What evidence should you save before reporting a scam?

Secure money and accounts before perfecting the file

If money, card details, login information or identity documents may have been exposed, contact the bank or card provider promptly using the number in its app, on the card or on its independently opened website. Do not wait until every screenshot is labelled. If anyone is in immediate danger, call 000.

Scamwatch separates urgent account protection from the later report. A report can help authorities understand scam activity, but it does not replace the bank’s security or transaction process and does not guarantee recovery. This guide is educational, not personal financial advice, and the official links below pay us no commission.

Source: Report a scam

Preserve one timeline and the original material

Create a dated sequence of what happened: the first contact, each instruction, each payment or information disclosure, and the moment you discovered the problem. For every entry, capture the time, channel, sender name or account, phone number or URL, amount and payment method, plus any bank or report reference number.

Save the original email, message, invoice, profile page or file where it can be kept safely. A screenshot is useful for what was visible, but it should not replace the original when the original remains available. Do not re-engage with the sender just to obtain more evidence.

Source: Report a scam · Report and recover from cybercrime

Route the incident by what happened

Use Scamwatch to report suspicious contact or activity and help the National Anti-Scam Centre identify patterns. Where the incident is cybercrime, the Australian Cyber Security Centre directs people to ReportCyber, the national reporting system. You can resume a saved ReportCyber report or check its status through the official service.

The correct route can include more than one organisation: a bank for account protection, Scamwatch for scam intelligence, and ReportCyber or police for cybercrime. Scamwatch also points to police and emergency services where safety or immediate criminal harm requires them. Record which channel received what and when.

Source: Report a scam · Report and recover from cybercrime

Keep private evidence private

Retain complete originals in a secure location, but do not publish account numbers, identity documents, passwords, verification codes or unredacted reports. Share sensitive material only through the verified process of the bank, police or official reporting service that needs it.

Open reporting portals independently. Do not use a reporting link sent by the suspected scammer or by an unsolicited helper. Confirm the domain from an official government page before uploading documents.

Source: Report a scam · Report and recover from cybercrime

Use a five-part handover

Your one-page handover should contain: a two-sentence summary; the dated timeline; money or information exposed; actions already taken; and the list of preserved files and reference numbers. Keep factual observations separate from conclusions you cannot verify.

Your next step is to secure the affected account, then create the timeline from the first contact forward. Update it each time a bank or agency responds. This record supports a clear report; it is not a finding that a transaction was fraudulent and it does not set a refund outcome.

Source: Report a scam · Report and recover from cybercrime

Changes to this guide

3 October 2026: First publication after National Anti-Scam Centre and ACSC review, counter-route testing and cross-network originality screening.