Save evidence without spiraling

Most of what your bank and the police will ask for is already on your phone. Save it once, log every call, and put it away.

If it’s happening now

Money just left, or you read someone a code. Call your bank or the payment company first, on the number on your card or inside its app. This page can wait until after that call. Steps: I paid or sent money or I gave out a code, password, or card number.

They’re still messaging you. Stop replying. Screenshot the conversation with their name, number, or username showing. Block or report them only after it’s saved. On some apps they can delete the whole chat from your phone, and some Report buttons delete it for you.

You’re on the phone with your bank or the police. Before you hang up, write down the date, the time, the person’s name, and the case number.

They were on your computer. If it’s still on, hold the power button until it shuts off, and leave it off. Don’t turn it back on to collect screenshots. Write down what you remember instead: the program they had you install, the number that called, the website they sent you to. Then: I let someone control my computer.

What to say

• Before we hang up, can I get a case number and your name?

• I'm writing this down. Can you say that again, slowly?

• What do you need from me? I'll send it through your app or bring it in.

What to save

Start with the chat and their profile, since they can delete those. Your bank and payment records will still be there later.

Messages. The whole conversation from the first message, with their name, number, or username in the shot. Then their profile page, with their username (it often starts with @). Display names are easy to change.

Calls. A screenshot of your recent calls with their number and the times. Keep any voicemails. Caller ID can be faked, but save the number anyway.

Emails. Leave them in your inbox or move them to a folder. Don’t delete them.

Websites. The full address, copied from the address bar or in a screenshot that shows it. If you closed it, it’s in your browser history. Don’t open it again.

Money. Every receipt and confirmation screen. For each payment: the date, the amount, how you paid, and where it went.

• Bank transfer, wire, or Zelle: the confirmation, and the name, bank, account number, email, or phone number it went to.
• Venmo, Cash App, PayPal, or Apple Cash: the payment screen with their name and the username, phone number, or email it went to.
• Gift cards: keep the cards and the store receipts, and take a photo of both.
• Crypto or a Bitcoin ATM: the ATM receipt, the wallet address or QR code they sent you, and the transaction ID if you have it.
• Cash or gold: the tracking number or mailing label, any doorbell camera video, and anything you noticed about the courier or the car.

Access. The name of any app they had you install, any code they had you read out, and which accounts you opened while they were connected.

Anything they sent as proof. A photo of a badge, a letter on letterhead, a contract, the name of the investment site or app.

How to take a screenshot

• iPhone with Face ID: press the side button and the volume up button at the same time, then let go. iPhone with a Home button: the side (or top) button and the Home button together. If the screenshot then fills the screen, swipe up on it to save it. The X in the corner can delete it. Screenshots are in the Photos app.
• Android: press Power and Volume down at the same time. If that doesn’t work, hold Power for a few seconds and tap Screenshot. On Android 12 and later, tap Capture more to get a long chat in one image.
• Windows: press the Windows key, Shift, and S together, then drag across what you want. It’s saved in your Screenshots folder.
• Mac: press Shift, Command, and 3 together. It’s saved to your desktop.
• A long WhatsApp chat: save it as a file. iPhone: open the chat, tap their name, then Export Chat. Android: open the chat, tap the three dots, then More, then Export chat. Choose Without media unless the photos matter, then email it to yourself. No Export option means this chat has exports blocked. Use screenshots.
• None of that works: take a photo of the screen with another phone. It counts.

For a long conversation, scroll up a screen at a time and take another, back to the first message.

Keep one log

Every call and report about this goes in one place. Ask for a case number every time. For online reports, screenshot the last page; it has the number. Print this page and fill it in by hand, or copy the headings into a note on your phone.

What happened. Five or six lines in your own words: how they first reached you, who they said they were, what they asked for, what you did, and when you realized.

Payments

Date	Amount	How you paid	Sent to	Transaction number

Calls and reports

Date and time	Who you talked to, or where you reported	What they said they’d do	Case or report number
Oct 2, 9:40 a.m.	Bank fraud line. Teresa.	Blocked the card. Opened a claim. Letter in the mail.	FR-20817

Filing with the FBI at ic3.gov. Use a computer, not a phone, and type your answers into a note first to paste in. The form can’t be saved halfway and takes no attachments, so keep the originals in case an investigator asks. It wants the payments and the scammer’s contact details most. The story matters less. When you submit, print or screenshot the page with the submission ID. You only see it once.

When your bank asks for documents, send them through its app or to an address you got on a call you made, not to one in a text or email. If it wants something confirmed in writing, log the deadline and keep a dated copy of what you send.

If you’re 60 or older, or helping someone who is, a National Elder Fraud Hotline case manager will walk you through the reports. Have this log with you when you call: 833-372-8311. Scammers pretend to be this hotline too, so you start the call.

Where to keep it

• One envelope for the paper: the bank’s letters and your printed log. Screenshots stay in your Photos app.
• Not on the computer they were on, and not only in an email account someone else got into.
• If someone is helping you, give them a copy. They can file the FTC and FBI reports for you. Your bank may still need to hear from you, so have them sit with you for those calls.

What not to waste time on

Getting more out of them. A real name, an address, a “receipt.” Every reply gives them another go at you.

Tracing the money yourself, or paying someone to. Anyone who offers to recover it for a fee, including people who say they’re with the FBI, IC3, the FTC, or a law firm, is running a second scam. IC3 says you won’t hear from it after you file. Someone offers to get my money back.

Saving the photos they’re threatening to share. Screenshot their messages and username, not your pictures. If you’re under 18, don’t send or copy the picture. Take It Down works from your own phone without sending it. Someone is threatening to share photos of me.

Getting every detail right. If you don’t know something, write “don’t know.”

Reading it again. Once it’s saved, close it. You only need it when someone asks.