A screenshot by itself is weak evidence. Preserve the page or message in context, including its URL or app name, visible date and time, sender or account identity, contact details, claims, payment instructions and surrounding text. Keep the original files unchanged, make working copies, record how and when each item was obtained, and secure a duplicate in encrypted storage. Save related emails with full headers, chat and call records, payment receipts and other electronic copies of the web page. Report promptly to the FTC at ReportFraud.ftc.gov, to the FBI’s Internet Crime Complaint Center (IC3), and to the financial institution or payment service that handled any transfer.
The workflow below is designed for a suspected relief scam that could disappear, change or block access. It preserves enough context for investigators while reducing the risk that your own handling changes the evidence.
As an Amazon Associate I earn from qualifying purchases.
What to preserve before the page changes
Capture the complete page or message, not only the sentence that looked suspicious. A useful set shows how the offer appeared to you and who was behind it at that moment.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Screen and page context
- A full-page screenshot, plus additional views if the page is longer than one screen.
- The browser address bar or the app name, with the complete URL or message identifier visible.
- Any visible date, time, countdown, expiration notice or “last updated” text.
- The sender name, account handle, profile, phone number, email address, domain and other contact details.
- The relief claim, eligibility language, promises, warnings, terms and surrounding text.
- Payment instructions, wallet addresses, bank details, gift-card demands, QR codes and requested fees.
- Navigation, logos and linked pages that show the page’s relationship to the rest of the site.
Save an electronic copy of the page where possible. A browser’s “Save page” or print-to-PDF function can preserve text and layout that a single image cannot. Keep the screenshot and the electronic copy together; neither should replace the other.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Related records
IC3 identifies potentially relevant evidence as printed or preferably electronic copies of web pages, emails with full headers, hard-drive images, network or host logs, chat transcripts, telephony logs and payment records. For a consumer collection, that means retaining:
- Original emails in their native form, including full headers rather than only a forwarded body.
- Chat exports or transcript files, with attachments and the account names that appear in the conversation.
- Call logs, voicemails and text messages, including the number or account that contacted you.
- Bank, card, payment-app, wire and cryptocurrency records showing dates, amounts, recipients and transaction identifiers.
- Any confirmation, invoice, application, receipt or tracking number supplied by the sender.
Step-by-step collection procedure
1. Stop interacting long enough to document the state
Do not delete the conversation, close an account or negotiate with the sender before collecting what you can. If the page is still open, note the device, browser or app, account used and your local time. If you already paid, contact the bank, card issuer, payment app or wire service immediately; recovery options can depend on how quickly the transaction is reported.
2. Capture the page or message in context
- Open the exact URL, message or account that you received. Do not rely on a search result that may lead to a different copy.
- Take a screenshot that includes the URL or app name and the surrounding content. Scroll through long pages and capture each section in order; keep the original image files at their native resolution.
- Record visible dates and times. If the site shows none, write down the time of access in your incident log and retain the device’s time-zone setting.
- Export or save the page as PDF or HTML when the browser permits it. Keep downloaded files in a separate folder from later annotations.
- For a message thread, capture the sender identity, earlier and later messages, attachments and the thread’s message IDs or timestamps.
Do not crop away the address bar, sender identity or surrounding text merely to make an image smaller. A clean, close-up crop can be a working copy, but retain the uncropped original.
3. Make an evidence index and provenance log
Assign each item a simple identifier such as RELIEF-001 and record:
- What the item is and the file name.
- When and how it was obtained (for example, browser screenshot, native email export or payment statement download).
- The device, account and application used.
- The URL, message identifier, sender address or transaction number.
- Who handled it and when it was copied or transferred.
- Later changes, such as a page edit, account suspension, deletion or replacement URL.
This is practical chain-of-custody documentation; the cited agencies do not prescribe a consumer-specific form. A plain text or spreadsheet index is sufficient if it is kept with the collection and updated consistently.
4. Preserve originals and work only from copies
Put the first screenshots, exports and downloads in a read-only or otherwise protected “Originals” location. Do not resize, annotate, rename in a way that removes the original name, or open and resave the source files in an editor. Create a separate “Working copies” folder for redactions, highlights and files prepared for a report. FTC guidance says not to destroy forensic evidence; retaining an untouched original lets an investigator see what you changed, if anything, in a submission copy.
5. Capture volatile information quickly
Some evidence is available only briefly. CISA recommends preserving highly volatile or limited-retention evidence and, in incident-response settings, taking system images, memory captures and relevant logs. For a suspected relief scam, prioritize a disappearing message, a live chat, a page that is changing, an account that may be suspended, or a service whose logs may expire. Save the visible content first, then obtain any native export or log that the service offers. Record the failed attempt if an item cannot be exported.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
6. Preserve disappearing communications
Do not rely on disappearing-message settings as a preservation method. The FTC and the U.S. Department of Justice state: “Companies and individuals have a legal responsibility to preserve documents when involved in government investigations or litigation in order to promote efficient and effective enforcement that protects the American public.” If a government inquiry or litigation is possible, retain messages, files and account records instead of enabling auto-delete or allowing an app’s retention period to run out.
7. Secure the collection and make a duplicate
FTC guidance recommends encryption for devices, removable drives, backup media and cloud storage containing sensitive personal information. Keep the original set separately from a duplicate on an encrypted external drive or equivalent secure storage. Limit access, use a strong device or account passcode, and avoid leaving the only copy on the phone or computer that received the scam. The duplicate should be available for a submission without exposing the protected originals to accidental edits.
How to make screenshots that remain understandable
Use a sequence, not a single dramatic image
For a long landing page, number files in viewing order and include a first image that establishes the URL and page title. Follow with full-width sections showing the offer, eligibility language, payment demand and contact information. If a popup obscures text, capture one image with the popup visible and another after closing it, documenting that action in the index.
Preserve what the viewer could actually see
Do not add arrows, captions or color changes to the original. If an investigator needs a highlighted version, create it from a working copy and label it as annotated. Keep the browser or app’s own date and time indicators when they are part of the message. A separate log entry can explain your local time zone, device and access time without altering the image.
Free tools Windows power users keep installed
One-click scans. No signup required.
Save the underlying file when available
Native email, chat and payment exports preserve details that may not appear in a screenshot. Keep those files in their original format and, where a service offers both a human-readable export and a machine-readable download, retain both. A PDF is useful for easy review; the original HTML, message export or statement remains the better source for verification.
Or skip the browser setup
ScreenshotNeo can capture a URL with one request when you need a repeatable page copy. Before capture it accepts the cookie or consent banner like a visitor and removes more than 60 known consent platforms, newsletter popups and chat widgets; each step can be turned off. That produces a clean reference image, but retain your ordinary browser capture as well when the overlay itself is relevant to the suspected scam.
Only clean shots are billed. Bot checks or CAPTCHAs, blank pages, timeouts, failed loads and cache hits cost nothing, and each response reports the result in the X-Page-Verdict and X-Billed headers. The API supports full-page captures with lazy images loaded, a CSS-selector element capture, dark mode, device presets or a custom viewport, retina scale, PDF output with paper size, margins, landscape and page ranges, HTML/CSS-to-image, custom CSS and JavaScript, a click before capture, hidden selectors, waits for a selector, delay or network idle, blocked ads, trackers, requests or resource types, custom headers, cookies, user agent and Authorization, timezone and geolocation, transparent backgrounds, image resizing, a chosen cache TTL, signed links, asynchronous jobs with signed webhooks, bulk capture of up to 100 URLs per call, a usage API and an OpenAPI specification. Parameter names used by other screenshot APIs also work, which can simplify a switch.
See the ScreenshotNeo documentation for authentication and options. The following examples use a demonstrative URL; replace it with the exact suspected page you recorded.
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
cURL
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://example.com/relief-offer -o shot.webpPython
import requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://example.com/relief-offer"}, timeout=90)
open("shot.webp", "wb").write(r.content)Node.js
const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://example.com/relief-offer' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);ScreenshotNeo also provides an MCP server with take_screenshot, get_page_info and capture_pdf tools for Claude, Cursor and other MCP clients. That can help an AI-assisted workflow collect a page and its metadata, but you should still retain the URL, access time, original browser evidence and provenance log yourself. The Free plan includes 1,000 screenshots per month with no card; paid plans start at $5 for 3,000 screenshots. Sign up for the free plan before collecting a larger set.
Choosing storage for the evidence set
No agency guidance identifies a required brand, model or retailer. Choose a method that matches the sensitivity and size of your collection, then keep an offline duplicate where practical.
| Storage method | Encryption support | Offline duplicate | Capacity for images, video and logs | Accidental-deletion protection | Handoff to investigators |
|---|---|---|---|---|---|
| Encrypted external or removable drive | Strong when device or volume encryption is enabled and the passcode is protected | Yes; it is the most direct offline option | Usually suitable for a growing mixed collection; capacity depends on the drive | Keep an untouched Originals folder and a separate working folder | Copy selected files to another drive without exposing the entire computer |
| Encrypted cloud storage | Depends on the provider, account security and encryption settings | Only if you also export a local copy | Scales with the account’s available space | Version history or retention can help, but verify settings | Share a controlled copy or download package; avoid public links |
| Computer or phone only | Depends on the device’s encryption and login protection | No, unless you copy it elsewhere | Limited by local storage | Vulnerable to deletion, loss or device failure | Easy to show, but risky as the sole repository |
Reporting and financial response
Report the fraud
File a report with the FTC at ReportFraud.ftc.gov and with the FBI’s IC3 for internet-enabled fraud. Include a concise timeline, the evidence index, the original URL or account identifier, payment details and any later deletion or suspension. FTC says reports help build cases and identify trends. The FBI says rapid IC3 reporting can support recovery.
Contact the payment provider immediately
Call the bank, card issuer, payment app or wire service as soon as money was sent. Give the transaction date, amount, recipient, confirmation number and a factual description of the deception. Ask what reversal, recall or fraud claim process applies and record the case number and representative’s name. Preserve every reply with the rest of the evidence.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchShare copies, not the only originals
Ask what format and size the recipient accepts. Provide a working copy or export package while keeping the protected Originals set. If an investigator specifically requests an original device or file, document what was transferred, when, to whom and by what method.
Common mistakes and how to correct them
Only saving a cropped screenshot
Problem: The image omits the URL, sender or surrounding claim. Fix: Reopen the source if possible, capture the complete context and preserve the first crop as a working copy rather than replacing it.
Editing or renaming the only file
Problem: Annotations and resaves make it difficult to establish what was originally received. Fix: Restore the untouched file from your earliest backup, then perform edits only on a copy and record them.
Rank #4
- Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Waiting for a perfect export
Problem: A disappearing message, live chat or changing page is gone while you search for a specialized tool. Fix: Capture what is visible immediately, then pursue native exports, logs and a cleaner copy.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsKeeping the collection on one device
Problem: Loss, damage or account compromise destroys the only set. Fix: Encrypt a duplicate on separate storage and verify that it opens before deleting anything from the source device.
Sending sensitive originals through ordinary email
Problem: Personal and financial information may be exposed or altered during forwarding. Fix: Ask the recipient for a secure upload method and send a controlled copy with the evidence index.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshooting evidence gaps
The site now returns an error or blank page
Keep the screenshot, URL, access time and error text. Check browser history, saved files, email links and payment records for the exact address. Do not substitute a similarly named domain without labeling it as a different item.
The screenshot has no visible timestamp
Retain the file’s original creation information, record the access time and time zone in your provenance log, and pair the image with a dated email, payment record or message export that independently places the event in time.
You cannot obtain full email headers
Keep the native message file or the provider’s “download original” export if available. Preserve the visible sender, recipient, subject, date and message ID, and note in the index that full headers were unavailable.
A service deleted the account or chat
Record the account name, profile URL, deletion notice and the time you discovered the change. Preserve notifications, screenshots and any local export; do not claim that a missing record never existed.
Best Value
- [Upgraded Version] - This external hard drive features a mirrored logo stripe combined with a striped anti-slip design, and the rounded corners of the casing make it easier to grip. The stripes also have a heat dissipation function, ensuring stable and fast data transfer.
- 【Ultra-thin and quiet】 - The motherboard adopts JMicron 578 noise-free solution, giving you a quiet working environment. Lightweight and portable size designed to fit in your pocket for easy portability.
- 【Ultra-Fast Data Transfers】 - Pairing this external hard drive with JMicron 578 solution USB 3.0 and USB 2.0 interfaces enables blazing-fast data transfer. It boasts theoretical read speeds of up to 125MB/s and write speeds of up to 103MB/s.
- 【Plug and Play】 - With no software to install, just plug it in and the drive is ready to use.The hard disk chip is wrapped with an aluminum anti-interference layer to increase heat dissipation and protect data.
- 【What You Get】 - 1 x Portable Hard Drive, 1 x USB 3.0 Cable, 1 x User Manual, Gift-type shell packaging ,Three-year manufacturer's warranty and free technical support services.
A capture contains personal information unrelated to the scam
Keep the unmodified original in protected storage. Redact only a working copy for a report when the recipient does not need the unrelated information, and describe the redaction in the index.
The API capture is blocked or incomplete
Use the browser capture as the primary record, then try an appropriate wait condition, full-page mode, custom user agent, headers or cookies in the API. A bot check, timeout, blank page or failed load is reported as such by ScreenshotNeo and is not billed, but it is not a substitute for documenting what your own browser displayed.
Questions people often ask
Should I print everything?
Paper can be useful for a quick review, but retain electronic originals whenever possible. Electronic files preserve context, headers, logs and payment details that paper cannot.
Can I rely on a screenshot’s file date as proof?
No single file property establishes the whole timeline. Treat the file date as one entry in your provenance record and corroborate it with access notes, message timestamps, statements and exports.
What if I am unsure whether the offer is actually fraudulent?
Preserve the material without accusing the sender in your notes. Describe what was promised, requested and observed, then let the FTC, IC3 or your payment provider assess it.
Is a clean automated screenshot better than the page I saw?
It can be easier to read and reproduce, but it may remove consent banners, popups or chat widgets that are themselves relevant. Keep the ordinary browser capture and use the clean copy as an additional reference.
Recommended Free Tools
How long should I keep the files?
Keep them until any bank claim, platform dispute, government inquiry or legal matter is resolved, or until the agency handling your report gives different instructions. Preserve them securely rather than deleting them when the webpage disappears.
Frequently Asked Questions
What is the minimum useful evidence set?
Keep an uncropped screenshot or page export showing the URL or app, the surrounding claim, sender identity and payment instructions, plus the original email or chat export, payment record and a provenance note with access time and device.
Should I send my originals with an FTC or IC3 report?
Submit the format requested and keep the untouched originals in protected storage. Work from copies unless an investigator specifically requests an original file or device, and document any transfer.
What should I do if the scammer asks for another payment while I collect evidence?
Stop engaging, preserve the request and contact your bank, card issuer, payment app or wire service immediately. Include the new request and its timestamp in the evidence index.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Can an automated screenshot prove who operated a website?
It documents what a URL displayed at a particular time; attribution usually requires additional account, domain, payment, communication or provider records. Preserve all of those related records instead of relying on the image alone.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
