange records — if you bought crypto to send, export the full transaction history from that exchange as CSV.
Copy addresses and hashes as text. A single mistranscribed character makes a hash useless.
Communications
- Full-length screenshots of every conversation, including the top of the thread and the profile page of the counterparty.
- Native exports where possible — Telegram, WhatsApp, Discord, and most email clients support export. An export preserves metadata a screenshot cannot.
- Complete email headers, not just the body. In Gmail this is "Show original"; in Outlook, message properties. Headers carry the routing information that identifies real origin.
- Usernames, display names, phone numbers, and any handles used — including ones later changed.
- Voice notes, call logs, and video call records.
The platform itself
Fraudulent sites are taken down quickly, sometimes by the operators themselves.
- Save the full page (browser "Save page as → complete") for the dashboard, the terms, and the withdrawal policy.
- Screenshot your account balance, transaction history, and any fee demands.
- Record the exact URL, including subdomain — clone sites often differ by one character.
- Submit the URL to a public web archive so a timestamped independent copy exists.
- Note the app name and store link if a mobile app was involved.
Financial records
- Bank statements showing outgoing payments, with reference fields visible.
- Card statements and any chargeback correspondence.
- Wire confirmations, including the beneficiary name, bank, and country.
- Receipts from crypto ATMs, including the machine's location and operator.
Identity and access
- Copies of any identity documents you provided, and a note of when.
- A list of any credentials shared, and everywhere else those credentials were used.
- Details of remote-access software installed (AnyDesk, TeamViewer, and similar), and when.
Organise it
A tidy submission is processed faster. We suggest:
`
01-timeline.txt dated account, plain language
02-transactions.csv date, chain, asset, amount, from, to, txid
03-communications/ exports and screenshots, named by date
04-platform/ saved pages, screenshots, URLs
05-financial/ statements, receipts
06-reports/ police and regulator references
`
Integrity
If you can, record a SHA-256 hash of each file when you create it and keep the list separately. It demonstrates the files have not changed since collection. Our reporting portal records a hash of every file it receives automatically, and shows it on your case record.
Common mistakes that destroy evidence
- Deleting the conversation out of anger or embarrassment. Archive instead.
- Confronting the operator, which frequently triggers account deletion.
- Reinstalling the operating system on an affected device before it is examined.
- Losing the phone number attached to the accounts used.
- Relying on screenshots alone when a native export was available.
- Waiting. Every week reduces what remains available.
Submitting to us
Our reporting portal accepts images, PDFs, documents, spreadsheets, text logs, email files, and archives, up to ten files per submission. Files are stored outside the public web root, are retrievable only by authorised staff, and are hashed on receipt.
If your evidence exceeds the upload limits, submit the report first and reference the case number when we contact you to arrange a secure transfer.
This guide is general information, not advice on your specific case
Every case turns on its own facts. If you have been defrauded, submit a report for a free assessment, and report the matter to your national fraud authority as well.
Been targeted by something like this?
Submit your case for a free assessment. If recovery is unlikely, we will say so.