Preserve the Evidence: A Fraud Incident Checklist

An incident report is only as strong as the material behind it.

After a fraud, people often collect too much of the wrong thing: hundreds of screenshots, repeated downloads and unlabelled files. The result looks substantial but becomes difficult to test.

CLAIM

Preserving evidence means retaining context, origin and sequence—not merely accumulating images.

EVIDENCE

Digital material changes easily. Messages can be edited or deleted, websites can disappear and account details can be replaced. A screenshot may capture what was visible at one moment, but it does not automatically establish who created the content, whether anything was omitted or whether the displayed account was genuine.

TEST

For every item, ask five questions: What is it? Where did it come from? When was it obtained? Is the original retained? What claim does it support?

VERDICT

A smaller, structured evidence pack is usually more useful than a large, unexplained folder.

ACTION — BUILD THE PACK

1. Preserve originals

• Keep original emails in the mailbox where possible.
• Export or download conversations using the platform’s own function if available.
• Retain original photographs, audio and documents rather than repeatedly re-saving them.
• Do not annotate the only copy.

2. Record identifiers

• Email addresses and full headers where available.
• Telephone numbers, usernames and profile URLs.
• Bank details, payment references and transaction identifiers.
• Website addresses, including the complete URL.
• Device and account names relevant to the event.

3. Create a chronology

Use one row per event:

• Date and time
• What happened
• Who or what account was involved
• Evidence filename
• Action taken
• Reference number

4. Separate fact from recollection

“The message was received at 14:06” may be supported by the original message. “The caller sounded nervous” is a recollection. Both may matter, but they are not the same kind of evidence.

5. Keep a working copy

Retain originals securely and use copies for highlighting, redaction or submission. Record what was provided, to whom and when.

MINIMUM INCIDENT INDEX

1. One-page summary
2. Chronology
3. Transaction schedule
4. Communications
5. Account and website identifiers
6. Reports and reference numbers
7. Actions and outstanding deadlines

LIMITATIONS

This process organises material; it does not certify authenticity or determine admissibility. Requirements differ between banks, investigators, regulators and courts. Follow any instructions issued by the body handling the matter.

Evidence & official sources

• NCSC phishing and reporting guidance
• NCSC suspicious website reporting

The Verification Desk distinguishes verified fact, evidence-led inference and unresolved uncertainty. This publication provides general information, not legal, financial, regulatory or emergency advice. Findings reflect the evidence available at publication and may be updated if material evidence changes.