Home › Knowledge Hub › Write a crypto scam timeline

How to write a clear crypto scam timeline investigators can use

By Golan Ben Moshe · Co-founder, Chain Pursuit · 7 min · Last updated 21 October 2026

Reviewed by the Chain Pursuit editorial team · Last reviewed 15 October 2026

To write a crypto scam timeline an investigator can actually use, build a dated, factual sequence that separates what happened from what you suspect. For each entry, record the date and time, the event, the party or account involved, any payment detail such as a transaction hash, and the evidence file that supports it. A clear chronological record, in neutral language, does more for your case than a long emotional account, because it lets an outside reviewer understand in minutes what took you weeks to live through.

Why a timeline, not a story

When you report a scam, the person reading, a police officer, an exchange compliance analyst, a bank's fraud team, has limited time and no knowledge of your case. A long, emotional narrative buries the facts they need. A clear, dated timeline surfaces them. The same information, organised chronologically and neutrally, is the difference between a report that can be acted on and one that gets set aside.

This builds on our evidence checklist, which covers what to collect. This page is about how to organise it into something an outsider can follow.

The template

Use a simple table, one row per event, in order. These columns carry what an investigator needs:

The example above uses fictional placeholders. Replace them with your real, verified details. Include a time zone, note it once at the top, and keep the format consistent.

What to include in each column

Date and time. As precise as you can, with the time zone stated. Timing is often what connects your case to others or establishes a recall window.

Event. One factual sentence: what happened, not how you felt about it. "Sent 0.5 ETH to the platform wallet," not "I was tricked into sending everything I had."

Party or account. The username, display name, phone number, email, platform name, or wallet address involved. Use the exact handles and addresses.

Payment detail. For any transfer, the amount, the asset, the network, and the transaction hash. The transaction hash (TXID) is the single most valuable item, because it lets anyone verify the transfer on the blockchain. Our guide to how blockchain tracing works explains what happens next with it.

Evidence. The filename of the screenshot, export, or receipt that supports the row, so each claim can be checked against a source.

Keep fact and suspicion separate

This is the habit that makes a timeline credible. Record what you directly observed as fact, and mark anything you infer as such.

"On 3 February I sent 0.5 ETH to 0x…" is a fact. "The scammer then moved it to an exchange" is a suspicion unless you can show the on-chain hop, in which case it becomes a fact with a TXID attached. Keeping the two apart does not weaken your report; it strengthens it, because a reviewer can trust your facts precisely because you did not overstate them. If you are unsure of something, say so plainly: "unsure of exact date; between 10 and 12 February."

Common mistakes to avoid

A usable timeline against a weak one

• An emotional narrative with no dates. Understandable, but unusable. Lead with the timeline; put feelings, if any, in a short separate note.
• Cropped or edited screenshots. Capture full screenshots showing context, handles, and timestamps. Never alter an original; keep the untouched file.
• Missing time zone. A timestamp with no zone is ambiguous and can break a recall or correlation.
• No transaction network. "I sent USDT" is incomplete; state the network, because the same asset exists on several and the TXID lives on only one.
• Addresses copied from memory. Copy wallet addresses and hashes from the source, never retype them, and beware copying from a transaction history that could be poisoned.
• One giant paragraph. Use the table. It is faster for you to build and for them to read.

Before you submit

A short checklist:

• Every row has a date, an event, and at least one of: party, payment detail, or evidence.
• The time zone is stated once, at the top.
• Every transfer has an amount, asset, network, and TXID where available.
• Facts and inferences are clearly separated.
• Every claim points to an evidence file you still hold in original form.
• Personal secrets are absent: no seed phrase, private key, password, or codes appear anywhere in the document.

In practice

Build the table as you gather evidence, not after. Add a row whenever you find a new screenshot or transaction, copy addresses and hashes from the source, and note the time zone once at the top. When it is time to report, to IC3 or your national line, to your bank, or to an exchange, you will have a document they can act on, and you can reuse the same timeline for each without rewriting it.

What this guide cannot do

A clear timeline does not, by itself, recover funds or identify the scammer; it is the thing that lets the people who might do those do their work faster and take your case seriously. What it guarantees is that your report will not fail for being unreadable, which is a surprisingly common reason good cases stall.

This is general information, not legal or investigative advice.

Use Chain Pursuit's free tools to organise your case and identify possible recovery scams. Do not share your seed phrase or private keys with anyone, and never include them in a report.

Sources

Federal Bureau of Investigation, Internet Crime Complaint Center, Filing a Complaint and What to Include. https://www.ic3.gov/Home/FAQ, on providing transaction details, dates, and supporting information in a fraud report.

Federal Trade Commission, What To Do if You Were Scammed. https://consumer.ftc.gov/articles/what-do-if-you-were-scammed, on documenting and reporting, and the payment details that matter.

The value of a neutral, dated, source-linked chronology reflects standard evidence-handling practice; the specific fields here map to what exchanges and law-enforcement reports commonly request. Reviewed quarterly.

Frequently asked questions

How detailed should a crypto scam timeline be?

Detailed enough that a stranger can follow what happened without asking questions, but no longer. One row per event, each with a date and time, a one-sentence factual description, the party or account, any payment detail, and the evidence file. Precision on dates, amounts, networks, and transaction hashes matters more than length.

Should I include every message in my report?

Not in the timeline itself. Summarise each significant event in one factual row and reference the screenshot that supports it. Keep the full message exports as evidence files you can provide if asked. A timeline is a readable index into your evidence, not a transcript.

How do I prove a wallet address was sent to me by a scammer?

Keep the original, uncropped screenshot or chat export showing the address in context, with the handle and timestamp visible, and record it as a row in your timeline. Copy the address from the source rather than retyping it. The message plus the on-chain transaction to that address together make the point.

Can I submit a timeline without knowing the scammer's real identity?

Yes, and you usually will not know it. Investigators do not expect you to identify the person; they expect accurate accounts, handles, addresses, and transaction hashes. Record what you observed, mark what you only infer, and let the authorities and the blockchain trail do the identification.

What should I never put in a timeline?

Your seed phrase, private keys, passwords, or two-factor codes. These are never needed in a report and including them creates a new risk. A legitimate recipient needs transaction hashes, addresses, amounts, dates, and screenshots, not your secrets.

Should I write how the scam made me feel?

Keep the timeline factual and neutral, because that is what makes it usable. If the emotional impact is relevant, for a victim-impact statement, say, put it in a short separate note rather than mixing it into the chronology, where it would bury the facts a reviewer needs.

Keep reading