A fraudulent crypto transfer can occur in minutes. The evidence needed to explain it may be scattered across a wallet, an exchange account, text messages, email, a fake website, and a public blockchain. Knowing how to document financial fraud promptly can turn a confusing loss into an organized factual record that investigators, law enforcement, and counsel can evaluate.

The goal is not to prove every part of the case by yourself. It is to preserve what happened, distinguish verified facts from assumptions, and create a reliable timeline before accounts, websites, chat histories, or scammer profiles disappear.

Preserve Evidence Before It Changes

Begin with preservation, not confrontation. Do not alert the suspected scammer that you are gathering evidence, and do not delete messages out of frustration. Fraud operators often close accounts, edit webpages, change wallet addresses, or move funds after a victim raises concerns. Your first record may be the only record that captures the interaction as it occurred.

Create a dedicated folder on a local device and a secure backup location. Save original files whenever possible rather than relying only on screenshots. Screenshots are useful, but an exported email, downloaded account statement, chat export, or original image file may retain information that a screenshot does not.

For each item, note when and where you obtained it. A simple evidence log should identify the file name, source, date and time collected, a short description, and any actions taken with the file. For example: “2026-08-14, Coinbase withdrawal confirmation email, downloaded from inbox, PDF saved without alteration.” This record helps demonstrate that materials were preserved methodically rather than reconstructed later from memory.

Do not alter images, crop transaction pages, edit message threads, or annotate the only copy of a file. If you need to highlight a detail, make a separate working copy and retain the unmodified original.

Build a Chronology of the Fraud

A clear chronology is often more valuable than a large, unorganized collection of screenshots. Start with the first point of contact: an advertisement, a dating-app message, an unsolicited call, a social media profile, or an apparent support request. Then record each material event in order.

Include the date, approximate time and time zone, platform used, person or account involved, what was represented, what you did, and the evidence supporting that entry. State facts precisely. “The account instructed me to send USDT to this address” is stronger than “they stole my money” because it can be tied to a message and a transaction.

Your chronology should generally capture:

• The initial contact and the identity or screen name used
• Claims made by the other party, including promises, deadlines, or alleged fees
• Deposits, purchases, wallet transfers, and exchange withdrawals
• Requests for passwords, recovery phrases, remote access, or additional payments
• Any refusal, delay, or invented condition when you attempted to withdraw funds
• The point at which you recognized the conduct as fraudulent

Separate what you know from what you infer. You may know that funds were sent to a particular wallet address at a particular time. You may suspect that several websites, names, and wallets are controlled by one operation. Label the latter as an observation or suspected connection unless records establish it directly. This distinction protects the credibility of the entire file.

Record the Complete Transaction Trail

For cryptocurrency-related fraud, the transaction hash is central evidence. A transaction hash, also called a transaction ID or TXID, is the unique identifier assigned to a blockchain transfer. Copy it exactly from the sending wallet or exchange confirmation. Also preserve the asset type, amount, network, sending address, receiving address, transaction date and time, and any associated fees.

A common mistake is recording only a wallet address. An address may receive many transfers. The transaction hash identifies the specific event and allows an investigator to verify the transfer independently.

Public ledgers provide architectural transparency: the movement of assets can often be viewed and checked without relying solely on the scammer’s claims. For Ethereum and compatible networks, Etherscan can display transaction details, token transfers, wallet activity, and smart-contract interactions. Blockchain.com can assist with review of relevant Bitcoin transactions. SoChain may be useful for examining activity on supported networks. Save a PDF or timestamped screenshot of the relevant explorer page, but also preserve the hash as plain text because web displays can change.

Explorer data has limits. A public ledger generally shows that one address sent assets to another; it does not automatically reveal the person controlling either address. It also cannot establish why a transfer occurred, whether an address belongs to a particular exchange customer, or whether a website’s displayed balance was genuine. Those questions require contextual evidence from communications, account records, platform information, and, where appropriate, formal investigative processes.

When a transfer passes through multiple wallets, do not simplify the path prematurely. Record each observable hop, the date and time, assets transferred, and any interaction with exchange deposit addresses, bridges, decentralized services, or token swaps. The sequence may reveal patterns that matter later, even if its significance is not immediately clear.

Capture the Off-Chain Evidence

The blockchain is only one part of the record. Most crypto scams rely on off-chain representations: a fraudulent trading dashboard, an impersonated support agent, a fake account manager, or a website that displays invented profits and fabricated withdrawal restrictions.

Preserve the communications that gave the transfer its context. Save complete email threads, including headers if available. Export chat conversations where the platform permits it, and take full-screen screenshots that show account names, dates, and the surrounding conversation. For text messages, retain the contact number and the full thread instead of isolated statements.

Document websites carefully. Capture the domain name, the full web address of significant pages, login screens, account balances, deposit instructions, and withdrawal messages. A screen recording can be useful when a site has multiple steps or changing displays. Do not keep logging in repeatedly if you suspect the site is trying to obtain additional information. Never provide a recovery phrase, private key, account password, or remote access in an effort to “verify” your account or recover funds.

If you used an exchange or payment service, download account statements, withdrawal confirmations, deposit confirmations, and identity-verification notices. Record support ticket numbers and the full text of communications with the platform. These records can connect a fiat payment or exchange withdrawal to an on-chain transaction.

Create an Evidence Index That Others Can Use

Investigators should not have to guess which screenshot relates to which transaction. Give every item a consistent label, such as E-001 for the initial message, E-002 for the exchange withdrawal confirmation, and E-003 for the blockchain transaction record. Reference those labels in your chronology.

A practical case file has three parts: a one- to two-page factual overview, a dated chronology, and an indexed evidence archive. The overview should identify the total known loss by asset and approximate dollar value at the time of transfer, the principal scammer identifiers, relevant wallet addresses, transaction hashes, platforms used, and the current status of the funds if known.

Keep a separate page for identifiers. Include wallet addresses, transaction hashes, domains, email addresses, phone numbers, usernames, social media handles, bank details, and company names exactly as displayed. Small transcription errors can impede transaction tracing. Copy and paste digital identifiers when possible, then visually confirm them against the source.

Report Carefully and Protect Remaining Accounts

Documentation supports reporting, but it does not replace it. Submit factual reports to the relevant exchange or service provider as soon as possible, especially if funds were sent from or passed through that platform. Provide transaction hashes, dates, receiving addresses, and the related account records. Avoid speculative narratives or sending dozens of duplicate messages; concise, organized evidence is more useful.

For losses involving criminal deception, report the matter to appropriate law enforcement and fraud-reporting channels. Preserve report numbers, submission confirmations, and the name or badge number of any official you speak with. If a report is updated, record what changed and why.

At the same time, secure accounts that may be exposed. Change passwords from a known-safe device, enable multi-factor authentication, review connected devices and API permissions, and contact the legitimate platform through a verified channel. This is account security, not an attempt to reverse the transaction yourself.

What Not to Do After a Crypto Scam

Victims are frequently targeted again by supposed recovery agents, hackers, or investigators who promise to retrieve funds for an upfront payment. Treat unsolicited recovery claims as a serious warning sign. Do not send more cryptocurrency to “release,” “insure,” “validate,” or “trace” assets. Do not share seed phrases or private keys with anyone.

Also resist the urge to publicly accuse a named individual before identity and control are established. The evidence may support a reported fraud and a transaction trail without proving who operated a wallet or website. Accurate language preserves the usefulness of your documentation.

Education is the strongest shield against repeated fraud. A well-preserved record gives legitimate investigators a starting point, and transaction tracking can uncover patterns for law enforcement discovery.