Capture the transaction record first
Text copies matter more than images. A hash typed out from a screenshot can be transcribed incorrectly, and a single wrong character makes the record unverifiable.
- Every transaction hash for funds you sent, copied as text rather than only as a screenshot.
- The exact destination addresses, including the network each transfer used.
- Dates and times with your timezone, and the amounts in both crypto and your local currency at the time.
- Exchange withdrawal confirmations and the account statements covering the period.
Preserve the communications before they vanish
Messaging platforms used in fraud often have disappearing messages enabled, and accounts are frequently deleted once contact stops. Export full conversation histories rather than screenshotting highlights, and record the profile names, usernames, phone numbers and any voice or video call logs.
If the approach came through a website or app, save the URL, capture the pages while they are still live, and note the app store listing if one existed. Sites in this category are routinely taken down within days.
Common mistakes that destroy evidence
- Deleting the chat out of frustration or embarrassment. It is often the most valuable single item.
- Blocking the account before exporting the history.
- Closing the exchange account used to send funds, which can cut off access to statements.
- Continuing to use a wallet that may be compromised, which mixes your own later activity into the trail.
- Sending small test transactions to the fraud address to see what happens. This adds noise and no information.
Organise it so somebody else can follow it
Put everything in one folder with a simple timeline document: what happened, in what order, with dates. Name files consistently. An investigator, a bank fraud team and a police officer will all read the same bundle, and how quickly they can follow it affects how seriously it is taken.
Keep the original files unedited. Annotate copies if you want to highlight something, but never alter the source material.
Report it in parallel
Reporting does not delay anything else and creates a dated official record. In England, Wales and Northern Ireland report to Action Fraud; in Scotland contact Police Scotland on 101. Notify the exchange you withdrew from and, if it can be identified, the exchange that received the funds — receiving services can only act on information they have been given. Keep every reference number.
Common questions
- Is it too late if it happened months ago?
- Not necessarily. On-chain records are permanent, so the transfer trail remains available. What degrades is the off-chain material — chat logs, live websites and account access — so preserve whatever still exists now.
- Should I move the remaining funds out of my wallet?
- If the wallet may be compromised, moving remaining funds to a newly created wallet is sensible. Record the transaction so your own movement is not later mistaken for fraud activity.
- Do I need all of this before contacting an investigator?
- No. Transaction hashes and destination addresses are enough to assess whether a case is traceable. Everything else can follow.
Have a case you want reviewed?
We scope at intake and tell you honestly whether the on-chain data supports a traceable case.