What Evidence to Save After an AI Scam or Phishing Attack

When you report a scam, your bank, the police, and the platform involved will all ask the same thing: what proof do you have?

AI tools now make a phishing email or a fake website look convincing, and scammers can delete accounts and messages quickly. Without records, disputing payment fraud becomes harder.

Reports filed with the FTC go into the Consumer Sentinel Network, a secure national database available to local, state, and federal law enforcement. The FBI's Internet Crime Complaint Center (IC3) says the information you submit can help investigators track trends and, in some cases, freeze stolen funds. Its complaint form asks for transaction and scammer contact information, and you can paste in technical details such as email headers.

Digital evidence supports each of these steps. Keep the suspicious message available for reporting, but do not interact with its links or attachments. This guide explains what to save and how to store it.

Why Evidence Matters After an AI Scam or Phishing Attack

Evidence shows what happened, when it happened, and how you lost money or data. Banks, police, and government agencies rely on it to act on your report.

• Your bank needs records to review a payment fraud dispute.
• Fast action can reduce or eliminate losses, according to the FBI.
• A phishing email can be unsent or deleted by the scammer.
• A fake website can be changed or taken down without notice.
• Saved digital evidence may be the only record of what the scammer sent.
• FTC reports go into a database used by law enforcement.
• The FBI uses IC3 reports to track threats and, in some cases, freeze stolen funds.
• The IC3 form asks for transaction details and scammer contact information.
• A record of what you shared shows which accounts to secure.
• Crypto payments typically cannot be reversed, but evidence still supports your report.

What to Do Before You Save Anything

The first few minutes after a scam affect what evidence you keep. Take these steps before you save, delete, or report anything, so your records stay complete and unchanged.

Action	What to Do
Do not delete	Keep the phishing email, texts, chats, and call logs.
Do not reply	Stop all contact with the sender.
Do not click	Avoid links and attachments in the message or on the fake website.
Do not block yet	Save the sender's details first, then block.
Do not send more money	Refuse any request for fees to "recover" lost funds.
Contact your bank	Call your bank or card issuer right away.
Secure your accounts	Change passwords from a clean device and turn on two-factor authentication.
Disconnect if needed	Turn off the internet on your device if you suspect malware.

Evidence to Save From a Phishing Email

A phishing email contains details that show who sent it, where it came from, and what it asked for. Saving it in full supports any report or dispute that follows.

1. Save the Email and Its Details

Keep the original email in your inbox or move it to a separate folder. Do not delete it, even if you have taken a screenshot. The original holds technical details that a screenshot does not show.

Take screenshots as a second copy. Make sure they show:

• The sender's name and email address
• The subject line
• The date and time
• The full body of the email

2. Save the Email Headers

Headers are hidden technical details that show where an email came from and how it traveled. Most email services have an option called "Show original" or "View message source." Copy this text into a document and save it. The FBI's IC3 report form lets you paste in technical details such as email headers, so having them ready makes your report easier to complete.

3. Save Links and Attachments Safely

Do not click links or open attachments in a phishing email. To save a link, right-click it, choose "Copy link address," and paste it into a document. If the email has an attachment, leave it in the original email and do not download it.

4. Save a Record of Your Own Actions

Scammers often ask for a reply, a click, or a payment. Write down what you did and when. Include:

• Any reply you sent to the sender
• Any link you clicked
• Any password, card number, or personal detail you entered

This record shows which accounts to secure and helps your bank review the case.

5. Save Payment Records

If you paid anything, keep the receipt, transaction ID, and bank confirmation. These records support a payment fraud dispute. Also save any follow-up emails, texts, or calls from the same sender, since they show the full pattern of the scam.

Evidence to Save From a Fake Website

A fake website can vanish within hours. Once it does, your only proof of what it showed and what you entered is what you saved. Here is the evidence to save:

1. Save the Website Address

Copy the web address (URL) from the address bar and paste it into a document. Copy it exactly as it appears, including any misspelled words or extra characters. Fake sites often use an address that is only slightly different from a real one. A shortened link or your memory of the address is not enough.

2. Take Screenshots of the Pages

If the site is still online, take a screenshot of each page you visited. Stop entering information on the site. Each screenshot should show the address bar, what was being sold, the prices, and any contact details or refund policy. Include the date and time if your device shows them. You can also print a page and choose "Save as PDF" to keep a full copy.

3. Write Down What You Entered

List everything you typed into the site. This may include your name, email, phone number, address, password, and card or bank details. You will need this list to decide which accounts to secure, and your bank may ask for it.

4. Keep Your Order and Payment Records

If you paid on the site, keep the order confirmation, any email you received, and the receipt. Save the bank or card statement that shows the charge. These records connect your payment to the website, and you will need them if you dispute the charge as payment fraud.

5. Note How You Found the Site

Write down where the link came from. It could have been a search result, an ad, a social media post, a text message, or an email. If the ad or post is still online, take a screenshot and save the name of the account that shared it.

6. Keep Your Browser History

Your browser history records the pages you opened and when you opened them. Do not clear it until your case is closed. Take a screenshot of the entries for the fake website, or write down the dates and times of your visits.

7. Look Up Who Registered the Site

A free domain lookup tool, often called a WHOIS tool, shows when a website address was registered. Some owners hide their details, but the registration date can still be useful. Save a screenshot of the results or copy them into your notes.

Evidence to Save From Calls, Texts, and Messaging Apps

Scam contacts made by phone or messaging app are easy to erase from the scammer's side. A record kept on your side helps support any report or dispute. Here is the evidence that matters:

Evidence	What to Save
Phone numbers and accounts	Phone number, username, profile name, and profile link
Message threads	The full conversation, from first message to last
Text messages	The message text and any links
Call records	Number, date, time, and length of each call
Voicemails	The audio message
Call notes	Names, amounts, account numbers, and payment instructions
Voice or video call details	App used, meeting link, names shown, and what was asked
Payment instructions	Messages telling you how and where to pay
Payment records	Receipts, transaction IDs, and bank confirmations

Evidence Specific to AI Scams

AI tools can create fake voices, videos, profiles, and documents. Saving the original files and details helps show how the scam was made and delivered.

1. Save Original Files, Not Only Screenshots

AI-generated content is often shared as a video, audio clip, image, or document. If the file was sent to you, keep the original in its message or email. A screenshot does not carry the same details as the file. The FBI warns that criminals use generative AI to create images, videos, and fake documents that make fraud schemes more believable.

2. Save Details of Fake Profiles

Criminals use generative AI to create large numbers of fictitious social media profiles. Save the following before the account is deleted:

• The profile name, username, and link
• Profile photos and any posted videos
• The date the account contacted you
• Any group or page the profile invited you to join

3. Save Details of Voice Clone Calls

A scammer can copy a person's voice from a short audio clip and use it to make a request for money or information. The FTC explains how voice cloning is used in family emergency scams. Do not rely on the sound of the voice as proof of who called. Save your call log and any voicemail, and write down the date, time, and what the caller asked for.

4. Save Details of Deepfake Video Calls

The FBI reports that criminals use AI-generated video in real-time video chats and to imitate public figures. If you joined a video call with someone who may have been a fake, note the app used, the meeting link, the names shown on screen, and the date and time. Save any chat messages sent during the call. If the app saved a recording, keep it.

5. Save AI Chatbot and Text Conversations

Some scams use AI to write messages that sound personal and error-free. A phishing email or chat message from an AI tool may look no different from a real one. Save the full conversation, including the first message, so investigators can see how the contact developed.

How to Store and Protect Your Evidence

Saved evidence is only useful if it stays complete, unchanged, and easy to find. Keep originals untouched, organize your files, and store copies where a scammer cannot reach them.

Step	What to Do
Use one folder	Put all files for the scam in a single folder. Use sub-folders such as "Emails," "Screenshots," and "Payments."
Use clear file names	Name each file with the date and type, such as "2026-09-29_bank-transfer-receipt."
Keep originals unchanged	Do not edit, crop, rename, or annotate the original files. Make a copy if you need to mark anything.
Make backup copies	Save a second copy on an external drive or a secure cloud account.
Use a safe device	Store evidence on a device you trust. If you think malware is on your device, use a different one.
Add a password	Protect the folder or drive with a strong password.
Keep a log	Write down what each item is, when you saved it, and where it came from.
Share only with the right people	Send files only to your bank, the platform, the police, and official agencies such as the FTC or FBI IC3.
Keep it until the case ends	Do not delete files until your report or dispute is fully closed.

Who to Report To and What to Send

Different organizations handle different parts of a scam. Report to your bank first if money was lost, then to the platform, and then to government agencies with the evidence each one asks for.

Who to Report To	What to Send
Your bank or card issuer	Transaction ID, date, amount, payment method, receipts, and the messages that led to the payment.
Email provider or messaging app	The phishing email, sender address, and screenshots of the messages.
Your wireless provider	The scam text and the sender's number.
FTC	A description of what happened, the scammer's contact details, the website address, and any payment information.
FBI IC3	Your contact details, the scammer's contact details, transaction information, and technical details such as email headers.
Local police	A copy of your evidence folder and your written timeline.

Not sure what to do after saving your evidence? Unscammed can help you report the scam to the right organizations and guide you through the next steps.

Common Mistakes That Weaken Your Evidence

Some actions can remove or damage the proof you need. Knowing these mistakes early helps you keep your records complete, clear, and ready to share with your bank and authorities.

• Deleting messages or emails: Deleted items are harder to recover and report. Keep the originals.
• Blocking the sender too soon: Blocking can hide the chat, profile, or number. Save the details first.
• Only taking screenshots: Screenshots do not show technical details, such as email headers. Keep the original file too.
• Editing or cropping files: Changed files can be harder to trust. Keep the original unchanged.
• Losing payment records: Without receipts or transaction IDs, a payment fraud dispute is harder. Save every confirmation.
• Waiting too long to report: Fast action can improve the chance of stopping or reversing a payment. Report to your bank right away.

Keep the Evidence, Make the Report

Evidence supports every step you take after an AI scam or phishing attack. Before you block or delete anything, save the original messages, screenshots, website addresses, call records, and payment records. Do not edit your files, and keep copies in a folder on a safe device.

If money was lost, contact your bank or card issuer first, since speed affects the chance of stopping a payment. Then report the scam to the FTC at ReportFraud.ftc.gov and to the FBI at ic3.gov. Keep every report number until your case is closed. Clear digital evidence helps banks, platforms, and authorities review your case faster.

Got a suspicious call, text, or email? Call 1-866-UNSCAMY for toll-free, 24/7 support. Unscammed offers an instant AI scam check by phone. You can also merge calls so Unscamy, its AI scam companion, listens in and helps protect you. No app is needed, only a phone line. If you have already been scammed, we can help you report it to your bank, the police, the FBI, and the FTC, all in under 10 minutes and for free.

Frequently Asked Questions

Should I delete a phishing email after I save a screenshot?

No. Keep the original email until your report or dispute is fully closed. A screenshot does not show technical details such as email headers, which the FBI's IC3 form lets you paste into your report. Do not click links or open attachments while you keep it.

Can I report a scam if I did not lose any money?

Yes. The FBI's IC3 encourages people to file a report even if they are unsure whether it qualifies. The FTC also reviews reports to spot patterns and build cases, so a report without a loss can still help.

What if the fake website is already offline?

Report it anyway. Use the web address, screenshots, browser history, order emails, and bank statements you saved. Also note the ad, post, or message that led you to the site. If you did not save the address, check your browser history before you clear anything.

Is a screenshot enough digital evidence?

A screenshot is useful, but it should not be your only copy. Keep the original email, message, file, or receipt as well. Screenshots are easy to question, and they leave out details such as headers, file information, and transaction IDs.

Will my bank refund me for payment fraud if I have evidence?

Not always. Evidence helps your bank review the case, but the result depends on how you paid. The FTC says federal law protects you from unauthorized use of a credit or debit card, while cryptocurrency payments typically cannot be reversed.

Do I need to report to both the FTC and the FBI?

You can report to both. The FTC collects reports at ReportFraud.ftc.gov and shares them with law enforcement through its Consumer Sentinel database. The FBI takes internet crime reports at ic3.gov. Your bank should still be your first call if money was lost.