When a scam is discovered, people often focus only on stopping the payment. That is important, but the messages, account details, transaction records and device activity can also matter if the incident needs to be investigated later.
First priority: stop further loss
Contact the bank, card provider or payment service using an official channel. If credentials may have been disclosed, secure the affected accounts from a trusted device and enable multi-factor authentication. Do not continue engaging with the suspected scammer in an attempt to recover funds yourself.
Preserve the digital trail
Keep the full message thread, emails, attachments, usernames, phone numbers, profile links and payment references. Screenshots are useful, but original emails and messages can contain technical information that screenshots do not preserve.
Record what happened
Write a short timeline while events are fresh: how contact started, what was requested, what was sent, when payments were made, and what action you took afterwards. Small timing details can become important when comparing messages, transactions and account activity.
Avoid unnecessary changes
Do not wipe the phone, clear conversations, delete suspicious apps or reset the device unless there is a pressing security reason. If a forensic review may be required, unnecessary changes can remove or overwrite useful evidence.
- Full message and email threads
- Phone numbers, usernames and profile URLs
- Invoices, bank details and payment references
- Original attachments and files
- Login or security-alert emails
- A written timeline of events
- Deleting conversations after taking one screenshot
- Installing remote-access software suggested by the scammer
- Warning the suspected scammer that evidence is being preserved
- Using links or phone numbers supplied in suspicious messages