Scammed online? Secure the evidence before you report anything

The first hour decides how much you can prove

The instinct after realising you have been defrauded is to act: call the bank, write to the seller, file a report. All of that is right. But there is one step that has to come first, because it is the only one that becomes impossible later.

Fraudulent operations are built to disappear. A fake shop is registered, run for a few weeks and abandoned. A marketplace listing is deleted the moment the money arrives. A profile is renamed. A price or a delivery promise is quietly edited so the page no longer says what it said when you paid. None of this is accidental — it is how the model works.

Everything you can still see right now, you may not be able to show anyone tomorrow.

What disappears, and how quickly

In practice, these are the things that are gone first — usually within hours to days:

• The listing or product page, including the price, the description and the delivery promise you relied on
• Seller identity: company name, registration number, address and contact details, which fraudulent shops often invent and then change
• Terms and conditions, refund policy and any guarantee shown at the time of purchase
• The payment page and the account details you were asked to send money to
• Chat messages, e-mails and profiles — on many platforms the sender can delete messages on both sides

What usually survives is your bank statement. That proves you paid someone. It does not prove what you were promised, and that gap is where most claims fail.

Step one: preserve, before you contact anyone

Preserving evidence takes minutes. Doing it before you make contact matters, because a seller who realises you are onto them will remove the page first and answer second.

Capture the whole context, not one screenshot

A single screenshot of the product is rarely enough. Capture everything that carries a claim or an identity:

• The listing itself: full page, including price, availability and delivery time
• Seller or company details, the imprint or 'about' page, and any registration numbers
• Terms, refund and complaints policy as they appear at that moment
• The checkout and payment instruction, including the account or wallet address
• Your entire communication: chat threads, e-mails with full headers, order confirmations

Capture the page as it exists now — including the parts you have not read yet. You cannot go back and add them later.

Do not rely on a plain screenshot alone

A screenshot is a picture file. It carries no verifiable proof of when it was made, where it came from or whether it was edited afterwards. That is enough for a first conversation, and it is often not enough when the other side denies the content ever existed. A forensic capture records the page together with its address, the time, the network response and a cryptographic fingerprint, sealed with a qualified electronic timestamp — so the record can be checked by anyone, including years later.

Write down the timeline while it is fresh

Dates and times of every step: when you found the offer, when you paid, what you were told and when, when you first suspected something. A short factual chronology is the backbone of every complaint you are about to file, and memory degrades faster than most people expect.

Your bank: the fastest route to your money — and the one with deadlines

If you paid by card or bank transfer, contact your payment provider immediately. This is usually the quickest path to recovery, and it is the one that expires. What the bank can do depends on how you paid.

If you paid by card

Card schemes provide a dispute mechanism, commonly called a chargeback. Grounds usually include goods never delivered, goods materially different from the description, or an unauthorised transaction. Time limits apply and they are strict — in card scheme rules the outer limit is commonly counted in months from the transaction or the expected delivery date, and your bank may impose a shorter internal window. Check with your provider on the same day rather than assuming.

• Evidence the bank typically asks for: the order confirmation, proof of payment, your correspondence with the seller, and the listing as it appeared when you bought
• The last item is the one people cannot produce, because by then the page has changed — which is exactly why capturing comes first

If you paid by bank transfer

A completed transfer is far harder to reverse than a card payment, because in most cases you authorised it yourself. Banks can attempt a recall, and speed is decisive — funds are frequently moved on within hours. Report it to your bank immediately and ask them to contact the receiving institution. Under EU rules on payment services you are also entitled to a documented answer, which is worth having in writing.

Card payment: dispute mechanism with defined grounds. Bank transfer: a request for help with no guarantee. The difference is worth remembering before you pay a stranger.

The police: what a criminal complaint actually needs

Fraud is a criminal offence in every EU member state. Reporting matters even when the amount is small — investigators connect individual reports into patterns, and one complaint about a shop that took €80 from you may join two hundred others. To be usable, a complaint needs to describe an identifiable act, not just a feeling of having been cheated.

• What was offered, by whom, and where — the address of the page and its content at the time
• What you paid, when, how, and to which account, wallet or payment provider
• What communication took place, in full, including headers where available
• Technical traces: the domain, the IP addresses it resolved to, hosting and registrar details where you have them

Most national police forces now accept online reports for cybercrime, and several member states run dedicated portals. Whatever the route, attach the evidence rather than describing it — a report that says 'the website said the goods were in stock' is weaker than one that includes the page showing it.

A court: where the other side gets to argue back

If the amount justifies a civil claim, the standard changes. In a police report nobody contests your account at the outset. In court, the other side will — and a defence built on 'that page never said that' or 'this image could have been made in any photo editor' is cheap to mount and surprisingly effective.

• The record must show the address, the exact time, and the content together, not as three separate assertions
• It must be possible to demonstrate the content was not altered after capture
• It should be verifiable without relying on the word of whoever produced it — including the vendor of the tool
• The method used to obtain it should be documented and repeatable, which is what forensic acquisition standards such as ISO/IEC 27037 exist for

In a dispute, the question is never only 'what did the page say' — it is 'how do we know'.

Three audiences, three different expectations

This is the part most guides omit. Your bank, the police and a court are not asking for the same thing, and material that satisfies one may not satisfy another.

• Your bank wants a commercial reconstruction: what was promised, what you paid, what arrived. It decides on documents and deadlines, and it decides fast.
• The police want an identifiable act and leads to follow: identities, accounts, domains, infrastructure. Volume of detail helps here.
• A court wants provenance and integrity: not only the content, but proof of where it came from and that it has not changed since.

You cannot know at the outset which of the three will matter most. That is the practical argument for capturing thoroughly once, at the beginning, rather than gathering separately for each.

Mistakes that cost people their case

• Contacting the seller before capturing anything — the page is usually the first thing to go
• Capturing only the product photo, and none of the price, terms or seller identity
• Cropping or annotating screenshots, which invites the argument that the image was manipulated
• Assuming the bank's deadline is generous, and discovering weeks later that it was not
• Waiting for the police to conclude before contacting the bank — these run in parallel, not in sequence

None of these are exotic errors. They are the ordinary consequence of dealing with a stressful situation in the order that feels natural rather than the order that preserves your options.

If the page is already gone

Not everything is lost. The Internet Archive's Wayback Machine may hold a copy, search engine caches sometimes survive briefly, and your own e-mail confirmations, invoices and browser history remain. Payment providers hold records of the merchant that a court can compel.

Be aware of the limits, though. An archived copy proves what an archiving service recorded, not what you personally saw, and coverage is patchy — archives capture what their crawlers happened to reach, which for a short-lived fraudulent shop is often nothing. Treat it as a fallback, not a plan.

The short version

Capture first, report second. Capture the whole context, not a single image. Contact your bank the same day, because that clock is already running. File with the police even if the amount seems too small to matter. And keep the original evidence untouched — you may need it for a purpose you cannot foresee today.

The people who recover their money are rarely the ones who reacted most emotionally. They are the ones who spent ten minutes documenting before they did anything else.

This article is general information, not legal advice. Deadlines, procedures and available remedies differ between EU member states and between payment providers. For a specific case, consult a qualified lawyer or your national consumer protection authority.

Frequently asked questions