Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Preserve a suspected tech-support scam as an evidence package, not just a cropped screenshot. Capture the full browser window with the complete URL, record the date, time and time zone, make a short recording if the page changes, retain related messages and files when it is safe and lawful, hash and protect the originals, and keep notes showing who collected and handled each file. Then report through official channels while retaining the originals. A screenshot is useful context; the surrounding browser, timeline and supporting records make it far more useful to investigators.
Do not call the number on the page, download software at the scammer’s direction, enter credentials or grant remote access. If the scammer already accessed your device or accounts, secure them after the safest practical capture.
As an Amazon Associate I earn from qualifying purchases.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11What makes a scam-website screenshot useful evidence?
A useful capture shows what was displayed, where it came from and when it was seen. The strongest package preserves the visible page together with the browser context, changing states, original files and collection records. Standards guidance from the Scientific Working Group on Digital Evidence (SWGDE) recommends retaining available on-screen information such as the URL and date/time, preserving originals, making contemporaneous notes and documenting custody (SWGDE online-content guidance).
| Quick screenshot | Stronger preservation package |
|---|---|
| One image, often cropped | Original full-window images plus clearly identified working copies |
| May omit the address bar, time or browser state | Complete URL, browser context, collection time and time zone in the image or notes |
| Weak for pop-ups, redirects and countdowns | Short screen recording with focused stills for changing content |
| Little information about how it was collected | Device, browser, operator, actions, errors and an evidence inventory |
| No integrity record | Hash values where feasible, secure storage and a transfer or custody history |
| Easy to report but easy to misinterpret | Related emails, full headers, texts, phone numbers, usernames, payment records, logs and files when available |
A screenshot is not automatically admissible in every legal proceeding, and a hash does not prove who created a page. Those questions depend on jurisdiction, the investigation and how the material was collected and handled.
Popular on Amazon
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
How do I stop the scam interaction safely?
Stop the activity that could expose more information or alter the device. The FBI and FTC describe unsolicited calls, fake security warnings, urgent demands, remote-access requests and payment instructions as common tech-support-scam tactics (FBI guidance; FTC guidance).
- Do not call any number displayed by the suspicious page. The FTC says, “Real security pop-up warnings and messages will never ask you to call a phone number.”
- Do not download a remote-support utility, run a command, install an extension or open a file because the page tells you to.
- Do not type passwords, payment details, recovery codes or other personal information into the page.
- Do not grant or continue remote access. If a technician is connected, disconnect in the safest practical way and seek qualified incident-response help if you are unsure what was changed.
- If the page is still open, document what is already visible without clicking through unnecessary prompts. Do not revisit a dangerous site merely to obtain a better image.
How should I capture the page and browser context?
Make the first capture broad and untouched. Keep the address bar visible, include the entire browser window when possible and record the full URL, including its path and query string, in your notes. SWGDE defines a screenshot as a digital image of a computer display preserved electronically and recommends retaining information shown on screen, including the URL and date/time.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
-
Capture the complete visible window
Use the operating system’s window or screen-capture function rather than a tool that captures only the web page. Include the address bar, browser tabs if they help identify the context, the warning or pop-up, the displayed phone number and any visible date or clock. Save the original in the tool’s native format when practical; create a presentation copy later if a different format is needed.
-
Record time and time zone
Write the collection date and exact time in your notes and state whether it is UTC or local time. If the computer clock may be wrong, note that fact instead of silently correcting it. A visible system clock can be useful context, but the written collection record should remain the authoritative note about when you captured the material.
-
Preserve the complete URL separately
Copy the address as text into the notes without shortening it. Record redirects, suspicious subdomains, URL parameters and any URL shown in a pop-up or message. A cropped image that hides the address bar should never replace the uncropped original.
-
Make focused derivatives only after the original
You may crop or annotate a copy to point out a phone number, fake warning or payment instruction. Label it as a derivative and keep the untouched original unchanged.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.Also popular on Amazon
Anker USB-C Hub, 5-in-1 USB Hub for Laptops, 4K HDMI Multiport Adapter | USB C Dongle with 90W Max Power Delivery, 3×5Gbps USB A Data Ports, for MacBook, Dell, and More (Charger Not Included)- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
How do I preserve pop-ups, redirects and changing content?
Use a short screen recording when the page changes, opens a dialog, redirects, flashes a number or displays a countdown. SWGDE gives preference to video used with still images and recommends focused intervals so the sequence is understandable rather than a set of unrelated frames.
- Start recording before an already-visible state is likely to change.
- Include the browser chrome and address bar in the recording when possible.
- Add still images at important states: the initial warning, a redirect, a payment request, a phone number and the final visible page.
- Note the action that caused each change. Do not click links solely to create more states if doing so could download code or expose credentials.
- Keep the original recording and export a viewing copy only when necessary; document the export format and software.
What underlying records should I save?
The image shows the display, but related records can explain how the contact occurred and what happened next. IC3 lists electronic web pages, emails with full headers, hard-drive images, PCAP files, network and host logs, malware, chat transcripts and telephony logs as possible evidence (IC3 FAQ).
- Save the original web captures and screen recordings.
- Keep emails with their full headers, text messages, chat transcripts and voicemails.
- Record every phone number, username, email address, domain and web address involved.
- Retain payment confirmations, bank or card transaction details and invoices.
- Preserve relevant browser, device, network or security logs when they are already available.
- Keep downloaded or malicious files only when doing so is safe and lawful. Do not execute them or knowingly download malware to improve the record.
- Record the device model, operating system, browser and account used for the capture.
CATCH also advises keeping screenshots, account records, transaction details, phone numbers, usernames, web addresses and device information before reporting (CATCH evidence guidance).
How do I create an evidence inventory and custody record?
Give each original a stable identifier and write down enough information for another person to understand what it is without opening it. A simple spreadsheet or text log is sufficient for an initial incident, provided it is stored with the evidence and updated contemporaneously.
Record these fields for every item
- Evidence ID and original filename
- File type and file size
- Collection date, time and time zone
- Complete URL or source account
- Device, operating system and browser
- Collector or operator
- Short description of what the item shows
- Actions taken and any error messages
- Hash value, when calculated
- Storage location and every transfer or person who handled it
Write notes as events occur, not from memory later. If you discover a mistake, preserve the original note and add a dated correction rather than deleting the earlier entry.
How should I hash and store the originals?
Keep originals in controlled storage and do all cropping, annotation, conversion and report assembly on a separate working copy. Where feasible, calculate a cryptographic hash for each original file or acquired evidence set and record the algorithm and value in the inventory. A matching hash helps detect later changes; it does not establish who made the page or prove that the capture is legally admissible.
Also popular on Amazon
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
An external SSD or comparable storage medium can hold the original package and a separate working copy. It is ordinary storage, not a guarantee of encryption, forensic soundness or chain-of-custody compliance. Limit access, protect the device from loss and keep a record of transfers. For litigation, criminal investigation or high-risk technical acquisition, consult a qualified digital-forensics professional.
Where should I report a tech-support scam?
Use official reporting routes and keep the original package. The FBI directs victims of internet-enabled crime to the Internet Crime Complaint Center (IC3), the FTC accepts consumer-fraud reports through ReportFraud, and local law enforcement may be appropriate for urgent threats or matters requiring local jurisdiction (FBI tech-support-scam page; FTC recovery guidance).
IC3 submission limits
IC3’s FAQ says it does not accept evidence attachments. Describe the incident, URLs, contact details, dates, amounts and the names or identifiers of the files in the complaint, then retain the originals securely in case an agency requests them later. Do not treat the complaint form as your evidence repository.
What to include in the narrative
- How the page or caller reached you
- What the site displayed and why it appeared fraudulent
- Every relevant date and time, with time zone
- Phone numbers, domains, usernames and payment instructions
- Whether credentials, payment information or remote access were provided
- What files and records you preserved and where the originals are stored
What should I do if the scammer had remote access?
After the safest practical capture, treat the device and accounts as exposed. The FTC advises updating security software, running a scan, changing exposed passwords and enabling two-factor authentication (FTC advice for people who were scammed).
- Change passwords from a device you trust, beginning with email and financial accounts. Do not reuse an exposed password.
- Enable two-factor authentication wherever it is available.
- Run current security software and follow its remediation guidance.
- Contact banks, card issuers and payment services immediately if money or account information was involved.
- Tell an investigator or qualified technician what remote-access software, commands or files you remember seeing; do not keep experimenting on a potentially compromised system.
What does a complete evidence package contain?
Before reporting or handing material to an investigator, check that the package is understandable without additional context.
- Original, full-window screenshots with the browser context and complete URL
- A short screen recording and focused stills for changing content
- Collection notes with date, time, time zone, device, browser, operator, actions and errors
- An inventory with identifiers, file details, hashes where feasible and storage history
- A separate working copy for annotations, crops and report attachments
- Emails with full headers, texts, phone numbers, usernames, web addresses and payment records
- Relevant logs, downloaded files or network records when safely available
- A report narrative explaining what happened and where the originals are held
Or skip the browser setup
If the page can be captured safely and lawfully without entering credentials or exposing private data, ScreenshotNeo can make a screenshot API request instead of requiring a browser automation setup. It accepts the URL and can produce PNG, JPEG, WebP or PDF. For evidence work, its relevant controls include full-page capture with lazy images loaded, a CSS-selector element capture, custom viewport or device settings, waits for a selector, delay or network idle, hidden selectors, custom headers or cookies, PDF page ranges and signed webhooks for asynchronous jobs. Avoid sending sensitive cookies or authorization headers unless you understand the privacy and legal implications.
Free tools Windows power users keep installed
One-click scans. No signup required.
Also popular on Amazon
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Widely Compatible: Transform any USB-C port into a USB-A port and USB-A port into a USB-C port, and connect up a wide range of USB-C(including MacBook, iPad Pro/Air/Mini, iPhone models with USB C ports, Samsung Galaxy series, and Google Pixel series. ) and USB A devices(including external hard drives, phones, mice, printers, and more)
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
ScreenshotNeo removes cookie-consent banners, newsletter popups and chat widgets before capture, with each step configurable. Bot checks or CAPTCHAs, blank pages, timeouts, failed loads and cache hits are not billed, and the response identifies the page verdict and billing status with X-Page-Verdict and X-Billed headers. It also offers an MCP server with take_screenshot, get_page_info and capture_pdf tools for Claude, Cursor and other MCP clients.
Use the ScreenshotNeo documentation for the current parameter reference. The following examples use a safe demonstration URL; substitute a recorded URL only when revisiting it is safe and lawful.
cURL
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://example.com -o shot.webpPython
import requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://example.com"}, timeout=90)
open("shot.webp", "wb").write(r.content)Node.js
const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://example.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);ScreenshotNeo’s free plan includes 1,000 shots per month with no card. Paid plans start at $5 for 3,000 shots; yearly billing gives two months free, and every feature is included on every plan. If that fits your capture workflow, sign up for the free plan.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What can go wrong during preservation?
The address bar is missing
Keep the uncropped original if it exists, then make another full-window capture with the address bar visible. Copy the complete URL into the inventory and explain why the first image omitted it.
Recommended Free Tools
The warning or phone number disappears
Do not keep clicking randomly. Use a short recording for the state change and add focused stills, noting the action and time associated with each frame.
The page is blank, blocked or times out
Record the error, URL, browser, device and time. Do not disable security controls or download unknown software merely to force a capture; preserve what is already available and seek qualified help for higher-risk acquisition.
A report form asks for an attachment
Follow the receiving agency’s instructions. For IC3 specifically, attachments are not accepted, so describe the evidence and retain the originals securely for a later request.
Also popular on Amazon
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
You edited the only copy
Stop editing it, preserve the file as found and document what changed if you can. From then on, create a read-only or otherwise protected original and work only from copies.
How should I judge a preservation method?
Choose the method that best balances safety and completeness. The important questions are whether it preserves the full visible context, shows changing content, retains underlying records, protects originals, supports integrity checks, documents custody, secures storage and remains practical to report. A one-click image is appropriate for immediate context; a recording, inventory and protected originals are worth the extra work when the scam involved money, credentials, remote access or an ongoing investigation.
Frequently Asked Questions
Can I publish a screenshot of the scam site online?
Use a derivative copy, not an original, and remove or obscure personal information, account identifiers and unrelated third-party data before public posting. Keep the unredacted original under controlled storage and document what was redacted and why.
Does a hash prove that the website was fraudulent?
No. A hash records whether a particular file changed after it was hashed. It supports file integrity, while the page content, URL, timeline, communications and other records provide the context needed to assess the allegation.
What if the scam page has disappeared before I can report it?
Keep every capture, message and note you already made, mark the page as unavailable or redirected, and record the last time it was visible. Do not repeatedly revisit a potentially malicious domain just to confirm that it is gone.
How long should I retain the evidence?
Keep the originals securely until the relevant agency, insurer, financial institution or legal adviser says they are no longer needed. If a dispute or investigation is possible, preserve the package and its custody log rather than deleting it after submitting a complaint.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
