All insights
First Response
What to preserve immediately after suspected online fraud
August 20267 min read
The first hours after discovering suspected fraud can determine how much reliable evidence remains available. Preserve first; investigate second.
Do not delete or reorganize the evidence
Keep original messages, emails, files and account records in their existing locations. Screenshots can help with quick review, but they should not replace original data.
- Keep complete conversations
- Preserve email headers
- Record account identifiers
- Avoid editing original files
Create a transaction record
Build a chronological list of every transfer, including dates, amounts, currencies, destination details and transaction references.
- Bank references
- Wallet addresses
- Transaction hashes
- Exchange or platform names
Secure affected accounts
Change credentials from a known-clean device, enable multi-factor authentication and contact relevant financial providers through verified channels.