The written report
Zavialov Ilia Nikolaevich on what to put in a fraud report before you send it
A fraud report is judged on what it contains before anyone reads the story behind it. Two people can lose money to the same scheme and file reports of very different value: one lists dates, account numbers and a saved screenshot, the other says only that a caller «from the bank» asked for a code. Reviewers cannot chase missing details for every case, so the file with gaps waits longest. This piece works through what to put in a fraud report, in the order a reviewer actually reads it.
English version for the United States.
Why the document decides the queue
A caseworker reads a fraud report differently from a friend hearing the same story. Dozens of files land in a single shift, each judged within minutes: a name to trace, an account to freeze, a number to flag. A report written like a diary entry forces a call back to whoever filed it. That wait for a reply is usually where a week or two disappears.
Scale makes this worse. The FBI's Internet Crime Complaint Center logged 1,008,597 complaints and close to 21 billion dollars in losses for 2025, up 26 per cent on the year before. That queue cannot run on follow-up calls for every half-finished file, which is the reason to think about what to put in a fraud report before writing the first line.
Getting this right is about the order of the facts, so the reader does not hunt for a date buried in paragraph four or guess which account the money left. The sections below go through the document part by part, roughly the order a reviewer reads it: timeline, money, the other side, then attachments. A report in that order tends to read as finished on the first pass.
The exact times a caseworker needs
«Last month» and «a few weeks ago» are the two phrases that slow a fraud report down more than any other. A reviewer needs actual dates, and ideally times, for three moments: first contact, the point you were persuaded to trust, and when money or details moved. Without those points fixed on a calendar, nobody can line your case up against a similar one filed the same week.
Your own devices already hold most of this. A phone keeps a call log with the time and duration of every call, a messaging app timestamps each message, and a bank statement stamps every transaction to the minute. Pulling those timestamps from the source, rather than trying to remember them, removes a common reason a report gets sent back for correction.
Write the timeline before writing anything else. A short numbered list, one line per event with a date and time, gives the report a spine, and the rest can then follow that same order. That habit, writing chronologically, is a large part of what to put in a fraud report if the aim is a document a stranger can follow unaided.
Account numbers and transaction references
A caseworker cannot trace money on the strength of «I sent it from my usual account». The report needs the account or card the payment left from, the sort code or routing number, the exact amount, the currency, and the reference number carried. Most of this sits on the confirmation screen or the emailed receipt, so save it the moment a payment looks wrong.
Where the destination account is known, even partially, it belongs in the report too: an account number, a wallet address for a cryptocurrency payment, or the receiving name shown on screen. A partial number is still more useful than a vague description, since it can be matched against other reports naming the same destination. A screenshot taken at payment can later link two reports.
Currency and amount deserve their own line rather than being folded into a sentence about something else. Where more than one payment was made, each needs its own date, amount and reference, set out separately. Separate transactions can be matched against bank records; a combined figure cannot.
The other side's numbers and addresses
Everything the other side gave you, even details you suspect were false, has a place in the report: phone numbers that called or texted, the caller ID even where spoofed, email addresses, and any website or app the conversation moved to. A fake-looking number is still worth recording. That is part of what to put in a fraud report, since a false caller ID is itself a pattern investigators track across complaints.
Physical addresses matter more than people expect from a scheme that started online. Some schemes end with a courier collecting cash or gold bars in person, so a pickup address or the address on a fake invoice can tie a report to others naming the same location. If an address was mentioned even once, it belongs in the report exactly as given.
Phone based schemes deserve particular care. Call center fraud, fake technical support bundled with impersonation of a government office, produced more than 80,000 complaints and 2.9 billion dollars in losses in the FBI's most recent tally, turning mostly on the number that called and what the caller claimed to represent. The caller's exact words help match a report against others naming the same script.
Screenshots and messages worth keeping
A chat log, a text thread or an email exchange is worth attaching in full rather than summarized in your own words. A later summary tends to smooth over an odd phrase or a slightly wrong name that a reviewer would flag as significant. Screenshot each screen with the clock visible, since a cropped image that hides the date is a common gap in an otherwise solid report.
Where an app allows it, export the conversation as a file rather than relying on screenshots alone. Some messaging platforms let the sender delete a message from both ends of a conversation, which can remove the very line a screenshot never captured. A saved export keeps the full thread even after the other side tries to clean it up.
A screenshot of the website, the QR code, or the profile page used in the approach belongs alongside the messages. Pages connected to a scheme tend to vanish within days once reported elsewhere, so a page convincing on the day of the call may no longer exist by the time anyone checks. Capturing it at the time is the only way to preserve what it said.
What most reports leave out, and why it costs weeks
A common gap in a weak report is that it never states plainly whether money actually left an account. The Federal Trade Commission's 2025 figures show four out of five impersonation contacts involved no money loss at all, meaning most reports describe an attempt rather than a completed theft. Saying so in one clear sentence near the top helps a reviewer act on it rather than guess.
Reports filed on behalf of an older relative carry a different gap. The FBI's data on victims 60 and over puts their average loss at 38,501 dollars against a general average of 20,699 dollars, nearly double, and many are written by an adult child rather than the person the caller spoke to. Details from that conversation, exact wording, a name used, often never reach the report because the writer was not on the call.
The fix in both cases points to the same rule for what to put in a fraud report: write down what was said and what happened, rather than a summary of the general shape of the scheme. A reviewer already knows that shape from thousands of other filings; what they need is the specific detail that makes this one traceable. That detail turns one report into a case someone can follow.
Putting the pages together
Once the facts are gathered, the order they sit in on the page matters almost as much as the facts themselves. A summary line at the top, the numbered timeline next, then money, then the other side's numbers and addresses, then attachments, gives a reviewer a document worked through top to bottom without hunting. Each section answers a question the reviewer would ask anyway.
For a printed copy, number the pages and sign and date the final one. A multi-page report without page numbers is easy to reassemble in the wrong order once scanned, and a reviewer working from a scan cannot tell if a page is missing unless the numbering says so. One printed and one digital copy means a lost page in one can be checked against the other.
A complete answer to what to put in a fraud report is simply one where every fact a reviewer needs sits where they expect to find it, so the case moves on the first read rather than the second or third. Putting that structure together takes a small amount of extra time at the point of writing. That time is what shortens the weeks of waiting that follow a gap-filled report.
The written report, part by part
| Report section | What belongs there | Gap that stalls review |
|---|---|---|
| Header line | date filed, your name, a case or account number | no reference number, so the file cannot be matched later |
| Timeline | date and time of first contact, of trust, of payment | vague ranges such as sometime last month |
| Money details | amount, currency, your account, destination account or wallet address | only a partial account number with no reference |
| Other side's details | phone numbers, email addresses, website address, any physical address given | just a first name or a nickname |
| Attachments | screenshots with a visible timestamp, saved chat export, confirmation screen | a cropped screenshot with no date showing |
| Signature block | printed name, signature, date, page count | no page numbers on a multi-page report |
Questions and answers
- What to put in a fraud report?
- A working fraud report needs an exact timeline of dates and times, the account or transaction details on your side, every phone number, email address and website the other side used, and screenshots or saved messages that back up each claim. Leaving any of these out is usually what sends a report back for a follow-up call before a caseworker can act on it.
- Should I file a report if no money was actually taken?
- Yes. The Federal Trade Commission's 2025 figures show four out of five impersonation contacts involved no money loss at all, and reports of attempts still help investigators match numbers, scripts and addresses against cases where money did move. Stating plainly in the report that no money was lost saves the caseworker from having to work that out from context.
- Do I need a screenshot for every message?
- A screenshot matters most for any message that shows a phone number, an account detail, a request for money or a claim about who was calling. Capture the full screen with the device clock visible rather than a tight crop, since a cropped image without a visible date is one of the most common gaps a reviewer flags.
- What if I never learned the destination account number?
- Write down whatever partial detail exists, even a few digits, a bank name mentioned on a call, or a wallet address copied before a cryptocurrency payment. A partial detail can still be matched against other reports naming the same destination, so it belongs in the report exactly as it was seen.
- Should a spoofed phone number still go in the report?
- Yes. A caller ID that looks fake is still useful, because investigators track which false numbers keep appearing across separate complaints. Recording the exact number shown, together with the date and time it called, is still part of what to put in a fraud report even when the number itself was never genuine.
- How long does a bank or the police take to review a fraud report?
- There is no fixed number of days, and the FBI's Internet Crime Complaint Center alone logged over a million complaints in 2025, so review time depends heavily on how complete the file already is. A report with a clear timeline, account numbers and attachments in place tends to move on the first read rather than waiting in a queue for missing details.
Written by Zavialov Ilia Nikolaevich, digital security consultant. All checklists