iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Save the evidence before you block, delete, or warn the person. Preserve the scammer’s profile and identifiers, complete communications, payment and cryptocurrency records, and a dated timeline. Keep the original files unchanged in secure storage, then report to the FBI’s Internet Crime Complaint Center (IC3), the Federal Trade Commission (FTC), the dating or messaging service, and your financial institution. If money moved recently, ask the institution immediately whether the transfer can be stopped or reversed.
You can still report if some messages or transaction details are missing. Submit what you have and explain what is unavailable; do not delay a report while trying to reconstruct a perfect file.
Save these four evidence groups first
Work in this order because accounts can disappear, messages can be unsent, and payment providers have short response windows.
| Evidence group | What to preserve | Why it matters |
|---|---|---|
| Identity and account clues | Profile URL, username, claimed name, email addresses, phone numbers, payment handles, wallet addresses, domains, websites, applications, exchanges, and any account IDs. | These identifiers let platforms, banks, and investigators connect accounts that use different names. |
| Complete communications | Full chat exports, texts, emails with full headers where available, voicemail and call records, and screenshots that show dates, usernames, and surrounding context. | A single cropped message can hide how the contact began, how money was requested, or whether a message was edited. |
| Payment records | Bank statements, canceled checks, card and wire receipts, money-order and prepaid-card receipts, payment-provider case numbers, and cryptocurrency transaction details. | Financial institutions need exact transaction information to investigate a transfer or attempt a recall. |
| Timeline and narrative | When and where you met, when the conversation moved off-platform, promises or emergencies, every request and payment, and when you recognized the fraud. | IC3 and the FBI ask for incident details in chronological form. |
Capture the account and identity clues
Save the profile before reporting it
- Open the person’s profile while you are still signed in.
- Copy the complete profile URL, including the username or account ID in the address bar. If the service uses an app with no visible URL, record the platform name, display name, username, profile ID, and the date and time you viewed it.
- Take screenshots of the profile, profile photo, biography, location, employment or relationship claims, and any verification badge. Include the device clock or another visible date indicator when practical.
- Record every linked website, social account, email address, phone number, payment handle, wallet address, domain, and application the person asked you to use. Do not click an unfamiliar link merely to obtain more evidence.
Do not assume the claimed name is the person’s legal identity. Label it as a claimed name and preserve the exact spelling, capitalization, and punctuation used on the account.
#1 Best Overall
- Certified to FIPS 197 - High-level information security standard approved by the U.S. Government
- Brute-Force Password Attack Protection - Data is automatically erased after 6 failed access attempts. The data and encryption key are securely destroyed and the crypto drive is reset
- Rugged Double-Layer Waterproof* Design - Protects the crypto drive against knocks, drops, break-in and submerging in water. The electronics are shielded by a hardended inner case. The rubberised silicone outer casing provides a final layer of protection
- Auto-lock - The crypto drive will automatically encrypt all data and lock when removed from a PC/Mac or when the screen saver or "computer lock" function is activated on the host PC/Mac
- Secure Entry - Data cannot be accessed without the correct high-strength alphanumeric 8-16 character password. A password hint option is available. The password hint cannot match the password
Preserve URLs safely
Paste each URL into a plain-text evidence index rather than relying only on a screenshot. Keep the original link exactly as shown, note which platform it belongs to, and record whether it required you to be logged in. If a page later becomes unavailable, the saved URL and dated screenshot still show where the account existed.
Save complete communications, not isolated excerpts
Chats and text messages
- Use the service’s export or download function if one exists. Prefer the complete conversation, including dates, sender names, attachments, and message IDs.
- Save screenshots of key screens as a readable supplement. Capture the conversation header, username, date separators, and enough messages above and below each money request to show context.
- Save images, videos, voice notes, and documents separately. Keep the filename supplied by the service when possible, and note which message contained the attachment.
- Do not edit, annotate, crop, filter, or re-save the only copy. Make a working copy if you need to highlight a sentence.
If the app supports disappearing messages, photograph or capture the screen promptly and record that the messages were configured to disappear. Do not ask the person to resend a message or continue the conversation just to obtain a cleaner record.
Save the entire email, not just a screenshot of the body. Download the original message file when the mail service offers that option, and retain the full headers. Headers can show routing and account details that are absent from a visible copy. Also save the sender address, reply-to address, subject, date, attachments, and any links without opening suspicious destinations.
Recommended Free Tools
Calls and voicemail
Record the phone number exactly as displayed, including country code, call dates and times, direction (incoming or outgoing), duration, and your carrier’s call-log entry. Preserve voicemail audio in its original format and make a written transcription for quick reference. A transcription is a convenience; it does not replace the audio file.
Preserve payment and cryptocurrency records
Traditional payments
Gather the record for every transaction, even if the amount was small. Save bank statements, canceled checks, card receipts, wire confirmations, money-order receipts, prepaid-card receipts, payment-app receipts, and the provider’s case or dispute number. Include the recipient name or handle, account or card ending, amount, currency, date, time, and confirmation number.
Cryptocurrency
For each crypto transfer, record the wallet address you sent to, the asset type, amount, date and time, network if shown, exchange or wallet used, and the transaction hash (also called a transaction ID). Download the exchange or wallet receipt and capture the page that displays the transaction status. A blockchain explorer link can be useful, but keep the hash itself in your index because an explorer page may change or become unavailable.
Rank #2
- Certified to FIPS 197 - High-level information security standard approved by the U.S. Government
- Brute-Force Password Attack Protection - Data is automatically erased after 6 failed access attempts. The data and encryption key are securely destroyed and the crypto drive is reset
- Auto-lock - The crypto drive will automatically encrypt all data and lock when removed from a PC/Mac or when the screen saver or "computer lock" function is activated on the host PC/Mac
- Secure Entry - Data cannot be accessed without the correct high-strength alphanumeric 8-16 character password. A password hint option is available. The password hint cannot match the password
- SuperSpeed USB 3.0 - Transfer all your confidential files and folders faster than ever before. Works on both PC & Mac
Never send additional cryptocurrency to “unlock” a refund or to pay a recovery service. Preserve those requests as evidence and report them as part of the same incident.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteBuild a dated timeline that another person can follow
Write the timeline while details are fresh. Use your local time zone and identify the platform for every event. A simple table is enough:
| Date and time | Platform or channel | Event | Evidence filename or reference |
|---|---|---|---|
| 2026-09-03 20:15 UTC−5 | Dating app | First contact; profile used the name shown in the account. | profile-2026-09-03.png; chat-export.zip |
| 2026-09-10 07:40 UTC−5 | Encrypted messenger | Conversation moved off the dating app; person described an emergency. | chat-2026-09-10.pdf |
| 2026-09-11 09:02 UTC−5 | Bank transfer | Transfer sent after the request. | bank-receipt-001.pdf |
| 2026-09-18 18:30 UTC−5 | Dating app | Profile disappeared; suspected fraud. | profile-unavailable.png |
Describe facts in neutral language: what was said, what you did, and what you observed. Separate a direct quote from your interpretation. Include the first place you encountered the person, every move to another platform, each request, each payment, and the moment you concluded it was a scam.
Keep originals unchanged and make them retrievable
Use a two-copy workflow
- Create a folder with the date and a neutral incident name, then copy original exports, receipts, audio, and screenshots into it.
- Set the original folder to read-only or store it on encrypted removable media. Do not rename files inside the original set if the export generated meaningful names.
- Make a working copy for sorting and redaction. Keep a separate index that maps each event in the timeline to a filename.
- Store a second encrypted backup in a different physical or cloud location. Restrict access to people who need it.
These practical organization choices balance four goals: completeness (full exports rather than excerpts), integrity (unchanged originals), retrievability (clear chronological names and an index), and security (encrypted storage and a separate backup). No particular consumer forensic format is required by the agencies cited here.
Use clear filenames
A consistent pattern such as 2026-09-11_bank-transfer_450-USD.pdf or 2026-09-10_messenger_chat-export.zip makes a large case easier to review. Keep a note explaining your time zone and any filename changes made only in the working copy.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesWhat IC3 and other agencies need
IC3 is the FBI’s central repository for cyber-enabled crime complaints. Its guidance lists electronic or printed emails (preferably with full headers), web pages, chat transcripts, and telephony logs as possible evidence. FBI cryptocurrency guidance asks for communications, names, email addresses, phone numbers, domains, websites, applications, exchanges, and a timeline.
Rank #3
- Certified to FIPS 197 - U.S. Government Approved High Level Information Security Standard.
- Protection against brute force password attacks - Data is automatically erased after 6 unsuccessful access attempts. The data of the USB flash drive type c encryption with dual connectors is destroyed and the cryptographic drive is reset.
- Durable dual-layer waterproof design* — Protects the crypto reader from bumps, drops, run-in and immersion in water. The electronics are protected by a hardened internal case. Rubberized silicone outer case provides a final layer of protection.
- Auto-Lock —The cryptographic key automatically encrypts all data and locks when removed from a PC/Mac or when screen protection or "computer lock" is enabled.
- Secure Entry —Data on these flash drives cannot be accessed without the correct alphanumeric password of 8 to 16 characters. A password indication option is available for this flash drive. The hint cannot match the password.
IC3 does not accept attachments with the online complaint. Paste the important facts into the form, identify the files you retained, and keep the originals because investigators may request them later. Save or print a copy of your submitted report before closing the page; the IC3 FAQ gives that instruction directly.
Report the incident to:
- IC3: Include the complete timeline, identifiers, payment details, wallet addresses, and transaction hashes.
- FTC: Report the impersonation, contact method, money request, and payment route. Reporting helps investigators identify patterns.
- The dating or messaging platform: Use the account-report function and provide the profile URL or username.
- Your local law-enforcement agency or an FBI field office: Consider this when there is an immediate threat, significant loss, stalking, extortion, or another local safety concern.
Contact the financial institution immediately
Do this before spending hours organizing files. Tell the institution that the transfer was induced by a romance scam, give the transaction reference, and ask whether it can be stopped, recalled, disputed, or reversed. Keep the representative’s name, call time, case number, and instructions.
| Payment method | Contact | Information to have ready |
|---|---|---|
| Bank transfer or wire | Bank or wire service fraud department | Recipient details, amount, date, confirmation number, and receiving institution if shown. |
| Credit or debit card | Card issuer | Merchant or recipient name, amount, date, and dispute or replacement request. |
| Payment app | App provider and linked bank or card | Username, transaction ID, amount, and screenshots of the request. |
| Gift or prepaid card | Issuer | Receipt, card number, purchase date, and redemption details. Do not share remaining codes with the scammer. |
| Cryptocurrency | Exchange or wallet provider | Wallet address, asset, amount, timestamp, network, and transaction hash. |
The FTC says it is worth asking the payment company whether money can be recovered. Recovery is not guaranteed, but delay removes options.
Free tools Windows power users keep installed
One-click scans. No signup required.
If your identity information was exposed
If you sent a copy of an identity document, account credentials, Social Security number, bank details, or other sensitive information, change affected passwords from a trusted device and enable multi-factor authentication where available. Ask the credit bureaus about a fraud alert or credit freeze, and monitor financial accounts for unfamiliar activity. CFTC guidance recommends these protective steps when information was provided to fraudsters.
Save evidence before changing a compromised account when it is safe to do so. If the scammer still has access, use a separate trusted device or ask the provider for an account-recovery procedure.
When messages or transaction details are missing
Deleted or unsent messages
Report with the remaining profile information, screenshots, notifications, call logs, receipts, and timeline. State which messages were deleted, by whom if known, and when. Check the service’s export, archive, recently deleted, or account-download options, but do not install an untrusted “recovery” application.
Rank #4
- FIPS 197 with XTS-AES 256-bit Encryption: Provides business-grade security with hardware-based encryption to protect your sensitive data
- Brute Force and BadUSB Attack Protection: Safeguards against unauthorized access attempts and malicious USB attacks with digitally-signed firmware
- Multi-Password Option with Complex/Passphrase modes: Offers flexible password configuration options to meet various security requirements and user preferences
- New Passphrase Mode: Enhanced security feature allowing users to create longer, more memorable password phrases for easier access without compromising protection
- Dual Read-Only (Write-Protect) Settings: Enables write protection functionality to prevent accidental data modification or deletion when needed
Unknown wallet address or incomplete receipt
Submit the exchange account, approximate date and amount, asset type, and any partial transaction ID. Explain what is missing. FBI guidance says to report with whatever information is available, including when transaction information is incomplete.
Account disappeared before you captured it
Keep the platform name, claimed name, username fragments, profile photo, notification emails, and the date you saw the account. Ask the platform to preserve its records through the report process; do not create a new account to contact the person.
Common mistakes and safer fixes
- Blocking too early: Export and capture the profile and conversation first, unless staying connected creates a safety risk.
- Saving only cropped screenshots: Capture headers, usernames, dates, and surrounding messages, then retain the complete export.
- Editing the only copy: Keep an untouched original and edit only a working copy.
- Sending evidence as an email attachment to IC3: IC3’s online form does not accept attachments; paste the facts and retain the files.
- Waiting for a perfect file: Report promptly with what you have and update the institution or platform if new evidence appears.
- Confronting the scammer: Do not threaten, bargain, or send more money. Continued contact can increase risk and destroy messages.
- Publishing private data: Share evidence with reporting channels, your financial institution, and trusted advisers—not publicly.
Or skip the browser setup
If you need a clean capture of a public profile or other page you are authorized to access, ScreenshotNeo can return a screenshot or PDF through one request. It accepts cookie or consent banners as a visitor and removes more than 60 known consent platforms, newsletter popups, and chat widgets before capture; each step can be turned off. Bot checks, CAPTCHAs, blank pages, timeouts, failed loads, and cache hits are not billed, and response headers identify the page verdict and whether it was billed. Do not use a screenshot API to bypass a private account, expose someone else’s personal data, or replace the original export.
See the ScreenshotNeo API documentation for request options. The following examples use the supplied public demonstration URL; replace only the target URL with a public page you are authorized to capture.
cURL
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpPython
import requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://stripe.com"}, timeout=90)
open("shot.webp", "wb").write(r.content)Node.js
const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);ScreenshotNeo also provides an MCP server with take_screenshot, get_page_info, and capture_pdf tools for Claude, Cursor, and other MCP clients. Every plan includes its features. Pricing is Free for 1,000 shots per month with no card, Starter $5 for 3,000, Growth $15 for 15,000, Pro $39 for 60,000, Scale $99 for 250,000, and Business $249 for 1,000,000; yearly billing gives two months free. Sign up free to get 1,000 screenshots a month without a card.
FAQ
Can a screenshot prove that the profile belongs to a real person?
No. A screenshot preserves what was displayed at a particular time; it does not authenticate the person behind the account. Treat it as contextual evidence alongside platform identifiers, communications, and payment records.
Should I keep talking to the person to collect more evidence?
No. Preserve what is already available, stop sending money, and use the platform’s reporting process. Continuing contact can create additional financial and personal-safety risk.
Best Value
- FIPS 140-3 Level 3 (Pending) Certified Military-Grade Security
- OS/Device Independent
- XTS-AES Hardware Encryption
- Enforced Alphanumeric PIN
- Multi-PIN (Admin and User) Option
What if I have only a username?
Report it anyway. Include the platform, username spelling, profile URL or ID if available, dates of contact, and any connected payment or phone details. Agencies and platforms can work from partial information.
Frequently Asked Questions
Can a screenshot prove that the profile belongs to a real person?
No. It shows what was displayed at a particular time but does not authenticate who controlled the account. Pair it with platform identifiers, communications, and payment records.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Should I keep talking to the person to collect more evidence?
No. Preserve what you have, stop sending money, and report the account. Continued contact can increase financial and personal-safety risks.
What if I have only a username?
Report it anyway with the platform name, exact username, profile URL or ID if available, contact dates, and any linked payment or phone details.
The Bottom Line
Preserve complete communications, account identifiers, payment or crypto records, and a dated timeline before deleting or blocking anything. Keep originals secure, contact the payment provider immediately, and report through IC3, the FTC, the platform, and appropriate law-enforcement channels.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →
