What should I preserve before contacting a bank or payment provider?¶
Contacting a bank or payment provider may be urgent, but important evidence can be lost if preservation is not considered first.
Avoid this assumption: The provider will retain everything you have already seen and can recreate it later.
Preserve the original material before accounts, devices or sessions are changed. This may include screenshots, statements, transaction exports, emails, messages, receipts, call logs, application screens and browser pages.
Capture the whole screen where possible. Include the date and time, account or wallet identifier, transaction status, amount, currency, beneficiary or merchant, transaction reference and any visible provider messages.
Retain original files rather than relying only on printed or copied versions. Record where the material came from, who obtained it and when.
If a live payment application or online account is open, consider whether navigating further could alter evidence, refresh timestamps, mark messages as read or trigger security controls. Record the current state before taking action.
Preserve device information that may matter later: device make and model, phone number, relevant applications, browser history, installed remote-access tools, notifications and any visible device-registration details.
Record recent security changes. This may include new beneficiaries, changed passwords, added devices, altered contact details, failed login alerts or multi-factor authentication events.
Preserve all communications connected with the payment. Keep email headers where available, message threads, usernames, telephone numbers, call times, links and attachments.
Where funds may still be moving, do not delay urgent protective action purely to collect perfect evidence. Preservation and contact with the provider may need to happen in parallel.
When contacting the provider, use the preserved identifiers and ask that relevant account, transaction, authentication, device, session and communication records are retained.
Do not rely on memory. A transaction can be renamed, a session revoked, a device removed or an application view changed after the account is secured.
Operational takeaway¶
Capture the complete current state, retain original files and record all transaction, account, device and communication identifiers before security changes alter the evidence.