Evidence Center
Turn scattered records into a usable case file
Banks, platforms and official authorities respond to structure. This is how to preserve what you have and organize it so it can be reviewed quickly.
Independent service. FraudGuard Recovery & Cyber Safety is an independent private service. We are not a law enforcement agency, government body, bank, regulator or law firm, and we have no government affiliation. We do not guarantee the recovery of lost funds. Outcomes depend on the circumstances of each case and on the institutions involved.
What to collect
Collect originals first and work from copies. Never edit, crop or annotate an original file.
Transaction records
- Bank or card statements as PDF exports rather than screenshots where possible
- Payment amounts, currencies, dates, times and time zones
- Beneficiary names, account numbers, sort codes, IBANs or wallet addresses
- Cryptocurrency transaction hashes, networks and exchange withdrawal IDs
- Any reference or description text you were told to include
Communications
- Original emails with full headers, saved rather than forwarded
- Exported chat histories from messaging apps where an export function exists
- Call logs with dates, durations and the numbers used
- Names, aliases, job titles and firm names given to you
- Any documents, contracts or 'certificates' you were sent
Screenshots and captures
- Full-screen captures showing the URL, account name and system clock
- Platform dashboards showing the balances you were shown
- Profiles, adverts and websites before they are taken down
- Two-factor prompts or security warnings you received
Your own account
- A plain written statement of what happened, in chronological order
- What you were told, by whom, and what you were asked to do
- What you believed at each point, and what changed your mind
- Any losses beyond the payments themselves, such as fees or charges
Printable checklist (PDF)
Download or print the full checklist, including blank timeline and reference-log templates, and work through it on paper.
Evidence Center checklist worksheet
Two pages, A4, tick-box format. Includes every item on this page plus the timeline and reference log templates with blank rows to fill in by hand.
Keep completed sheets with your case file. Do not write passwords, PINs, one-time codes, seed phrases or private keys on the worksheet.
Build a timeline and a reference log
Two simple documents do most of the work: a timeline of events, and a log of every contact you make.
Timeline template
Date | Time (TZ) | What happened | Amount | Method | Evidence file 2026-01-12 | 14:05 UTC | First contact via messaging app | - | - | chat-export-01.txt 2026-01-14 | 09:40 UTC | First payment to "broker" | 1,200 EUR | Bank transfer | statement-jan.pdf 2026-01-22 | 16:12 UTC | Told to pay "release fee" | 2,500 EUR | Crypto (USDT) | tx-hash-list.txt
Reference log template
Date | Organization | Contact | Reference | Outcome | Next step / due 2026-01-15 | Bank fraud team | K. Mensah | FR-884120 | Recall attempted | Update due 22 Jan 2026-01-16 | National reporting body | Online form | NR-99231 | Report logged | Keep for bank 2026-01-20 | Exchange support | Ticket | EX-55710 | Under review | Chase 27 Jan
Handling evidence safely
Good practice protects both the integrity of your records and your own privacy.
- Keep one untouched master copy in a separate, backed-up location
- Redact your own full card numbers and identity documents unless an institution formally requires them
- Do not publish evidence publicly or name suspected individuals online
- Record file names in your timeline so each event points at its evidence
- Note where each item came from, and when you captured it
- Never share passwords, PINs, one-time codes, seed phrases or private keys with anyone
We never ask for credentials. We will never ask for your passwords, PINs, one-time codes, seed phrases, private keys, full card numbers or remote access to your devices. Anyone who does is not acting on our behalf. Read our Anti-Impersonation Policy.
Need help understanding what happened?
Document the incident, protect your accounts, and identify the appropriate next steps.
Start a Case Assessment