A crypto scam case can involve hundreds of messages and many transactions. Sending investigators a large folder of unorganized screenshots may make the case harder to understand. A structured case file turns raw information into a concise factual record.
The goal is to help a reviewer answer five questions: who contacted the victim, what was promised, how the victim was persuaded to pay, where the money went, and what happened afterward.
1. Create a Master Summary
Begin with a one- or two-page summary describing the incident, approximate total loss, payment methods, key dates, and major entities involved.
The summary should point to detailed evidence rather than attempting to contain every fact.
### Practical note on 1. create a master summary
Keep a written record of the action taken at this stage and the source of the information used to make the decision. If another person later reviews the case, they should be able to understand what was known at the time and why the action was taken. This is particularly useful when an incident involves several payments or multiple people communicating under different names.
It is also important to avoid turning an investigation into a confrontation. Do not threaten suspected individuals, attempt unauthorized access to accounts, or publish unverified accusations. Those actions can create additional security, legal, and evidentiary problems. Use legitimate institutional and professional channels instead.
Where information cannot be verified, label it clearly as an allegation or an unresolved point. A case built around accurate uncertainty is stronger than one built around assumptions that later prove incorrect.
2. Build an Identity Section
List the names, usernames, phone numbers, email addresses, websites, social profiles, and claimed organizations associated with the case.
Separate claimed identity from verified identity. If a person used multiple names, record each one.
### Practical note on 2. build an identity section
Keep a written record of the action taken at this stage and the source of the information used to make the decision. If another person later reviews the case, they should be able to understand what was known at the time and why the action was taken. This is particularly useful when an incident involves several payments or multiple people communicating under different names.
It is also important to avoid turning an investigation into a confrontation. Do not threaten suspected individuals, attempt unauthorized access to accounts, or publish unverified accusations. Those actions can create additional security, legal, and evidentiary problems. Use legitimate institutional and professional channels instead.
Where information cannot be verified, label it clearly as an allegation or an unresolved point. A case built around accurate uncertainty is stronger than one built around assumptions that later prove incorrect.
3. Build a Communication Section
Organize messages by platform and date. Preserve relevant conversations in chronological order where possible.
Highlight the messages that introduced the investment, requested payments, promised returns, blocked withdrawals, or demanded additional fees.
### Practical note on 3. build a communication section
Keep a written record of the action taken at this stage and the source of the information used to make the decision. If another person later reviews the case, they should be able to understand what was known at the time and why the action was taken. This is particularly useful when an incident involves several payments or multiple people communicating under different names.
It is also important to avoid turning an investigation into a confrontation. Do not threaten suspected individuals, attempt unauthorized access to accounts, or publish unverified accusations. Those actions can create additional security, legal, and evidentiary problems. Use legitimate institutional and professional channels instead.
Where information cannot be verified, label it clearly as an allegation or an unresolved point. A case built around accurate uncertainty is stronger than one built around assumptions that later prove incorrect.
4. Build a Transaction Table
Use columns for date, asset or currency, amount, payment method, sending account or wallet, destination, transaction reference, and evidence filename.
For cryptocurrency, include the network and transaction hash. This table becomes one of the most useful documents in the case.
### Practical note on 4. build a transaction table
Keep a written record of the action taken at this stage and the source of the information used to make the decision. If another person later reviews the case, they should be able to understand what was known at the time and why the action was taken. This is particularly useful when an incident involves several payments or multiple people communicating under different names.
It is also important to avoid turning an investigation into a confrontation. Do not threaten suspected individuals, attempt unauthorized access to accounts, or publish unverified accusations. Those actions can create additional security, legal, and evidentiary problems. Use legitimate institutional and professional channels instead.
Where information cannot be verified, label it clearly as an allegation or an unresolved point. A case built around accurate uncertainty is stronger than one built around assumptions that later prove incorrect.
5. Add Blockchain Evidence
Preserve transaction links or records from appropriate blockchain explorers along with the underlying transaction hashes. Record subsequent movements separately.
Avoid unsupported statements about wallet ownership. Use labels such as “destination address” unless control has been independently established.
### Practical note on 5. add blockchain evidence
Keep a written record of the action taken at this stage and the source of the information used to make the decision. If another person later reviews the case, they should be able to understand what was known at the time and why the action was taken. This is particularly useful when an incident involves several payments or multiple people communicating under different names.
It is also important to avoid turning an investigation into a confrontation. Do not threaten suspected individuals, attempt unauthorized access to accounts, or publish unverified accusations. Those actions can create additional security, legal, and evidentiary problems. Use legitimate institutional and professional channels instead.
Where information cannot be verified, label it clearly as an allegation or an unresolved point. A case built around accurate uncertainty is stronger than one built around assumptions that later prove incorrect.
6. Preserve Website Evidence
Save screenshots of the investment website, dashboard, withdrawal page, contact page, legal claims, and relevant terms. Record the domain name.
If the website later disappears, your preserved evidence may provide the only record of what was displayed.
### Practical note on 6. preserve website evidence
Keep a written record of the action taken at this stage and the source of the information used to make the decision. If another person later reviews the case, they should be able to understand what was known at the time and why the action was taken. This is particularly useful when an incident involves several payments or multiple people communicating under different names.
It is also important to avoid turning an investigation into a confrontation. Do not threaten suspected individuals, attempt unauthorized access to accounts, or publish unverified accusations. Those actions can create additional security, legal, and evidentiary problems. Use legitimate institutional and professional channels instead.
Where information cannot be verified, label it clearly as an allegation or an unresolved point. A case built around accurate uncertainty is stronger than one built around assumptions that later prove incorrect.
7. Add Financial Records
Include bank statements, exchange statements, payment confirmations, card records, and invoices. Remove unrelated transactions where appropriate while retaining originals securely.
Make sure totals reconcile with the transaction table.
### Practical note on 7. add financial records
Keep a written record of the action taken at this stage and the source of the information used to make the decision. If another person later reviews the case, they should be able to understand what was known at the time and why the action was taken. This is particularly useful when an incident involves several payments or multiple people communicating under different names.
It is also important to avoid turning an investigation into a confrontation. Do not threaten suspected individuals, attempt unauthorized access to accounts, or publish unverified accusations. Those actions can create additional security, legal, and evidentiary problems. Use legitimate institutional and professional channels instead.
Where information cannot be verified, label it clearly as an allegation or an unresolved point. A case built around accurate uncertainty is stronger than one built around assumptions that later prove incorrect.
8. Add a Timeline
Create a chronological timeline linking communications and payments. For example, an investment instruction should be connected to the payment that followed it.
This helps reviewers understand causation and sequence rather than seeing isolated documents.
### Practical note on 8. add a timeline
Keep a written record of the action taken at this stage and the source of the information used to make the decision. If another person later reviews the case, they should be able to understand what was known at the time and why the action was taken. This is particularly useful when an incident involves several payments or multiple people communicating under different names.
It is also important to avoid turning an investigation into a confrontation. Do not threaten suspected individuals, attempt unauthorized access to accounts, or publish unverified accusations. Those actions can create additional security, legal, and evidentiary problems. Use legitimate institutional and professional channels instead.
Where information cannot be verified, label it clearly as an allegation or an unresolved point. A case built around accurate uncertainty is stronger than one built around assumptions that later prove incorrect.
9. Add Reporting Records
Keep bank case numbers, exchange tickets, police or cybercrime report numbers, regulator submissions, and professional correspondence.
Record when each report was made and what evidence was submitted.
### Practical note on 9. add reporting records
Keep a written record of the action taken at this stage and the source of the information used to make the decision. If another person later reviews the case, they should be able to understand what was known at the time and why the action was taken. This is particularly useful when an incident involves several payments or multiple people communicating under different names.
It is also important to avoid turning an investigation into a confrontation. Do not threaten suspected individuals, attempt unauthorized access to accounts, or publish unverified accusations. Those actions can create additional security, legal, and evidentiary problems. Use legitimate institutional and professional channels instead.
Where information cannot be verified, label it clearly as an allegation or an unresolved point. A case built around accurate uncertainty is stronger than one built around assumptions that later prove incorrect.
10. Protect the Case File
Use secure storage and restrict access. Never include seed phrases, private keys, passwords, or authentication codes in the case file.
Maintain original evidence separately from working copies and avoid editing original screenshots or documents.
### Practical note on 10. protect the case file
Keep a written record of the action taken at this stage and the source of the information used to make the decision. If another person later reviews the case, they should be able to understand what was known at the time and why the action was taken. This is particularly useful when an incident involves several payments or multiple people communicating under different names.
It is also important to avoid turning an investigation into a confrontation. Do not threaten suspected individuals, attempt unauthorized access to accounts, or publish unverified accusations. Those actions can create additional security, legal, and evidentiary problems. Use legitimate institutional and professional channels instead.
Where information cannot be verified, label it clearly as an allegation or an unresolved point. A case built around accurate uncertainty is stronger than one built around assumptions that later prove incorrect.
