Preserving evidence after a scam

A payment leaves your account and, within hours, the money has moved through two correspondent banks and into a wallet you have never seen. The scam is over. What happens next depends almost entirely on what you do in the next 48 hours – and the single most important action is rarely the one victims take first.

Preserving evidence after a scam is the foundation of every subsequent recovery step. Without a complete, timestamped record of communications, transactions, and counterparty details, the tools available to recovery practitioners – including a Norwich Pharmal order to identify a wrongdoer, a worldwide freezing order to stop dissipation, and on-chain tracing to follow crypto proceeds – become harder or impossible to deploy. Evidence that exists today may be gone within days.

This guide walks through each preservation step in order, explains why it matters for fraud recovery, and flags the mistakes that close off recovery options before a specialist can be instructed.

Why the First 48 Hours Decide Whether Recovery Is Possible

Speed determines the outcome in most cross-border fraud matters. Assets that are not frozen quickly are moved, layered, or converted – and each step adds cost and complexity to any subsequent tracing effort. In our experience, the difference between a matter where interim relief is achievable and one where it is not often comes down to whether the victim acted decisively in the first two days.

Three things happen fast after a fraud. First, the fraudster withdraws or converts funds, sometimes within hours of receipt. Second, electronic communications are deleted or platforms are taken down. Third, banking records and platform logs are subject to retention limits that vary by jurisdiction – many institutions purge transactional metadata after relatively short periods unless a hold is formally requested. Delay on any of these fronts narrows the recovery options available.

This is not a reason to panic. It is a reason to act methodically – starting now, before you have even identified a lawyer or a recovery specialist. The steps below can be taken by the victim directly. None require legal authority to complete. All of them feed directly into the evidence base that a practitioner will need.

In our experience, the most damaging mistake a fraud victim makes in the first hours is spending all available time calling the bank and doing nothing else. Calling the bank matters. It is not, however, sufficient.

Step 1: Freeze the Record Before You Touch Anything

The first instinct after discovering a fraud is to reply to messages, close accounts, or delete embarrassing communications. Resist all of these. Every action taken on a device or platform after the fraud is discovered risks overwriting metadata, altering timestamps, or – in the case of messaging apps – triggering auto-delete functions on the counterparty's side.

Put the devices used in the fraud aside. Do not factory-reset them. Do not uninstall apps. Do not delete contact records, browser history, or email threads, even if they feel irrelevant. Metadata embedded in digital communications – IP addresses, send times, device identifiers – is often as valuable as the message content itself, and it is destroyed by ordinary housekeeping.

If the fraud occurred through a web-based platform – an investment portal, a trading interface, a messaging service – take full screenshots immediately. Capture the URL, the page content, and the visible timestamp. If the platform goes down (a common occurrence once a fraud is detected), those screenshots may be the only record that the platform existed.

This applies to crypto wallets and blockchain interfaces too. Screenshot the transaction history, the wallet addresses shown, and any counterparty identifiers visible on the screen. On-chain tracing can recover much of this from public ledgers, but screen-level records are faster and sometimes capture information that has been obscured in subsequent on-chain activity.

Step 2: Document Every Transaction – Not Just the Last One

Fraud recovery practitioners need to reconstruct the full payment trail, not just the final transfer. This means documenting every transaction connected to the matter: the initial deposit that opened the relationship, all subsequent transfers in or out, any fees paid, and the final loss event.

For each transaction, collect: the date and time, the amount and currency, the sending and receiving account details (IBAN, account name, sort code, or wallet address as applicable), the reference field text, and the name of the institution or platform involved. If you received confirmation emails or platform receipts, do not delete them. Export them or photograph them.

Bank statements are necessary but not sufficient. Many victims have bank statements and assume that is the full record. It is not. The bank's internal records may contain additional correspondent routing data – the chain of correspondent banks through which a wire actually travelled – that does not appear on the customer-facing statement. Obtaining a detailed SWIFT or wire-trace report from your bank is a separate step, and it should be requested in writing as early as possible.

For crypto transactions, the public blockchain provides an immutable record of on-chain movements, but the victim still needs to document what they can see: the sending and receiving wallet addresses, the transaction hashes, the timestamps, and the amounts. If the fraud occurred through a centralised exchange or a virtual-asset service platform (VASP), log into the account and export the full transaction history before you take any further action. Accounts on fraudulent platforms are sometimes frozen or deleted without notice.

Step 3: Capture All Communications With the Fraudster

Fraud recovery depends on identifying the fraudster or the entities they used. Communications are often the richest source of identifying information – and the most frequently lost. Every channel used in the fraud should be preserved: email, SMS, messaging applications, social media, phone records, and any in-platform messaging on trading or investment portals.

For email, export the full thread in its original format, not just the visible text. Email headers contain routing information – the IP addresses of mail servers used – that can help trace the origin of communications. Most email clients allow export of the raw message (sometimes called .eml format). If you are unsure how to do this, do not delete anything while you find out.

For messaging applications, take screenshots of every conversation, capturing the sender's identifier (phone number, username, profile image) alongside each message. Be aware that some applications have disappearing-message functions; disable these immediately if the platform allows it. If the counterparty has already set messages to auto-delete, the screenshots you take now may be all that remains.

Keep a written record of phone calls: the number called or calling, the date and time, the approximate duration, and a summary of what was said. If calls were recorded on your device – whether automatically or by design – ensure those recordings are backed up.

What are you looking for? Names, claimed locations, company names, registration numbers mentioned, websites linked, email domains, and any personal detail the fraudster volunteered. Even a claimed LinkedIn profile that turns out to be fabricated is useful: it may share infrastructure – images, text, hosting – with other fraudulent operations, and that shared infrastructure can support a cross-border tracing effort.

How Does Cross-Border Evidence Preservation Work in Practice?

Most significant frauds are cross-border by design. The fraudster, the receiving accounts, the platform, and the eventual beneficiary are typically in different jurisdictions – chosen precisely because cooperation between those jurisdictions is slow. This is relevant to evidence preservation because records held in a foreign jurisdiction are not automatically available to a court in your home forum; they require a formal request, and that request takes time.

When a recovery practitioner seeks to obtain records from a foreign bank or platform, they may use a Bankers Trust order, a Norwich Pharmal order, or equivalent disclosure mechanisms available in the relevant jurisdiction. These tools compel a third party to disclose information. But they require the applicant to identify, with some precision, who holds the information and where. If the victim has already documented the counterparty's account details, institution name, and jurisdiction, that application becomes faster and more targeted.

The records the victim preserves directly also have a different evidentiary status from records obtained by court order. Records obtained directly – screenshots, exports, downloaded statements – can often be used in support of an urgent application without the delay of a formal disclosure request. This matters when the goal is to obtain a worldwide freezing order before the defendant dissipates the assets.

For crypto matters, on-chain tracing begins with the wallet addresses the victim can provide. The public blockchain contains the rest of the trail, but the starting point – the address the victim sent funds to, or the address shown on the fraudulent platform – must come from the victim's own records. Without it, a blockchain-analytics investigation must begin with significantly less certainty about where the funds went. A well-preserved set of wallet addresses and transaction hashes can compress the investigation timeline from weeks to days.

A matter in Southeast Asia, autumn 2024, illustrates the point. A business owner had transferred funds in the mid-six-figure range to what appeared to be a legitimate trading platform. When the platform became unresponsive, the owner still had screenshots of every screen visited, the full email thread with the introducer, and a downloaded CSV of the platform's stated transaction history. That record set allowed a blockchain-analytics investigation to begin within 24 hours of instruction, identify the destination wallets, and support a disclosure application against the relevant VASP – all before the platform's domain registration lapsed. Had those records been lost, the investigation would have started from a substantially weaker position.

The steps above describe the typical pattern. Your matter turns on specific facts – where the money went, which institutions were involved, and which forums can act on the evidence you hold. To assess the viability of tracing from your record set, contact us at info@axiomtracel.com.

Step 4: Report to the Right Bodies – and Create a Paper Trail When You Do

Reporting a fraud is not the same as preserving evidence. But the act of reporting, done correctly, creates a dated record of the complaint that can be useful in subsequent proceedings. It also triggers obligations on institutions – banks in many jurisdictions are required to investigate and report suspicious transactions once formally notified.

Report to your bank in writing, not just by phone. Send an email or a secure message through the bank's online platform, stating that you have been the victim of a fraud, identifying the transaction by date and amount, and requesting that the bank investigate and preserve all records relating to the transaction. Follow up any phone call with a written confirmation of what was said.

Report to the relevant financial-intelligence unit or national fraud-reporting body. Most jurisdictions have a mechanism for this – whether a dedicated fraud reporting portal, a national police economic-crime unit, or a central bank supervisory body. The specific body varies; local counsel or a recovery specialist can direct you to the right channel. The important point is to report in a way that generates a reference number or written acknowledgement. That acknowledgement is evidence.

For crypto frauds involving a centralised exchange, report directly to the exchange's compliance or fraud team, in writing. Some exchanges will voluntarily freeze accounts on a credible fraud notification while the facts are investigated; others will not act without a court order. Either way, a written report creates a record of the time at which the exchange was put on notice – which matters if funds are later dissipated from the account after that notification.

Do not stop after one report. A report to your local police that is not acted on immediately does not close the door to parallel action. Cross-border fraud matters often involve reporting to multiple bodies in multiple jurisdictions simultaneously, and a practitioner can help coordinate that process. However, the victim should begin with what is immediately available and document each step.

What Should You Not Do After a Fraud?

Knowing what to avoid is as important as knowing what to do. Several common responses by fraud victims actively damage the prospects for recovery. They are worth naming directly.

Do not attempt to recover funds by sending more money. This is the defining move of a second-stage fraud – a follow-on scam targeting the same victim with a promise to recover the original loss for an upfront fee. In our experience, this is one of the most common errors victims make, and it compounds the loss significantly. Legitimate recovery practitioners do not ask for upfront fees in exchange for guaranteed outcomes. Recovery is uncertain; anyone who tells you otherwise is running a scam.

Do not engage with unsolicited contact from anyone claiming they can help recover your money. After a fraud is reported – whether to a bank, a regulator, or online – victims frequently receive unsolicited approaches from individuals or organisations claiming to specialise in recovery. Many of these are fraudulent. The same criminal networks that ran the original scam often operate recovery scams as a secondary operation, targeting the same victims. Approach any unsolicited recovery offer with extreme caution and independently verify any firm you consider engaging.

Do not take legal action yourself without professional advice. Sending a legal letter to the wrong party, freezing your own account at the wrong time, or making a public accusation about a named individual can complicate a subsequent recovery claim and may have adverse legal consequences. Interim relief applications – including a worldwide freezing order or a Norwich Pharmal disclosure order – are technical. They require coordination with local counsel and careful preparation. Acting unilaterally, even with good intentions, can prejudice the application.

Finally, do not assume that because a payment was made via a regulated institution, recovery is straightforward. Banks and exchanges are subject to their own legal and compliance obligations; they do not simply reverse payments on request. Recovery through a formal legal process is a separate matter from the bank's internal dispute mechanisms, and one does not replace the other.

Building the Evidence File: A Practical Checklist

By the time you speak to a recovery practitioner or instruct local counsel, you should aim to have assembled a single organised file. What goes in it?

• A written chronology: every event in the fraud, dated and timed, in plain language – first contact, key conversations, each payment, the point of discovery.
• All transaction records: bank statements, wire-transfer confirmations, exchange receipts, crypto transaction hashes, and wallet addresses for every party involved.
• All communications: exported emails with headers, screenshots of messaging threads (with sender identifiers visible), call logs, and written summaries of any verbal conversations.
• All documentation provided by the fraudster: contracts, investment prospectuses, account statements, company registration documents (even if fraudulent), terms and conditions.
• Screenshots of all platforms and websites used, including URLs and timestamps.
• Copies of all reports made to banks, exchanges, police, and regulators, with reference numbers and written acknowledgements where obtained.
• A list of any individuals or entities named or identified in the course of the fraud, however tentatively.

This file should be stored somewhere secure and accessible – ideally both a physical copy and a secure digital backup. Send it to no one until you have verified their identity and their purpose. The same care that should have been applied to the original transaction should now be applied to this evidence set.

You may also find it useful to review the Fraud Response guidance on the Axiom Trace site, which covers related topics including scam typologies and first-response priorities. For matters that have already involved cross-border fund movements, the analysis of what to do when scam money lands in Jersey illustrates how jurisdiction-specific steps interact with this general framework.

If you want a structured assessment of whether the evidence you have preserved is sufficient to support a recovery action, the Axiom Trace feasibility report provides exactly that: a documented, confidential analysis of the facts and the realistic options.

What Happens Next: From Evidence to Recovery Action

Evidence preservation is a means to an end. The end is recovery – or at least a realistic assessment of whether recovery is achievable. What happens once the evidence file is assembled?

The first step is a viability analysis. Not every fraud is recoverable. The realistic prospects depend on where the funds went, whether the receiving institution can be compelled to act, whether the defendant has identifiable assets that can be frozen, and whether the cost of recovery is proportionate to the likely return. An honest viability assessment is the foundation of any sensible next step. We regularly advise clients that a particular matter – for all its merits – does not justify the cost of formal proceedings at the anticipated asset value. That is not a comfortable message, but it is a necessary one.

Where recovery is viable, the evidence file the victim has preserved becomes the basis for urgent applications. A worldwide freezing order application needs, at minimum, evidence of the fraud, evidence of the defendant's assets, and a good arguable case. A Norwich Pharmal application needs enough information to identify the third party who holds the identifying information. A disclosure order against a VASP in a crypto matter needs the wallet address or account identifier at which the order will be directed. All of that comes from the victim's preserved record set.

The quality and completeness of the evidence file directly affects the speed at which these applications can be prepared and filed. In cross-border matters, speed is not a preference – it is a determinant of outcome. Applications for interim relief are measured in hours to days; each additional day of delay increases the risk that assets have moved beyond reach.

We have traced assets that reached multiple jurisdictions before a court was even approached – and some of those matters were still viable because the victim's preserved records provided enough certainty about the destination to make a targeted application. We have also seen matters where the absence of any preserved records made it impossible to identify the forum or the defendant with sufficient precision. The difference, in almost every case, was what the victim did in the first 48 hours.

If you have preserved evidence and want a confidential assessment of whether your matter is realistically recoverable, request a case review at info@axiomtracel.com.

Related Guidance

• Fraud Response – typologies, first steps, and action guides for victims assessing their position after a loss.
• When scam money lands in Jersey – what to do: a jurisdiction-specific walkthrough of how cross-border recovery intersects with offshore financial centres.
• Feasibility report: a structured, documented analysis of whether your matter is recoverable and what it would take.

Frequently Asked Questions

Q: What should I do in the first hours after a fraud?

A: In the first hours, do not delete anything. Take screenshots of all platforms, export all communications, and download all transaction records before platforms are taken down or accounts closed. Then notify your bank in writing – not only by phone – and request that it preserve all records relating to the transaction. Those two steps, taken quickly, keep the most recovery options open. Contacting a recovery specialist as early as possible allows urgent interim relief options to be assessed while they are still available.

Q: Is my loss realistically recoverable?

A: Recoverability depends on several factors: where the funds are now, whether the receiving institution can be compelled to act, whether the defendant has identifiable assets, and whether the cost of proceedings is proportionate. Not every fraud leads to a viable recovery action, and an honest assessment at the outset prevents wasted cost. A feasibility report provides a documented, confidential analysis of those factors based on the specific facts of your matter. Recovery is never guaranteed; the goal of the assessment is to identify whether the realistic prospects justify the investment of time and resources.

Q: How do I avoid a second, recovery-focused scam?

A: After a fraud is reported, victims frequently receive unsolicited approaches from individuals or organisations claiming to specialise in asset recovery. Many of these are fraudulent, operated by the same networks that ran the original scam. Legitimate recovery practitioners do not guarantee outcomes, do not demand large upfront fees in exchange for promises of return, and do not make unsolicited contact with recently defrauded individuals. Before engaging any recovery firm, independently verify its identity, check whether it has a traceable business presence, and be sceptical of any guarantee. Axiom Trace does not offer guaranteed outcomes and does not make unsolicited contact.

About Axiom Trace

Axiom Trace is an independent boutique focused on cross-border and crypto asset recovery. We trace assets that have moved across borders or on-chain and coordinate their freezing and recovery – working with defrauded principals, insolvency practitioners, and the lawyers and funders who refer them. We work lawfully and within applicable sanctions regimes, alongside local counsel where proceedings must be filed. We have advised on matters involving multiple jurisdictions and asset types, from banking fraud with correspondent-bank layering to crypto schemes where funds moved through several wallets and exchanges before being identified. In our experience, the clients who reach the best outcomes are those who acted quickly and preserved their evidence carefully from the start. To discuss a matter, contact info@axiomtracel.com.

Disclaimer: This publication is for general information only and is not legal advice, nor a promise or prediction of recovery. No outcome is guaranteed. Asset recovery depends on the specific facts and on the law and procedure of each relevant jurisdiction, where local admitted counsel must act. Axiom Trace assumes no liability for actions taken or not taken based on this material. For advice on your situation, contact info@axiomtracel.com.