Records · International
How to build a fraud evidence timeline that institutions can use
Create a short chronology linked to original records, separate facts from assumptions and avoid counting the same loss twice.
By Stonebridge Resolution · Published 4 October 2026 · Updated 4 October 2026
AI-generated illustration; not a depiction of a real case.
The short answer
Create one dated row for each important contact, payment and withdrawal demand. Link each row to an original record and distinguish verified events from claims made by the scammer.
Begin with a one-paragraph overview
State how contact began, what you were promised, the payment methods used, the actual amount paid and why you now believe there was fraud. Keep this summary factual and short.
The purpose is to help a reader understand the case before opening attachments. You do not need to describe every conversation or prove the offender's full identity before creating a useful record.
Use a consistent row structure
For each event, record date, time if known, timezone, what happened, amount where relevant and the filename or reference supporting it. Use approximate dates only when necessary and mark them as approximate.
An illustrative row might read: '12 September, 14:20 local time—assistant sent a wallet address and requested an investment deposit—message export 03.' This is a format example, not a real case or evidence of an outcome.
Separate actual money from displayed profit
List outgoing payments and genuine amounts returned. Keep the platform's claimed balance in a separate field labelled unverified. Do not add an invented profit to the cash you lost.
Avoid counting a bank transfer to your own exchange and the later crypto withdrawal as two independent losses. They can be two stages of the same funds. Record both events while calculating the loss carefully.
Link evidence without modifying originals
Store original statements, emails, exports and screenshots unchanged. Use copies for highlighting, redaction or explanatory notes. A simple numbered folder structure is enough; specialist forensic software is not required for an initial report.
Keep a secure backup in a separate location. Limit access to people helping you or verified institutions that need the records. Evidence can contain sensitive personal and financial information even when it contains no passwords.
Maintain a separate follow-up log
Track calls to the bank, exchange tickets, police references, requests for information and deadlines. This prevents administrative updates from obscuring the original sequence of the scam.
When a new fact appears, add it with the date learned and the source. Do not silently rewrite earlier assumptions as if you knew them at the time. Clear corrections are more credible than a perfectly polished but misleading narrative.
Checklist
- Write a short overview.
- Use dated rows linked to evidence filenames.
- Separate payments, returns and unverified balances.
- Keep originals and a separate follow-up log.
Common questions
Do I need every message before reporting?
No. Make urgent reports with the key facts and preserve the rest. Do not delay a bank call to finish a perfect timeline.
Should I include guesses about wallet ownership?
Only as clearly labelled suspicions with the basis stated. Do not present an explorer label or a scammer's claim as verified identity.