Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Save the scammer’s profile and identifiers, complete communications, payment records, and a dated timeline before you block or delete anything. Keep the original files unchanged in secure storage, make working copies for reports, and contact your bank or payment provider immediately about stopping or reversing transfers.
Report with what you have to the FBI’s Internet Crime Complaint Center (IC3), the Federal Trade Commission (FTC), the dating or messaging service, and—when appropriate—local law enforcement or an FBI field office. IC3 does not accept attachments, so retain every original in case investigators request it later.
As an Amazon Associate I earn from qualifying purchases.
Start with a preservation checklist
Work through this list before confronting the person, closing an account, or resetting a device. If a message or transaction is unavailable, continue with the other evidence; the FBI says you can still report when some transaction information is missing.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →- Account and identity clues: profile URL, username, claimed name, email addresses, phone numbers, payment handles, wallet addresses, domains, websites, and applications the person directed you to use.
- Complete communications: exported chats, texts, emails, voicemails, call records, and screenshots showing dates, usernames, and surrounding context.
- Payment proof: bank and card statements, canceled checks, wire receipts, money-order receipts, prepaid-card receipts, payment-provider case numbers, and any confirmations or invoices.
- Cryptocurrency details: wallet address, asset type, amount, date and time, transaction hash, exchange or wallet used, and the related conversation.
- A dated timeline: when and where contact began, when it moved off-platform, promises or emergencies used to request money, every request and payment, and when you recognized the fraud.
- Original files: untouched exports, downloaded attachments, email files with headers, and the device or account on which they were obtained.
Capture the scammer’s profile and account trail
Save the profile before reporting it
Open the profile while you are still logged in and record the complete URL, displayed username, claimed name, profile text, photos, listed location, and account creation or activity details if shown. Take screenshots that include the browser address bar, the account name, and enough surrounding page context to establish what you saw. Save the page as a PDF or web archive when the service permits it, but treat that as a working copy rather than a substitute for the live account record.
#1 Best Overall
- Certified to FIPS 197 - High-level information security standard approved by the U.S. Government
- Brute-Force Password Attack Protection - Data is automatically erased after 6 failed access attempts. The data and encryption key are securely destroyed and the crypto drive is reset
- Rugged Double-Layer Waterproof* Design - Protects the crypto drive against knocks, drops, break-in and submerging in water. The electronics are shielded by a hardended inner case. The rubberised silicone outer casing provides a final layer of protection
- Auto-lock - The crypto drive will automatically encrypt all data and lock when removed from a PC/Mac or when the screen saver or "computer lock" function is activated on the host PC/Mac
- Secure Entry - Data cannot be accessed without the correct high-strength alphanumeric 8-16 character password. A password hint option is available. The password hint cannot match the password
Record every identifier separately in a plain-text index. Include spelling, capitalization, punctuation, and any numbers in the username. A scammer may change a display name while leaving a handle, email address, phone number, payment tag, domain, or wallet address unchanged.
Preserve linked services and instructions
Scammers often move conversations to another application or send a link to a website, investment dashboard, payment page, or messaging service. Save each URL exactly as displayed, the date and time you opened it, and the application or service you were told to install. Do not revisit a suspicious site from a device containing sensitive accounts unless necessary; capture the address and context first, then ask a security professional or law-enforcement contact about safe access.
Save complete communications, not isolated screenshots
Export the whole conversation
Use the platform’s download or data-export function whenever available. Preserve the resulting file in its original format. For email, keep the message file with full headers when possible; headers can show routing and account details that are absent from a screenshot. For texts and chat apps, export the conversation or save a continuous sequence that includes dates, usernames, attachments, and the messages immediately before and after a money request.
Take targeted screenshots as a visual index
Screenshots are useful for showing how an account appeared and for helping a reviewer find important passages quickly. Capture:
- the profile page with the URL or account identifier visible;
- the first contact and the point where the conversation moved off-platform;
- statements of identity, location, occupation, or relationship;
- promises, emergencies, secrecy requests, or investment claims;
- every request for money and the instructions for sending it;
- messages acknowledging receipt, disputing a payment, or threatening consequences;
- the account’s disappearance, blocking, name change, or deletion notice.
Keep the surrounding context. Cropping a single sentence can remove dates or preceding messages that explain what happened. Do not annotate the original screenshot; add notes in a separate file that identifies the screenshot filename and what it shows.
Include calls and voicemails
Save voicemail audio, call logs, caller-ID information, and any written notes made immediately after a call. Note the phone number shown, date, start time, duration, and whether the call was incoming or outgoing. Do not secretly record a new call unless doing so is lawful where you are; existing voicemail and call-log records can still be preserved and reported.
Rank #2
- Certified to FIPS 197 - High-level information security standard approved by the U.S. Government
- Brute-Force Password Attack Protection - Data is automatically erased after 6 failed access attempts. The data and encryption key are securely destroyed and the crypto drive is reset
- Auto-lock - The crypto drive will automatically encrypt all data and lock when removed from a PC/Mac or when the screen saver or "computer lock" function is activated on the host PC/Mac
- Secure Entry - Data cannot be accessed without the correct high-strength alphanumeric 8-16 character password. A password hint option is available. The password hint cannot match the password
- SuperSpeed USB 3.0 - Transfer all your confidential files and folders faster than ever before. Works on both PC & Mac
Document every payment, including cryptocurrency
Traditional payments
Download statements and confirmations rather than relying on an account’s current balance. Keep the date, amount, currency, recipient or destination, confirmation number, and the institution’s name. Preserve receipts for wires, checks, money orders, prepaid cards, and cash-equivalent instruments. If you already contacted a bank, card issuer, wire service, or payment app, save the case number, representative’s instructions, and time of contact.
Recommended Free Tools
Cryptocurrency payments
For each transfer, copy the exact destination wallet address, asset type, amount, date and time, and transaction hash. Record the exchange, wallet, or service used to initiate it and save the related deposit or withdrawal record. A blockchain explorer link can be useful as a working reference, but retain the hash and address in plain text because an explorer’s presentation can change.
Keep the conversation that connects the transfer to the request. A transaction hash alone may not show who controlled the destination address; the messages, account identifiers, and timeline provide that context. Do not send additional cryptocurrency to “recover” funds or to unlock a supposed refund.
Build a dated timeline investigators can follow
Create one chronological document with a row or paragraph for each event. Use your local time zone consistently and identify the source file for every entry.
| Date and time | Event | Evidence filename or identifier |
|---|---|---|
| 2026-01-12 18:40 | First contact on a dating platform; username recorded. | profile_2026-01-12.png; chat_export.zip |
| 2026-01-19 21:10 | Conversation moved to another application; new phone number provided. | chat_0021.png; phone_index.txt |
| 2026-02-03 09:15 | Emergency request; instructions for a wire transfer. | chat_0048.png; wire_receipt.pdf |
| 2026-02-03 10:02 | Transfer sent; confirmation number saved. | bank_statement.pdf; confirmation.txt |
Those dates are an organizational example, not a required format. Explain where you first encountered the person, when trust-building changed into requests for money, each payment, and when you concluded it was fraud. If you are unsure of a date, label it as approximate instead of guessing.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Preserve originals and make secure working copies
Use an integrity-first folder structure
Keep an untouched “Originals” folder or storage device. Make a separate “Report copies” folder for files you rename, redact, or attach to a form. Use clear filenames such as 2026-02-03_0915_chat_request.png and maintain an index listing the original filename, date captured, source account, and a short description.
Rank #3
- Certified to FIPS 197 - U.S. Government Approved High Level Information Security Standard.
- Protection against brute force password attacks - Data is automatically erased after 6 unsuccessful access attempts. The data of the USB flash drive type c encryption with dual connectors is destroyed and the cryptographic drive is reset.
- Durable dual-layer waterproof design* — Protects the crypto reader from bumps, drops, run-in and immersion in water. The electronics are protected by a hardened internal case. Rubberized silicone outer case provides a final layer of protection.
- Auto-Lock —The cryptographic key automatically encrypts all data and locks when removed from a PC/Mac or when screen protection or "computer lock" is enabled.
- Secure Entry —Data on these flash drives cannot be accessed without the correct alphanumeric password of 8 to 16 characters. A password indication option is available for this flash drive. The hint cannot match the password.
Store the originals in encrypted storage with a strong, unique password. Keep a second backup in a different physical location or secured cloud account. A read-only or write-protected copy can reduce accidental changes. Storage hardware does not prove that a file is authentic; authenticity comes from retaining the unaltered source and documenting how and when you obtained it.
Do not alter or destroy source data
Do not edit, filter, compress, or resave the only copy of a screenshot, export, audio file, email, or receipt. If you must redact an account number for a report, preserve the complete original separately and label the redacted version. Do not factory-reset a phone or delete an account until you have completed exports and backups.
What IC3 and other agencies need
IC3’s complaint form asks for specific incident details. Prepare a concise narrative that identifies the person or account, explains how contact began, describes the deception, lists each payment, and states when you recognized the fraud. Include names, email addresses, phone numbers, domains, websites, applications, exchanges, wallet addresses, transaction hashes, and the timeline where applicable.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteIC3 does not accept attachments. Enter the important identifiers and facts into the form, then save or print a copy of your submitted report before closing the page; the IC3 FAQ specifically advises keeping a copy. Retain the originals and your evidence index for any follow-up request.
Report the same core facts to the FTC and the dating or messaging platform. Use the platform’s abuse or fraud-report mechanism and include the profile URL and username so moderators can locate the account. Contact local law enforcement or an FBI field office when the loss is substantial, threats are involved, or an officer advises you to do so.
Act immediately when money or identity data is involved
Ask whether a transfer can be stopped or reversed
Call the bank, card issuer, wire service, gift-card company, payment app, or cryptocurrency exchange immediately using a trusted number from its official website or statement. Tell the representative that the transaction is connected to fraud, provide the amount and confirmation number, and ask whether a stop, recall, chargeback, or reversal is possible. Recovery is not guaranteed, but delay can remove options.
Rank #4
- FIPS 197 with XTS-AES 256-bit Encryption: Provides business-grade security with hardware-based encryption to protect your sensitive data
- Brute Force and BadUSB Attack Protection: Safeguards against unauthorized access attempts and malicious USB attacks with digitally-signed firmware
- Multi-Password Option with Complex/Passphrase modes: Offers flexible password configuration options to meet various security requirements and user preferences
- New Passphrase Mode: Enhanced security feature allowing users to create longer, more memorable password phrases for easier access without compromising protection
- Dual Read-Only (Write-Protect) Settings: Enables write protection functionality to prevent accidental data modification or deletion when needed
Protect exposed accounts and identity information
If you provided passwords, identity documents, account numbers, or other personal data, change affected passwords from a clean device and enable multifactor authentication where available. Ask about a fraud alert or credit freeze. Review account activity and preserve suspicious login or transaction notifications as evidence.
Free tools Windows power users keep installed
One-click scans. No signup required.
If messages or records were deleted
Report with whatever remains. Do not invent missing dates or amounts. Check the platform’s account-download or archive feature, email trash and archives, cloud backups, device notification history, bank statements, and the other participant’s copies of a conversation. Ask the platform or provider whether it can preserve records, but do not assume it will restore a deleted chat.
In your timeline, mark gaps explicitly—for example, “messages from January 20–22 deleted before preservation; payment receipt and later replies retained.” A clear limitation is more useful than a reconstructed conversation presented as complete.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Or skip the browser setup
For a page you are lawfully preserving, ScreenshotNeo can capture a clean image or PDF through one request. Replace https://example.com with the profile or evidence page you need to document, and keep the resulting file alongside your original exports. Read the parameter and response details in the ScreenshotNeo documentation.
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://example.com -o shot.webpimport requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://example.com"}, timeout=90)
open("shot.webp", "wb").write(r.content)const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://example.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);Before capture, ScreenshotNeo accepts cookie or consent banners and removes more than 60 known consent platforms, newsletter popups, and chat widgets; those cleanup steps can be turned off. Bot checks or CAPTCHAs, blank pages, timeouts, failed loads, and cache hits are not billed as clean shots, and the response identifies the result with X-Page-Verdict and X-Billed headers. An MCP server provides take_screenshot, get_page_info, and capture_pdf tools for AI agents and MCP clients.
Use an automated capture as a convenient working copy, not as a replacement for complete chat exports, email headers, transaction records, or untouched originals. ScreenshotNeo’s free plan includes 1,000 screenshots per month without a card; paid plans start at $5 for 3,000 shots. Create a free ScreenshotNeo account.
Common preservation problems and fixes
The profile disappears after you report it
Keep the screenshots, URL, username, and timeline entries you captured before reporting. Save the platform’s confirmation or case number and note the time of removal.
Best Value
- FIPS 140-3 Level 3 (Pending) Certified Military-Grade Security
- OS/Device Independent
- XTS-AES Hardware Encryption
- Enforced Alphanumeric PIN
- Multi-PIN (Admin and User) Option
The bank statement does not show the recipient’s identity
Save the statement anyway, then add the transfer confirmation, recipient details supplied in messages, payment handle, and provider case number. Do not alter the statement to add missing information; connect the records in your timeline.
A screenshot cuts off the date or username
Retake it with the full browser or app context visible, and preserve the page at a readable zoom. Keep the defective screenshot only if it shows information not present elsewhere, labeling its limitation.
You are unsure whether a file changed
Stop editing the original. Copy it to a new working folder, record its filename and location, and explain in your index which copy was used for reporting. If investigators request technical verification, provide the original storage device or account as instructed.
Quick final check before submitting reports
- Profile URL, username, claimed name, phone, email, payment handle, domains, applications, and wallet addresses recorded.
- Complete chats, emails with headers where possible, texts, voicemails, and call logs exported or saved.
- Every payment matched to a receipt, statement, confirmation number, or cryptocurrency hash.
- Timeline explains first contact, off-platform move, requests, payments, and discovery of the fraud.
- Originals secured; working copies clearly labeled; backups separated.
- Bank or payment provider contacted immediately about stopping or reversing transfers.
- IC3, FTC, and the platform report prepared, with local law enforcement considered where appropriate.
- Fraud alert or credit freeze requested if identity information was exposed.
Frequently Asked Questions
Can someone else preserve and report the evidence for me?
Yes. A trusted representative can organize copies and submit information with your permission. Keep the originals under your control and identify who collected each file and when.
Should I send all of my raw files to every reporting organization?
No. Enter the requested facts in each form and follow that organization’s instructions. Because IC3 does not accept attachments, retain the complete originals and provide them only through a verified follow-up channel.
What should I do if the scammer contacts me again after I report?
Do not send money or disclose that you are collecting evidence. Preserve the new message, account identifier, and timestamp, then add it to your existing timeline and report.
The Bottom Line
Preserve complete communications, account identifiers, payment and cryptocurrency records, and a dated timeline before deleting or blocking anything. Keep originals secure, act immediately with financial institutions, and report to IC3, the FTC, the platform, and appropriate law-enforcement contacts.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
