The First Hours: What to Preserve Once the Fraud Has Already Happened

People who discover they've been defrauded online almost always do the same things, in the same order: confront the scammer, try to claw the money back on their own, delete whatever is embarrassing, and only then look for help.

Every one of those reactions is understandable. The first three destroy evidence.

This is about what to do in the hours when nobody is yet thinking about evidence — which is precisely when the case is decided.

Why the first hours

Three clocks are running at once, and none of them waits:

The money clock. Transferred funds are broken up and moved fast. The sooner you know where they went, the better the odds of reaching anything.

The content clock. The profile, the site and the distribution channel go dark the moment the scheme closes — often before the victim understands what happened. Whatever wasn't captured ceases to exist.

The memory clock. Who made the referral, from which group, what was promised on what date: it all feels unforgettable on day one and is gone in two weeks.

What to preserve

Financial records. Every PIX, wire, boleto or transfer: amount, date, time and — most importantly — the destination account and account holder. The beneficiary's name is usually the first real thread.

Crypto identifiers, where applicable. The hash of each transaction and the destination address. Two short pieces of data, and they are what makes tracing possible; without them, "I sent it in bitcoin" goes nowhere.

Full conversations, exported. Messaging apps let you export the entire chat, with a date and time on every message. Use that. A cropped screenshot shows the fragment the victim considered relevant; the export shows the sequence — and it is the sequence that demonstrates inducement.

Addresses and pages. Full URLs for the site, the profile, the channel and the ad. If there's a dashboard showing a balance, capture the screen and the URL. An address that has already gone offline can sometimes be recovered from public web archives; one that was never written down cannot.

Human context. Who referred you, when, in which group, what was promised. Write it in a file, dated. It isn't evidence on its own, but it's what directs everything else.

How you preserve matters as much as what

Two pieces of material with identical content can carry very different evidentiary weight.

An export beats a screenshot. The exported file carries metadata; the image carries only what was on screen.

The original beats a forward. Forwarding a photo through an app recompresses the file and strips its metadata. Keep the original and share copies.

Record when you collected it. One line is enough: what the file is, where it came from, on what day and at what time. It looks like bureaucracy, and it's what lets you later assert that the material hasn't changed.

Compute a hash, if you know how. A sha256 for each file, noted alongside the date, creates a reference any examiner can verify later. If you don't know how, don't worry — the previous items already cover most of it.

That is the essence of chain of custody, minus the vocabulary: knowing where it came from, when it arrived, and being able to show it hasn't changed since. Done after the fact, it isn't done.

The five costly mistakes

1. Deleting the conversation. Out of shame or out of anger. It's the most common loss and the hardest to reverse.
2. Confronting the scammer. It signals that the victim has caught on, and the response is to wipe everything on the other side — including whatever was still accessible.
3. Paying the "release fee." No legitimate charge precedes a withdrawal. The amount requested is always small next to the balance on display; that's the whole point.
4. Hiring anyone who promises recovery for an upfront payment. That's the second scam, frequently run by whoever bought the victim list from the first.
5. Waiting to "gather more information" before filing a report. A report can be supplemented later; lost time cannot.

Where to take it

Filing a formal police report is the first step, and it's worth doing even with incomplete material. From there the paths open up depending on the case: the financial institution involved, the cybercrime unit where one exists, and — where the amounts are significant or there are multiple victims — legal counsel to pursue the appropriate remedies.

If the case involves virtual assets, bring the transaction hashes. They are the difference between an account of events and a starting point.

In one line

Keep everything, exported and unedited, with the date you kept it. Don't confront, don't delete, and don't pay anything to get paid.

---

CyberX works in digital intelligence applied to investigation — OSINT, on-chain tracing and anti-fraud. This content is informational and does not constitute legal advice.