Start with a timeline
Create a chronological list with date, approximate time, channel and event: first contact, account opening, payment, document request, promise made, withdrawal attempt and any new payment demand. Link each line to a file or screenshot. A timeline separates what you remember from what you can document.
Keep original material
Where possible, retain complete emails, PDF receipts, exported conversations, URLs, phone numbers and payment coordinates. Screenshots are helpful but can lose metadata and context. Keep an untouched original and make a separate annotated copy if you need to highlight something.
Do not share more sensitive data than necessary
A research file can contain highly sensitive information. Before sending it, decide what the recipient actually needs. Redact full card numbers, passwords, OTP codes, seed phrases and private keys. They are not needed to show that a transaction occurred and should never be requested by an educational checking service.
Add public sources as references, not decoration
If you find a registry entry or warning, save the link and a brief note describing what it actually says. Record the date accessed. This makes the file reproducible and reduces the temptation to overstate what a source proves.
The file does not need to “prove fraud”
Determining offences belongs to the competent authorities and legal process. Your practical goal is narrower: create a coherent sequence of facts, payments, communications and sources. A neutral file is often more useful than an emotional document full of final conclusions.
Give files useful names as you collect them
A simple naming convention prevents chaos: “2026-08-10_transfer_5000.pdf”, “2026-08-11_email_tax-request.eml” and so on. Put the date first so files sort naturally. If you create an annotated copy, label it as a copy and keep the original separately. You do not need specialist forensic software to keep a usable record.
Separate what you observed from what you were told
Create two categories. Put directly observable facts in one: payment made, email received, page content, registry result. Put statements in the other: “the adviser said…”, “the platform claims…”, “I was promised…”. This keeps a repeated promise from accidentally acquiring the same weight as a document.
Prepare a short version and a complete version
For an initial bank or authority contact, a one-page chronology with amounts and key contacts plus an index of attachments can be easier to use than a large folder. Keep the full archive behind it. Structure does not mean withholding information; it means making the information findable.