I have been given messages or a chat account. What happens next?¶
A victim has supplied screenshots of messages from the seller of a motorbike. The conversation moved from a marketplace to a private messaging service, where the seller supplied the bank details used for a £1,850 payment. The messages explain the approach - but their source, completeness and authorship still need to be established.
A message may be very good evidence of what was communicated while still leaving authorship and personal responsibility open.
Read what has actually been supplied¶
The screenshots show a chat with account @fenland_classics. The seller says the marketplace notifications are unreliable, asks the victim to continue privately and later sends an account ending 4219 with payment reference BIKE27.
Work the conversation as evidence¶
01 · Preserve the victim’s source, not another screenshot of the screenshot
The victim’s phone still holds the live conversation and the marketplace exchange that preceded it.
Record who created the screenshots, when and from which device. Preserve the files in their original form where possible. Establish whether the service offers a native export and whether the source phone, account and attachments remain available.
Capture enough surrounding conversation to explain how the parties met, moved service and agreed the payment. Preserve account details, telephone numbers, profile links, thread or group identifiers, message times and the device’s displayed time-zone context.
The incriminating line makes sense because of what came before and what happened afterwards. Preserving only “pay £1,850” discards the route from advert to account to money.
Go deeper: What exactly have I been given? · What should be preserved alongside a messaging screenshot?
02 · Separate the visible name from the service account
The provider identifies the seller as account MC-77104, registered to the mobile ending 6142.
The visible label @fenland_classics is useful, but a username may change or be imitated. The service’s stable account, thread and message identifiers provide the stronger basis for preservation and comparison.
MC-77104@fenland_classics6142TH-771MSG-90318The mobile ending 6142 also appears as the recovery number for marketplace account FC-88214. That independent match is meaningful corroboration between two providers. Subscriber, account holder and user are different propositions, so subscriber and device evidence are then used to test the person behind the accounts.
03 · Understand what the message states actually mean
The service recorded the payment message as sent and delivered before the bank transfer.
“Sent” commonly means the service accepted or processed a message from the sending account or device. “Delivered” may mean it reached an account or one of its devices. “Read” or “seen” normally means the service generated that status under its own rules.
Those states help reconstruct the event. They do not certify that a named person typed, personally read or understood the message.
MSG-90318 · delivered 14:01:48The service recorded delivery under its technical rules.The victim personally read it at 14:01:48This may be supported by the victim’s account and subsequent payment, but the status alone does not prove it.Go deeper: What does “sent” mean? · What does “delivered” mean? · What does “read” or “seen” mean?
04 · Use the conversation to open other lines of enquiry
The chat contains the same advert details, payment reference and receiving account recorded elsewhere.
The message does not sit in splendid isolation. It refers to advert AD-7719, uses the seller identity from marketplace account FC-88214 and supplies the account receiving the victim’s payment. Exact wording, copied images, voice notes or attachments may connect further victims or accounts, but similarity should be tested rather than assumed.
MC-77104 begins thread TH-771.MSG-90318 supplies the payment details.BIKE27.The matching account details, reference and six-minute sequence strongly corroborate the victim’s account and connect the communication to the payment event. Neither provider is simply repeating the other: each independently records a different part of the same sequence. Control of the seller account still requires evidence, but the underlying communication and payment route are already well supported.
Compare the stable account, thread and message IDs, payment reference and precise provider times as a joined event sequence. Retain the provenance of each source and the separate accountability of every person who handled the device or account; a combined case chronology must not turn individual actions into an anonymous team record.
05 · Test authorship against sessions, devices and conduct
A handset recovered from Ellis Ward contains the seller account, thread and copied motorbike images. Provider records associate the same handset installation with the relevant message event.
Subscriber records associate mobile 6142 with Ellis. The device is found in Ellis’s possession and contains an active session for account MC-77104. Its local message identifier corresponds with provider message MSG-90318, and it holds the copied advert images.
Those facts substantially strengthen the case that Ellis controlled and authored the seller conversation. This is the sort of corroboration that supports message authorship: provider identifiers, a matching local message, an active account session, copied advert material, possession and closely aligned times. The payment route separately points to Sam Dyer. Communications between Ellis and Sam around the transfer can then test whether they acted together and what each knew.
