Keep what makes it possible to reconstruct what happened
During an incident, messages, screens and notices can change as new information arrives. Record the source and the time of what you observed, and distinguish confirmed facts from hypotheses. That makes it easier to relate the documents to the sequence of events.
Documentation helps the review, but it does not guarantee that a request will be accepted. Consult the contract for the evidence required and the applicable time limits. Organize what is available without exposing credentials or discussing the case on public channels.
Four sets of information that complement one another
Gather the identifiers of the related transactions and the network of each one. State which action each record represents. The identifier locates the transaction, but its relationship to the loss has to be clear in the report.
Keep the position you observed, with the date and time, and obtain the statement available from the service. When there are records from before and from after, keep both so they can be compared. A capture should be accompanied by the context in which it was produced.
Keep official communications together with the source address and the time of the consultation. Distinguish the provider's notice from comments by third parties, and keep the version you consulted so that any later change in the information can be placed in time.
Write a chronological sequence of what you did and what you observed. Relate each point to the corresponding transactions, screens or documents, and mark what has not yet been confirmed. That report connects the evidence without replacing what the contract requires.
Keep the case in the appropriate environment
Handle the claim through the authenticated area, and use the official channel for questions about submission. Publishing details in groups can expose personal data and attract improper offers of recovery. The documentation has to reach the correct process without becoming public.
Never send a private key, a recovery phrase or an authentication code to anyone who presents themselves as support. Those details give access to the assets or to the account, and they are not evidence required for the review of a claim. Keep the incident records without sharing the means of moving the assets.
