Digital Evidence Checklist for Suspected Online Fraud

Well-organized evidence helps you explain what happened without relying on memory alone. Preserve original records where possible, avoid altering files, and document how and when evidence was collected.

Preserve communications

• Keep original emails with headers when possible, chat exports, SMS messages, and relevant attachments.
• Record account names, profile links, email addresses, phone numbers, and message dates.
• Take screenshots that include useful context, but do not rely on screenshots as the only copy.

Record financial and transaction details

Save receipts, bank or exchange statements, payment references, wallet addresses, transaction hashes, amounts, currencies, and timestamps with time zones where known.

Capture online identifiers

Record full website URLs, suspicious domain names, profile URLs, app names, and visible account IDs. Do not revisit dangerous links on a device you suspect is compromised.

Maintain a simple evidence log

For each item, note its filename or description, collection date, source, collector, and any transfer or storage action. Keep a separate copy in a secure location and restrict access to people who need it.

Protect devices and accounts

If you suspect malware or account compromise, use a trusted device to change credentials, enable multifactor authentication, and review sessions. For a serious incident, seek qualified incident-response help before wiping or resetting a device if evidence may be needed.

Avoid risky investigation

Do not break into accounts, impersonate people, access private records, or alter data. Preserve what you lawfully control and let authorized professionals or authorities handle requests for restricted records.

Important: This guide is general educational information, not legal or financial advice. Outcomes depend on the facts and applicable law; no recovery or security result is guaranteed.