Begin with a short timeline
Fictional example: Omar paid after seeing an online listing but never received the item. He creates a private note covering first contact, payment, agreed delivery and the latest exchange. He labels uncertain times as approximate rather than inventing precise recollections.
Separate observation from inference. “The sender used the platform’s name” is an observation; “the platform was involved” is an unsupported conclusion. Record what raised your suspicion and which organisation you have already reached through an independently verified channel.
Organise available evidence safely
Gather original messages, order confirmations, existing screenshots and payment records in protected storage. Use understandable filenames including date and subject. A short index connects each document to the event it supports. The responsible organisation can request further details later.
Do not reopen suspicious pages or attachments to complete the collection, and do not download unfamiliar evidence tools. If malware is suspected, arrange appropriate device assessment first. Documentation must not delay urgent card protection or ending an active remote access session.
Distinguish originals from sharing copies
Preserve original files unchanged where they can be stored safely. If you hide names or account details for general advice, create and label a separate copy. This makes clear that the advice version is not the complete original record.
A bank or police service may need complete information through its official procedure. A public comment does not. Conceal QR codes, ticket codes, addresses and other people’s details before any public sharing. Merely placing a transparent coloured mark over text may leave the information readable.
Verify the recipient and transfer route
Ask the responsible organisation which documents it needs and which secure channel to use. Reach that contact independently of a newly received message. A familiar case reference inside an email does not by itself prove that the sender belongs to the existing support team.
Do not share password lists, one-time codes or complete private archives. Limit disclosure to the specific purpose. Business matters also involve internal reporting and privacy procedures. This general guide does not promise particular legal evidential value and does not replace individual legal advice.
Maintain and protect the record
Omar adds the date, case reference and next task to each response. He can then see whether he owes documents or is waiting for a reply. He does not send every update to every contact, and keeps the overview outside publicly shared storage.
Ask the relevant organisations how long records remain necessary. Avoid premature deletion during an open case, but do not collect new private information indefinitely either. An organised record supports case handling; it cannot guarantee a successful investigation or reimbursement.
Your checklist
The checkboxes are for your own reference. No entries are sent to us. To keep a copy, print the page or save it as a PDF using your browser menu.
Common questions
Must I reopen the suspicious page to take a screenshot?
No. Do not create additional risk for more evidence. Record information already available and ask the responsible organisation what it actually requires.
Can I post all my evidence in a help forum?
Do not publish complete personal documents. General advice usually needs a description or carefully redacted copy without other people’s private information.
Does a screenshot prove who was responsible?
No. It shows visible content at a particular time, but does not necessarily establish authorship or authenticity. Preserve context and originals for assessment by the responsible organisation.
Sources and further information
Primary sources from public authorities, consumer organisations and providers. A source may be in another language; follow the guidance that applies to your service and where you live.
- Polizeiliche Kriminalprävention: Sicher Handeln – Weitere InformationenSource review date:
- UK Government, Stop! Think Fraud: What to reportSource review date:
- BACS: Käufer und Verkäufer im Visier der TicketbetrügerSource review date:
