Evidence for a fake account complaint: what to record and how
Complaints about fake accounts are rejected more often because they do not show what is forged, where, and who was harmed, than because the account turns out to be genuine. A screenshot without a link and a date is not evidence.
A complaint about a fake account has two readers, and they want different things. The platform needs to see in a minute that the account passes itself off as you and harms people. A bank, the police or a court needs this to be verifiable a month later, when the account has already been removed and the page looks different.
So it is better to collect evidence to the higher standard from the start. It is not more expensive: the difference is in discipline, not money. And a report to Telegram only benefits from such a package.
What to save
Separately, about the fraudster's correspondence with victims. Telegram's FAQ says the company does not process requests about private groups and chats, so moderators will see this correspondence only when the injured person sends it in. Ask such people to take screenshots and pass them to you. The police and the bank need them too.
How to save it so it survives scrutiny
A phone screenshot is the beginning, not the end. The other side will say it could have been altered, and the time and address rest on your word. The same four components apply that we covered for the evidence base of a due diligence report: time, address, a saved copy and integrity.
Record the time at once and in UTC, not "in the evening when I have a moment". It is stronger when the moment is confirmed by an independent timestamp under the RFC 3161 standard rather than by your phone's clock. Address: take the screenshot with the page address visible, or save the page whole. A crop without a link proves nothing.
Keep the copy in its original form, compute its SHA-256 hash and record it in a log. If the hash matches a year later, the file was not changed. Make marks, arrows and circles on a copy, and do not touch or crop the original.
The log: what it should contain
Files without a description soon turn into a folder of pictures. So keep a log beside them: one row per capture.
The log can be an ordinary spreadsheet. What matters is that the row appears right after saving, not reconstructed from memory. A month later such a table answers "where does this come from" in a minute, and it can be handed to a bank or a lawyer together with the files.
Two levels: for the platform and for a court
For a report to Telegram a clear package is enough: links, dated screenshots, a comparison with the original, a description of what the account asks people for. For the police add the movement of money: a receipt, a statement, the recipient's card number, the victim's correspondence. A court is different: the court decides the admissibility of evidence, and a casual screenshot may not be enough. The levels of evidential weight, from a screenshot through notarial certification to an expert opinion, are set out in the article on evidence standards. Where a notary can certify a web page, it is costlier and slower, so it is kept for the items a claim will actually rest on.
What you must not do
Do not log in to someone else's account or guess its password, even if it is obviously fraudulent: that becomes your risk, not his. Do not pose as a customer to "draw out" the fraudster, and do not correspond with him under another name. Do not publish the personal data of a suspect "as a warning": a similar name or photo does not prove that this particular person is behind the account, and a mistaken identity is possible. Do not collect other people's correspondence without the consent of those it concerns. About complaint floods specifically: they add no evidence and they add risk, as we wrote in the article on removal services.
Typical mistakes
A screenshot without the page address. A photo of the screen taken with another phone instead of a proper capture. Editing the original: underlined in red and saved over it. A crop of a chat where the account name is not visible. Screenshots taken a week after the account appeared, when part of the content had already been removed. Five files with no note of what matches what. Each of these is small, but together they turn weighty material into "somebody's pictures".
An example package for a report
For an account collecting advances in the name of a company, the package is several screenshots of the profile and posts with the address visible, a screenshot where the account asks for a transfer, and the payment details themselves. Add a comparison with your official channel, messages from victims (with their consent) and a half-page description: who you are, what is forged, what the account asks for. The package ends with the log of hashes. All of it can be assembled in a few hours, and with such a package the report goes to Telegram, to the bank and to the police without rework.
What to do with the finished package
It works in every channel: in the report to Telegram, in the notice to the bank, in a report to the police (in Ukraine through cyberpolice.gov.ua/declare) and in a conversation with a lawyer. Assembling it once is cheaper than reconstructing it after the account is deleted. If there are many accounts or they keep returning, recording and monitoring can be handed to us: we prepare evidence as an evidence package with a log, hashes and time, within reputation defense. The general order of action for the first 24 hours is described here.
Frequently asked questions
Related reading: the first-day plan, in a fake Telegram account in your company's name, and the standards behind documented evidence, in evidence standards in due diligence.
We record evidence so that the platform, a bank and a lawyer will accept it, and hand over a log with hashes and time. The price is set after a short brief and fixed before work starts.