How to Preserve Digital Evidence After a Scam

Guia informativo · Leitura aproximada: 6 minutos

Immediately stop interacting with the suspected scam and preserve original communications and receipts without altering them. Contact your platform, bank or local authorities and seek an authorized digital forensics provider if needed.

Immediate actions to contain damage

As soon as you suspect a scam, stop interacting with the sender and avoid following any links, providing further information, or sending money. Preserving evidence begins with preventing additional changes to messages, accounts or devices.

Do not delete original messages, emails, receipts or browser history. If anyone else’s device, account or system is involved, obtain written authorization from the account or device owner before taking action or accessing those resources.

Do not reply to the sender or click links in suspicious messages.
Keep original messages and screenshots untouched.
Inform your bank or payment provider right away and follow their guidance.

How to preserve messages and attachments

Keep the messages in their original form. Use built‑in export or archive functions provided by the messaging platform when available rather than copying and pasting, so metadata and timestamps are preserved.

Save attachments in their original file formats and make at least two copies on separate, secure storage devices or encrypted cloud storage. Avoid opening attachments on other devices that could alter file metadata.

Use official app export or archive features where possible.
Save attachments separately and back them up in read‑only formats.
Take clear screenshots showing the sender, timestamp and the full message if export is not available.

Preserving emails and headers safely

Email evidence is stronger when it includes full headers and the original message file. Save emails using your email client’s official save or export option to retain headers and routing information; if unsure, request an export from the provider or seek help from authorized support.

Avoid altering subject lines, message bodies or timestamps. If you must capture a quick record, take screenshots that include the visible header area and note the date and time you made the copy.

Save the email in a format that retains headers (for example, an original message file) or request an official export.
Capture screenshots that include sender, recipient, timestamp and subject.
If you need assistance, contact the email provider or an authorized forensic specialist rather than attempting advanced recovery yourself.

Capturing URLs, web pages and transaction records

Preserve any web evidence by saving the full URL, copying visible page content and saving page snapshots or PDFs. For transactional fraud, keep receipts, confirmation numbers, bank or payment records and exact timestamps.

When possible, download statements or export transaction logs directly from the bank or platform. If logs are only available on the platform, request an official account statement or case report from the provider.

Copy full URL strings and take screenshots showing the address bar and page content.
Save confirmation emails, transaction IDs and bank statements without modifying them.
Request official logs or exports from the service provider when necessary.

Handling devices, logs and metadata responsibly

Avoid factory resets, reinstallations or extensive troubleshooting that could alter logs or timestamps. If the device is critical evidence, power it on/off only as advised by an investigator and keep a detailed note of any actions you take.

Do not attempt forensic imaging, rooting, jailbreaking or advanced system changes yourself. These can corrupt evidence; instead, consult an authorized digital forensics professional who can preserve metadata and create verifiable copies.

Keep the device in a secure location and document its condition (powered on/off, locked/unlocked).
Avoid system changes that could overwrite logs or metadata.
Contact platform support, your financial institution or an authorized forensics provider for guidance.

Documenting chain of custody and involving authorities

Keep a clear, dated log of who handled each piece of evidence and when. Include notes on where copies are stored and how they were made. Good documentation supports investigations by banks, platforms and law enforcement.

Report the incident to the relevant platform, your bank and local authorities as appropriate. If you hire a digital forensics provider, confirm their credentials and ensure you provide any required written authorization to examine accounts or devices that belong to someone else.

Create a timeline of events with dates, times and actions taken.
Record names of people you contacted and any case reference numbers.
Only permit authorized investigators to access others’ accounts or devices after receiving written consent.

Perguntas frequentes

Should I delete scam messages or emails?

No. Do not delete original messages or emails. Preserve them in their original form and make backups. Deleting can remove crucial metadata that investigators or your bank may need.

Can I forward the evidence to my bank or the police?

Yes—forward the original message or an official export whenever possible and explain the context. Keep copies of what you send and note the date, time and the name of the person or team you contacted.

How long should I keep evidence of a scam?

Keep all relevant evidence until the matter is resolved with your bank, the platform or law enforcement. If advised by authorities or a forensic professional, retain original files and copies as directed.

Is it okay to try to recover funds or reverse transactions myself?

Contact your bank, payment provider or the platform before attempting actions on accounts. Avoid unauthorized attempts to access other people’s accounts or services; those actions may be illegal and can harm investigative efforts.

Do I need written permission to work on someone else’s device or account?

Yes. Any action on another person’s account, device or system should be authorized in writing by the owner. Forensic examiners and institutions typically require documented consent or legal authority before proceeding.

Preserving digital evidence carefully improves the chances that banks, platforms and law enforcement can investigate

Preserving digital evidence carefully improves the chances that banks, platforms and law enforcement can investigate. If you need help, report the incident to the platform or your financial institution and consider contacting an authorized digital forensics provider or local authorities—always acting with the proper written authorization.

Fale com a equipa