Records · International; recording laws vary
How to preserve scam messages before accounts disappear
Save context, exports, email headers and payment instructions without installing new software or exposing private information.
By Stonebridge Resolution · Published 4 October 2026 · Updated 4 October 2026
AI-generated illustration; not a depiction of a real case.
The short answer
Save messages with their sender details, dates and surrounding context. Use built-in exports where available, keep original files unchanged and preserve payment instructions before blocking accounts that may disappear.
Capture identity and context together
A screenshot of a single sentence may not show who sent it or when. Include the username, profile or phone number, timestamp and surrounding messages where possible. Save the profile and website address separately too.
For disappearing messages, capture what is still available without continuing risky contact. You do not need to persuade the scammer to repeat the demand or obtain a confession before reporting.
Prefer original exports alongside screenshots
Many messaging services offer a built-in export or download function. Use it where available and save media already received if safe. Screenshots remain useful for showing appearance, but a text export can make a long conversation easier to search.
Do not install an unknown 'evidence recovery' app or provide account credentials to a stranger. A tool advertised to recover deleted messages can create a new security problem.
Preserve email headers and attachments carefully
An original email file with full headers can contain routing information that a forwarded copy may omit. Use your email provider's official instructions to download or view the original.
Keep suspicious attachments without opening or running them again. If malware is a concern, ask qualified support how to handle the files safely. A screenshot of an attachment name is preferable to executing a file merely to discover what it contains.
Record payment requests precisely
Prioritise messages naming amounts, account details, wallet addresses, promised returns and withdrawal conditions. Connect each request to the corresponding bank or exchange receipt.
Save changes in instructions, including new beneficiaries and claims that a fee is refundable. Those changes may help explain the deception more clearly than hundreds of unrelated social messages.
Keep originals private and unchanged
Store an unedited copy and work from duplicates when adding notes or redacting unrelated information. Use a secure backup and a simple index of files. Avoid public links with unrestricted access.
If you consider recording a call, check local law first; rules differ. Existing call logs and a contemporaneous written note can still be useful. Never include seed phrases, passwords or authentication codes in an evidence bundle intended for general sharing.
Checklist
- Capture sender, date and surrounding context.
- Use built-in exports and original email downloads.
- Link payment demands to receipts.
- Keep unedited originals and share only through verified channels.
Common questions
Should I block the account immediately?
Prioritise safety. If safe, preserve key details first because reporting or blocking may make them harder to access. Do not prolong harmful contact for evidence.
Can screenshots be useful without an export?
Yes. Include enough context to identify the sender, date and relevant event, and keep the original files.