Free lesson · Skill · 6 min
Preserve screenshots and messages
Lesson 5 of 10 in If Money Is Gone — The First 24 Hours
The one idea
Scammers clean up after themselves. WhatsApp accounts get deleted, messages get "removed for everyone", fake sites go offline, and social profiles vanish — often within hours of the money moving. Evidence you do not capture today may simply not exist tomorrow.
Compare:
"I will screenshot the chat later, first I need to deal with the bank." — by evening the account shows "This contact is no longer available" and the thread is gone.
versus
Before anything else after containment: full-thread screenshots, scrolled from first message to last, sender number visible, phone clock in frame. Copies emailed to self. The scammer's cleanup now deletes nothing that matters.
Capture like an investigator
- Whole threads, not highlights. The early friendly messages prove the setup; the pressure sequence proves the method. Cherry-picked screenshots invite the question "what came before this?"
- Metadata in frame. Sender number or email address, date headers, timestamps. On email, use "show original" to capture full headers if you can.
- The fake site too. Screenshot the page AND the address bar; copy the URL into your notes.
- Then move copies OFF the phone. The attacked device may be compromised, lost to a SAPS evidence request, or wiped. Email the images to yourself or upload to cloud storage — anywhere that survives the phone.
One warning: capture, never edit. Cropping for privacy when sharing is fine, but keep the originals untouched — an edited exhibit can taint the whole file.
Try it now
Practise the full-capture drill on any recent conversation: screenshot the complete thread with sender and timestamps visible, then email the set to yourself with subject "evidence drill". Sixty seconds, and the muscle memory exists.
Your win today
Your evidence outlives the scammer's cleanup and the fate of your phone. Originals intact, copies elsewhere.