What should I ask a victim to preserve?¶

Ask a victim to preserve the original devices, accounts, messages and records that show what happened, without encouraging unnecessary interaction.

Avoid this assumption: The victim should immediately send everything, delete harmful content or secure every account before the original state is recorded.

Ask them not to delete messages, emails, call records, account alerts, transaction records, files, voicemails or relevant applications.

Ask them to preserve the device on which the material was first received or observed.

Record account names, usernames, phone numbers, email addresses, profile links, dates, times and the service involved.

Ask them to retain screenshots they have already taken, but explain that screenshots may not preserve full metadata or original quality.

Preserve provider emails, password-reset notices, login alerts, receipts, bank references and case or support numbers.

Where content is disappearing, threatening or remotely controlled, obtain specialist or safeguarding advice quickly.

Do not instruct the victim to open attachments, follow links, confront the sender or investigate the account.

If account security changes are necessary to prevent further harm, preserve the visible state first where practicable and document what was changed.

Ask the victim to note what they remember seeing, what actions they took and whether anyone else had access to the device or account.

Provide a safe route for supplying material rather than asking them to forward everything through ordinary messaging.

Operational takeaway¶

Ask the victim to retain original devices, accounts, messages, alerts and transaction records, avoid unnecessary interaction and document every security or forwarding action already taken.