Home › Knowledge Hub › Evidence checklist
Crypto scam evidence checklist
A useful fraud report answers five questions: who contacted you, what they claimed, how money moved, what evidence supports the timeline, and where the digital trail leads. Collecting this does not guarantee recovery, but it is the difference between a report that can be assessed and one that cannot. The single most important item is the transaction hash.
Do this before you block anyone
Scam infrastructure is temporary. Platforms go offline, accounts are deleted, messages get edited or wiped. Once you confront the person or block them, some of this becomes unrecoverable.
Collect first. Then stop replying. Then block.
Transaction hashes: the item that decides everything
A transaction hash, also called a transaction ID or TXID, is the unique identifier for a transaction recorded on a blockchain. It is the most useful single piece of evidence in a crypto fraud report, because it lets any reviewer locate the transaction on the public ledger and verify it independently.
From a hash, a reviewer can see the sending address, receiving address, asset, amount, network, block confirmation and timestamp. Depending on the transaction type it may also show token transfers, contract interactions and fees.
Where to find them:
- Your exchange's withdrawal history, look for "details", "TXID" or "view on explorer" next to each transfer
- Your wallet's activity list
- A blockchain explorer, if you know your own address
Copy them. Never retype them. A single wrong character makes a hash useless, and there is no error-correction, a mistyped hash refers to nothing.
Record the network alongside each hash. The same-looking address format exists on several chains, and a hash without its network wastes a reviewer's time.
Spanish police guidance puts this bluntly: without the transaction ID, tracing is technically unviable, and the report is far more likely to be closed for lack of an identifiable suspect. The same is true everywhere.
Identity and contact information
Save every name, handle, email address, phone number, social media profile, website domain, advertisement and messaging account used by the suspected scammer.
Capture full profile URLs, not just usernames, accounts get renamed and deleted. Take screenshots showing the account name and timestamp, not cropped fragments.
Note how first contact was made and on which platform. That detail helps investigators group cases, because operations tend to reuse channels.
Communications
Export the full conversation using the app's own export function where one exists, WhatsApp, Telegram and Signal all have this. An export preserves timestamps and sequence; screenshots do not.
Take screenshots as well, but as a supplement. Where you screenshot, include the surrounding context rather than a single message.
For email, save the original message with full headers where possible. Headers carry routing information that a screenshot destroys.
For calls, keep logs, voicemails and notes made immediately afterwards. Recording laws vary by jurisdiction, do not record covertly where local law prohibits it.
Keep the parts that embarrass you. Investigators need the whole sequence. The messages where you were persuaded are the ones that show how the fraud worked.
Platform and payment records
- Every website address used, including ones that now error or redirect
- The app name and where you downloaded it, store, direct link, or TestFlight
- Screenshots of your account showing the claimed balance and any trade history
- Account numbers, usernames, client IDs on their system
- Documents they sent: contracts, certificates, licence numbers, tax notices
- Exchange account details for the account you sent from
- Bank statements showing money moving to the exchange
- Card, wire or payment-app references
A dated timeline
This turns a confusing experience into something a reviewer can follow. It matters most where the fraud developed over weeks or months, as in a romance-led investment scam.
Five columns:
| Date and time | Event | People or accounts | Evidence file | Transaction details |
|---|
Start at first contact. Record the introduction to the platform, account opening, each deposit, each claimed profit, and every obstacle when you tried to withdraw.
Be precise. "28 April 2026, approximately 10:00 local time" is worth more than "late April". Where you are unsure, write that it is approximate rather than guessing silently.
Keep hashes and wallet addresses in their own column so they are never mangled by reformatting.
How to write the report itself
Reports do not need legal language. They need accuracy and structure.
Open with a single paragraph covering: who contacted you, what they represented themselves as, how much you sent, which asset or payment method, and why you believe it was fraudulent.
Then list the detail: contact information, platform URLs, wallet addresses, transaction hashes with networks, dates and amounts, exchange and bank references, and a note of which communications you hold.
Keep every reference number you are given: police report numbers, exchange ticket numbers, bank fraud case numbers. Store them with the file. You will be asked for them.
Do not speculate about who the perpetrator is. Describe what happened and what you hold. An investigator will draw their own conclusions, and a report that argues a theory is harder to assess than one that presents facts.
Storing it
One folder, backed up somewhere that is not the device that was compromised.
If any account was accessed without permission, assume the device may be affected. Move the evidence to separate storage before doing anything else, and secure your email before anything else at all.
What this does and does not do
Good documentation makes a report actionable rather than a statistic. It is what an exchange needs to review an account, what police need to open a file, and what a lawyer needs to advise on a civil claim.
It does not make recovery likely. Most crypto losses are not recovered, and no amount of evidence changes the underlying reality of where the funds went. What it does is ensure that where something can be done, the lack of records is not the reason it isn't.
Then file with the reporting channel in your country that can lead to an investigation, in several countries the obvious one cannot.
Frequently asked questions
What is a transaction hash and where do I find it?
It is the unique identifier for a blockchain transaction, sometimes called a TXID. Look in your exchange's withdrawal history or your wallet's activity list, usually behind a "details" or "view on explorer" option next to each transfer. Copy it rather than retyping, one wrong character makes it useless.
I only have screenshots, not exported chats. Is that enough?
It is worth reporting with what you have. Screenshots lose timestamps and sequence, which weakens them, but partial evidence is far better than none. Note in your timeline what is missing and why. Some platforms retain data obtainable through legal process even after your own copy is gone.
Should I include messages that embarrass me?
Yes. Investigators need the full sequence, and the passages where you were persuaded are precisely what demonstrate how the fraud operated. Nobody reviewing your file is judging you, they have seen the same pattern many times.
How long should I keep this evidence?
Indefinitely, or at least until every avenue is closed. Cases are sometimes reopened when a network is dismantled years later and investigators seek victims, and you will need your records at that point.
Do I need all of this before I report?
No. Report as soon as you can, because speed matters, and supplement the report afterwards. Aim to include the transaction hashes in the first submission if at all possible, they are the item most likely to determine whether anything follows.
Can I send my evidence to a recovery company to assess?
Be careful. Never send original documents, never share seed phrases or account credentials, and never pay before anything is recovered. Send copies, and keep a record of what you sent and to whom. Read our guide on spotting recovery scams first.
Not sure where your case stands?
Ten questions showing which documentation and reporting steps are available to you.
Recovery pathway assessment