WhatsApp scam and fraud evidence, preserved for your bank, police and court
Scammed on WhatsApp? Preserve the evidence before the scammer vanishes.
Export the conversation, send it to us, and we deliver a certified package your bank, the police and courts trust: a readable, line-numbered transcript with an eIDAS qualified timestamp, chain of custody, and your raw export preserved. One conversation, certified in 24 hours.
Romance or pig-butchering scam, a hi mum message, a task or investment scam? The scammer will delete their account, block you and turn on disappearing messages. Capture it now.
If you sent money, call your bank's fraud line now. The first 48 hours give the best chance of stopping or reversing a payment. ProofSnap preserves evidence; it is not your bank or the police, and it cannot recover funds.
Delivered in 24 hours · eIDAS qualified timestamp · Verifiable by anyone
Unknown number
online
Hi mum, I dropped my phone in the sink. This is my new number.
1:12 PM
Can you pay a bill for me today? I'll send the details. Locked out of my banking.
1:14 PM
Sort code and account number below. Please hurry.
1:15 PM
Illustrative example. A preserved full thread shows the whole scam, the grooming and the ask, which a single screenshot cannot.
Every package can be verified by anyone, for free, in the open Trust Verifier.
Quick answer
How do I use WhatsApp scam messages as evidence and report the fraud?
If you sent money, call your bank's fraud line first, then preserve the whole conversation and report it, using an authenticated copy rather than loose screenshots. Export the chat from WhatsApp (open the chat, use Export chat, include media), then have it certified: a line-numbered transcript, SHA-256 hashes, chain of custody and an eIDAS qualified timestamp, so the scam messages, their order and their timing are hard to dispute. Report the fraud to your bank, to the police or your national fraud agency, and inside WhatsApp.
ProofSnap preserves evidence; it is an evidence tool, not legal or financial advice, is not a bank or the police, and cannot recover your money. Beware anyone who offers to get your money back for a fee. One conversation is $59.99, in 24 hours.
The WhatsApp scams people need to preserve
WhatsApp is a main channel for fraud. According to the US Federal Trade Commission, people reported losing a record $15.9 billion to fraud in 2025, and investment scams that started on social media accounted for $1.1 billion. A preserved full thread is what a bank claim or a police report turns on.
Romance and pig-butchering scams
A relationship is built over weeks or months, then you are steered into a fake investment or crypto platform. The long grooming is the case, and only a full thread shows it.
"Hi mum" and "hi dad" impersonation
Someone pretends to be your child or a relative with a new number, a lost or broken phone, and an urgent bill or transfer. Preserve the ask and the account details they send.
Task and job scams
You are paid small amounts for simple tasks, then told to deposit your own money to unlock the next set or to withdraw fake earnings. Preserve the dashboard promises and the demands.
Investment and crypto scams
A tip, a platform, a screenshot of fake profits, then pressure to send more before you can withdraw. Crypto transfers are hard to reverse, so the evidence matters even more.
Sextortion and blackmail
Threats to share private images or information unless you pay. Preserve the demands, do not pay, and report it. A certified record supports the report.
Impersonation and refund scams
A fake bank, delivery company, tax office or support agent asks for details, a code or a payment. Preserve the whole exchange, including the number and profile they used.
Recognise the pattern? Our dedicated guides cover pig-butchering scam evidence and fake job and task scam evidence in depth, and this page handles any WhatsApp scam end to end.
Why you have to capture it now
Scam evidence is perishable. The moment a scammer thinks they have been rumbled, the account and the messages start to disappear.
The scammer deletes the account
Scam numbers are burner accounts. Once deleted, the number and profile vanish. Your preserved export keeps the record of what was said and when.
Disappearing messages and delete-for-everyone
A scammer can turn on disappearing messages or delete key messages for everyone, so the ask and the account details self-destruct. Export before they do.
WhatsApp will not have a copy later
WhatsApp does not keep your messages on its servers once they are delivered, so you cannot count on recovering deleted content afterwards. The copy on your device is what matters.
Your bank claim needs the proof fast
The first 48 hours matter most for a payment claim. A clean, authenticated record of the scam supports that claim and your police report, so preserve it early.
How to report a WhatsApp scam, in order
If money changed hands, speed is everything. Work through these in order, and preserve the conversation before you block anyone.
Call your bank's fraud line, by phone
If you sent money, do this first. The first 48 hours give the best chance of stopping or reversing the payment. Call the number on your card, not one a stranger gave you.
Report to the police or your fraud agency
In the US, the FBI Internet Crime Complaint Center at ic3.gov and the FTC at reportfraud.ftc.gov. In the UK, Action Fraud. Elsewhere, your national cybercrime unit. Bring the preserved evidence and a short timeline.
Preserve the conversation, then report in WhatsApp
Export the whole chat first, so nothing is lost. Then open the chat and use Block and Report. See WhatsApp's information for law enforcement.
Certify the evidence for the record
Send us your export and we seal it with a hash, a chain of custody and a qualified timestamp, so your bank, the police or a court can rely on it later. $59.99, in 24 hours.
Beware the recovery scam, and do not become a money mule
After a scam, a second scammer may contact you promising to recover your money for an upfront fee. That is almost always another scam. And never move money for someone you met online: it can make you a money mule, which is a criminal offence.
Why a screenshot may not be enough
Take screenshots, they are a good first step. For a bank claim or a court, they are also the easiest evidence for the other side to attack.
Under FRE 901 in the US you must show the item is what you claim, and courts increasingly ask for the underlying data. A screenshot, stripped of metadata, hash and provenance, rarely clears that bar on its own.
"It could have been faked"
Fake-chat generators can produce a convincing fake conversation in seconds, so a bare screenshot invites the claim that you made it up. A SHA-256 hash and a signed manifest answer that.
No provable date
A screenshot has no independent timestamp. An eIDAS qualified timestamp and a Bitcoin anchor fix when the scam messages existed, which matters for a claim and for showing the timeline.
It shows only fragments
Screenshots capture single moments. A preserved full export shows the whole scam, the grooming, the false promises and the ask, which is what a fraud case relies on.
No chain of custody
There is no record of how the image was captured and handled. Certification preserves the raw export and adds the chain of custody an authentication needs.
From "I was scammed" to court-ready, in four steps
A done-for-you service. Export and send, we do the rest, you receive the sealed package within 24 hours for your bank, the police or your lawyer.
Export the WhatsApp chat
On a computer, right-click the conversation and choose Export chat. On a phone, open the chat and use Export chat, with media.
See exact steps ↓Upload on the secure page
A secure upload page opens right after payment. Upload your files and tell us which chat to certify plus any case reference.
We certify and deliver
A signed ZIP with your line-numbered transcript, preserved raw export, Bitcoin anchor and eIDAS timestamp, within 24 hours.
Step 1 in detail
How to export the WhatsApp chat
WhatsApp has a built-in per-chat export on your phone (iPhone and Android) and in the WhatsApp Desktop app (Mac and Windows). Choose to include media, and send us that export.
On a computer, in WhatsApp Desktop (Mac and Windows)
Export from WhatsApp Desktop
In the WhatsApp Desktop app on Mac or Windows, this is the quickest route:
- 1Right-click the conversation in your chat list (or click the chevron that appears on hover), then click Export chat.
- 2Choose Attach media (recommended) or Without media.
- 3The file is saved straight to your Downloads folder (a message confirms "Exported chat was saved to Downloads folder"). Send us that .zip.
You get the same _chat.txt plus media as the phone export. Desktop is easiest when the chat is already on your computer, or is too large to email from a phone.
On your phone (iPhone and Android)
Export from your phone
On iPhone: open the chat, then:
- 1Tap the contact or number at the top to open contact info.
- 2Scroll down and tap Export chat.
- 3Choose Attach media, then Save to Files.
On Android: open the chat, then:
- 1Tap More options (the three-dot menu at the top right).
- 2Tap More, then Export chat.
- 3Choose Include media, then pick how to save it.
Export chat greyed out or missing?
Two things can hide the in-app Export chat. It is unavailable in Germany (and may be limited in a few other regions). It is also disabled when Advanced Chat Privacy is turned on for that chat. Turn Advanced Chat Privacy off and export again, use a device backup, or email us and we will guide you.
For the exact click-by-click with screenshots, see our guide to exporting and printing a WhatsApp chat for court, or WhatsApp's guide to exporting your chat history.
Send us everything (recommended)
The primary artifact is the _chat.txt export plus its media folder. For the strongest exhibit, if available also send the WhatsApp message database, which can sometimes still hold recently deleted messages. We seal whatever you send, hashed and timestamped, never opened. If authenticity is ever disputed, a court-appointed technician can verify the transcript against the source. Decrypting the database needs its key, which the custodian provides separately.
Optional: the message database
Find your device below, then send us the folder it points to. When in doubt, send more rather than less.
Connect by USB and copy the whole WhatsApp folder:
Android/media/com.whatsapp/WhatsApp/
- •
Databases/:msgstore.db.crypt15and every dated backup - •
Media/: the attachments
Your 64-digit key: WhatsApp › Settings › Chats › Chat backup › End-to-end encrypted backup.
The store lives inside a device backup, so make a full local backup:
- 1.Plug into a Mac (Finder) or Windows PC (Apple Devices / iTunes)
- 2.Tick Encrypt local backup, set a password, back up
- 3.Send the whole backup folder:
~/Library/Application Support/MobileSync/Backup/(Mac)%APPDATA%\Apple\MobileSync\Backup\(Windows)
Encrypting the backup is what keeps the WhatsApp data complete.
Zip this whole folder as-is (needs Full Disk Access):
~/Library/Group Containers/group.net.whatsapp.WhatsApp.shared/
- •Messages:
ChatStorage.sqlitewith its-waland-shmsidecars (recently deleted messages can live only in-wal) - •Attachments: the
Media/andMessage/folders
Too large to zip whole? Send the .sqlite with its -wal and -shm plus the Media folder.
Zip the whole folder for whichever build you have:
- •Store / older app:
%LOCALAPPDATA%\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState\ - •Newer WebView2 build (default since late 2025):
%APPDATA%\WhatsApp\
Not sure which you have? Zip both paths if present, or just tell us.
Your files stay encrypted. Keep your key or backup password yourself. We seal everything exactly as sent, hashed and timestamped, and never open it. You only hand the key to a court-appointed technician if authenticity is ever disputed. After we deliver your finished package, we delete all your data from our servers.
What you get back
A readable transcript that shows the whole scam
We render your conversation into a clean, line-numbered Chat Conversation Transcript PDF: every message in original order, deleted messages shown as markers, photos inline where they were sent, and every other attachment referenced by file name and linked to the preserved file inside the package.
Every message in original send order, numbered so you or an officer can cite "Line 13"
Deleted messages shown as markers, and photos rendered inline in place
A SHA-256 hash on every file, a signed manifest and a chain of custody
Cover sheet: parties, case reference, date range, message count and source SHA-256
Bitcoin anchor plus an eIDAS qualified timestamp, verifiable by anyone for free
Two layers of proof, and what each one means
Both layers are included in every certification. The qualified timestamp is what carries legal weight in the EU.
Bitcoin OpenTimestamps
The SHA-256 hash of your sealed manifest is anchored in the Bitcoin blockchain: a decentralised, independent, tamper-resistant proof that the export existed at a point in time. Subject to the court's free evaluation of evidence.
eIDAS qualified timestamp
Court-grade in the EU
Issued by Disig a.s., a Qualified Trust Service Provider on the EU Trusted List. Under eIDAS Article 41(2) it carries a presumption of accuracy of the date and integrity of the data: the other side has to rebut it.
What certification proves, and what it does not
What certification proves
- The export existed in that exact state no later than the timestamp.
- It has not been altered since it was sealed.
- The raw export is preserved for later expert examination.
- If you also send the sealed message database, an expert can examine the sender identifiers (the phone number and WhatsApp account each message is bound to), which materially strengthens attribution.
What it does not do
- It does not recover your money and cannot guarantee reimbursement.
- It is verifiable preservation, not a report to your bank or the police.
- On its own it ties messages to an account, not conclusively to a named person; the court decides authorship.
We make the content, order and timing impossible to dispute, and preserve the untouched original, so your bank claim and any report rest on evidence that is hard to challenge. Recovering funds and deciding the case are for your bank and the court.
Built to support authentication under FRE 901 and self-authentication under FRE 902(14) in the US, and the eIDAS Article 41(2) presumption in the EU. In the UK, the Civil Evidence Act 1995 admits authenticated documents and the court weighs their reliability. ProofSnap is an evidence tool, not legal or financial advice, and cannot recover funds. Report to your bank and the authorities, and beware recovery scams.
Pricing
Already have the WhatsApp conversation exported? We certify it as-is.
One certification covers one conversation, including its attachments and any supporting file.
WhatsApp Chat Certification
1 conversation · certified in 24 hours
- Your WhatsApp export, certified as-is
- Line-numbered transcript, deleted messages marked
- eIDAS qualified timestamp + Bitcoin anchor
- Signed ZIP + certificate PDF + chain of custody
- Raw export preserved, verifiable by anyone for free
Right after payment, a secure upload page appears where you send us your files, so nothing sensitive has to go by email. If we cannot process your files, we will help you produce a usable export or issue a full credit. Not sure what you have? Ask us before you order.
A specific scam type?
See our in-depth guides on pig-butchering scam evidence and fake job and task scam evidence.
Threatened, not scammed for money?
If this is harassment or a threat, see WhatsApp harassment and stalking evidence. The full service is on the WhatsApp chat evidence page.
Frequently asked questions
For a website, not a chat
Scammed on a website, marketplace or social media, not WhatsApp?
If the scam is a fake shop, a marketplace listing, a social profile or an investment website, ProofSnap is a Chrome extension that captures it as court-ready evidence yourself, in seconds, before it is taken down. Same integrity you read about here: a SHA-256 hash, an RSA-4096 signature, a Bitcoin blockchain timestamp and a Provenance Certificate, packaged into an 11 to 15 file evidence ZIP you can verify for free.
Standard SnapPack
10 captures · no expiration · one-time purchase
Pay-as-you-go, no subscription. All features: export, metadata, a short video proof, Provenance Certificate and blockchain timestamp.
eIDAS SnapPack
EU qualified timestamps (Disig a.s.)
$5.00 / stamp · also 1× $6.99 or 10× $49.99
Adds a qualified eIDAS timestamp per capture (Article 41), with a legal presumption of accuracy across the EU. Whitelabel branding on the evidence PDF.
Subscription
Essential · Professional · Enterprise
Annual plans save 20%
For regular use: monthly capture allowances, File Certification and eIDAS stamps on higher tiers. Includes a 7-day free trial (a credit card is required to start).
Prefer no subscription and no auto-renewal? The Standard SnapPack at $4.99 is a one-time purchase. SnapPacks are bought inside the extension after you install it. See the full ProofSnap pricing and features on getproofsnap.com.
Free to install · capture your first web evidence in under a minute.