A suspected online scam: what to prepare before a consultation

What should not wait for analysis

If money has been lost or your bank account may be at risk, contact your bank urgently through its official channel. Poland's Central Cybercrime Bureau (CBZC) recommends urgent bank contact in its guidance for scam victims (in Polish). Do not wait for a perfect timeline or an analyst's reply. If an online account has been taken over, also use the platform's official account recovery and security process.

CBZC states that a crime report can be made at any Polish police unit. An incident report to CERT Polska (Polish FAQ) is a separate route for reporting an online threat; it does not replace reporting a suspected crime. Each recipient sets the information requirements for its own process. The first-contact restrictions below apply to the OSINT Detektyw consultation only.

What to prepare privately, without sending it yet

Start with what you already lawfully hold. You do not need to identify an offender yourself, make contact under a pretext or obtain new personal information. An inventory helps establish what the problem concerns and which information actually exists.

• A short account of the incident: what was offered, what the contact concerned, what happened and what raised suspicion. Distinguish an observation from your assessment.
• Dates and sequence: first contact, material changes to the offer, a payment, the last response and any observed change or disappearance of public content.
• Public traces: URLs of listings, websites or profiles already held, with when and in what context they were seen. Keep them in your private notes without reopening suspicious links.
• Non-public material: an inventory of correspondence and payment documents you hold. Possessing them does not mean they will be accepted for OSINT analysis.
• Steps already taken: whether you contacted a bank, platform, CERT Polska or the police. Keep the details and case reference numbers locally.
• One main question: for example, whether public listings used the same identifiers during a specified period.

CBZC lists the website address, correspondence in its unchanged form and transaction information among the materials useful for a crime report. That guidance concerns preparation for the police; it is not a request to send those details to OSINT Detektyw.

Build a timeline without filling gaps with assumptions

For each entry, note the date, event, source of the information and what remains unknown. If the time is approximate, say “approximately” instead of creating false precision. For events across countries, preserve the time-zone context; the time displayed in an application may need clarification.

Synthetic example — all events and labels are fictional:

• Day 1: the reader saw Profile A associated with Listing B. Basis: a retained view of the listing. The account operator is unknown.
• Day 2: a payment was made. Basis: a payment confirmation retained privately. The relationship between the payment recipient and the profile operator has not been established.
• Day 5: Listing B was unavailable when checked. Basis: a note made that day. When or why it disappeared is unknown.

This preserves important distinctions. “I cannot see the listing” does not yet mean “the offender deleted the evidence”. A name displayed with a payment does not determine who operates an account. Analysis may compare public connections, but should not fill these gaps with speculation.

Preserve the context of the material

Do not overwrite originals with your comments. Keep notes and summaries separately so that the material can later be distinguished from your description. For an existing screenshot, record the URL, capture date and viewing context where known. A cropped fragment may not reveal which listing, conversation or moment it concerns.

Do not run suspicious attachments or log in through a received link to complete your documentation. CERT Polska warns against opening unexpected attachments. Preserving material should help later assessment, not expose accounts or devices to another threat.

Do not publish your own collection of “evidence” containing other people's data. The way material is shared should fit the intended recipient and purpose. This article does not determine a screenshot's or file's authenticity, completeness or evidential value; those require assessment in the particular context.

Preparing material and sending a first message are separate stages

Stage one: a general description for qualification

Tell OSINT Detektyw the type of incident, approximate period, connection to Poland and types of public trace available. Explain what you want to clarify. Use labels such as “Profile A” and “Listing B”. You can begin this discussion remotely from abroad without transferring the case material.

Synthetic example of a first message: “I suspect a scam involving an online offer connected to Poland. The events took place during the last two weeks. I hold a record of a public listing and profile, and my own timeline. I would like to know whether public-source analysis could clarify connections between listings. I have already contacted my bank.” Include the last sentence only if it is true.

Do not include names, bank account numbers, document numbers or third-party phone numbers, profile URLs, payment confirmations, conversation screenshots, documents, passwords, codes or intimate material. State the type of material, without supplying its contents.

Stage two: an agreed scope and sharing method

After assessing the purpose and whether the work is permissible, we agree which information is necessary and how it may be shared. Private material requires a separate assessment; it is not automatically part of public-source analysis. Agreeing to a conversation is not an invitation to send your entire archive.

Which questions can OSINT help answer?

A useful question concerns information that can be compared: the public history of a listing, earlier appearances of its content, changes in claims or public connections between identifiers. The output may be a chronology, source register and explanation of discrepancies. Scope and format are agreed before work begins. For an enquiry from abroad, also agree the language and contents of the output; the work concerns lawfully available sources relevant to Poland.

A public connection between listings does not always identify a particular person. OSINT Detektyw does not take over accounts or recover money, and does not guarantee identification of an offender. It does not replace a bank, platform, law-enforcement authority or lawyer. See the online scam and fake-profile analysis service for the scope.

If no incident has occurred and you only need to assess a person's claim before making a decision, start with the guide to checking a suspicious profile. This helps choose the right question without expanding the analysis to a person's entire life.

Before contacting us

• Have I avoided delaying urgent bank or platform action while waiting for a consultation?
• Have I separated known events from assumptions about an offender or their intentions?
• Are the material and its context retained locally, without overwriting originals?
• Can I identify one question about public information?
• Does my first message contain only a general description and material types, without personal details, links or attachments?

Once that description is ready, use the contact page to discuss a possible scope. Limiting the first message is our service process, consistent with data minimisation under Article 5 of the GDPR. It is not a legal assessment of your matter.