Malte ZanderContents
A screenshot holds up as evidence when it shows the whole page with the full address bar, the date, time and time zone are clear and it was stored unchanged. Add the page source, a checksum and a short log of who captured it, when and with what. Capture desktop and mobile, and secure the page before you report it.
- ISO/IEC 27037 is the international guideline for identifying, collecting, acquiring and preserving digital evidence (ISO).
- The Berkeley Protocol sets minimum standards for finding, collecting, preserving and verifying online information (UC Berkeley).
- In an analysis of 112,005 phishing websites, 31.3 percent used tricks that show the content only to certain visitors (Zhang et al., IEEE S&P 2021).
- Phishing pages whose appearance changed more than 100 times stayed online for a median of 17 days. What you see today may look different tomorrow (Lee et al., WWW 2025).
What turns a screenshot into evidence?
That a third party can trust it without having been there. A crop showing a logo and a form proves the page existed, but not where or when. A reviewer at a host, a lawyer or a court wants to see at which address the page appeared, at what time, and that the image hasn't been changed since. Those three things, place, time and integrity, are the core of all evidence handling.
The checklist for screenshots that hold up
| Element | Why it matters | How to meet it |
|---|---|---|
| Full URL | Proves where the page was | Address bar visible, long addresses also noted as text |
| Date, time, time zone | Proves when it was online | System clock in the image or a timestamp in the log, always with time zone |
| Whole page | Shows the form, imprint and text | Full-page capture instead of a screen crop |
| Desktop and mobile | Fakes look different per device | Two captures, mobile with a real device or device emulation |
| Unchanged | Credibility | Keep the original file, don't crop or compress it |
| Checksum | Proves the file wasn't altered | Note the SHA-256 of the file in the log |
| Page source | Shows what the image doesn't | Save the page's HTML and, if needed, the network recording |
| Log | Who, when, with what | A short entry per capture |
Why the whole page and not just the visible part?
Because the important details are often further down. A fake imprint, a wrong bank account, a "support" phone number or a link to the next stage of the fake rarely sit in the first screen. Modern browsers offer full-page captures, and so do the developer tools. Also capture the visible screen with the address bar, because full-page captures often leave it out.
Why desktop and mobile?
Because many fakes show different content depending on the device. Some redirect desktop visitors to harmless pages and only show the form on smartphones. Others only show their content with the right parameters in the address or only to visitors from certain countries. In the CrawlPhish study, almost one in three phishing websites used such tricks (Zhang et al., IEEE S&P 2021). So record which device, browser and link you used to see the fake. More in Hidden fakes.
What complements the screenshot?
A screenshot is an image. A takedown, and certainly a legal case, needs more:
Page source: shows embedded files, form targets and often traces of the phishing kit used.
Registration data: registrar and creation date from RDAP.
DNS and hosting: IP address, name servers, network operator.
Certificate: issuer, issue date, other names in the certificate.
Archived copy: a timestamped copy of the page, made yourself or through a public archive.
The full list is in Securing evidence of a fake website, archiving in Archiving fake sites before they vanish.
Which mistakes make screenshots worthless?
Five common ones:
Cropped images without the address bar. Without a URL, the place is missing.
No time reference. Without date, time and time zone, the time is missing.
Images sent through messengers. Many messengers compress images and strip metadata. Keep the original.
Editing. Highlights and redactions belong in a copy, never in the original.
One device, one moment. For fakes that change, several captures over time help.
Is a screenshot enough in court?
Rarely on its own. Courts weigh evidence freely, and a screenshot is easy to fake. Its credibility grows with what surrounds it: a log, a checksum, the page source, an independent archived copy and a person who can testify to the capture. For takedowns at hosts and registrars, good screenshots with the full URL are usually enough. ICANN explicitly names a screenshot and the full URL as useful evidence (ICANN). For legal proceedings, agree the requirements with your law firm. This overview is not legal advice.
How does AI Fraud Protect help?
AI Fraud Protect builds the evidence package for every find automatically: screenshots with the full URL and a timestamp, plus registration, DNS, hosting and certificate data. The case is secured before the first report goes out. A person reviews and sends every message, and the evidence stays with the case long after the fake is offline.
Start the free fraud scan for a short report within 48 hours, or request a demo to see detection, evidence and takedown in the app.
FAQ
Do I need special software for evidence screenshots?
Not necessarily. A browser with full-page capture, a checksum tool and a clean log are enough for most cases. Specialist tools help with high volumes and with cases that might go to court.
May I open a phishing page to capture it?
Yes, but don't enter any data and use an isolated environment, such as a separate browser or a virtual machine. That protects your device and keeps the case clean.
How long should I keep screenshots?
At least until the case is closed and no comeback is expected, longer if proceedings are possible. Set a fixed retention period and document the deletion.
Is a phone photo of the screen enough?
In an emergency it's better than nothing, but much weaker. It lacks resolution, the whole page and a clean time reference.
Sources
UC Berkeley Human Rights Center: Berkeley Protocol on Digital Open Source Investigations
Zhang et al.: CrawlPhish, Large-scale Analysis of Client-side Cloaking Techniques in Phishing, IEEE Symposium on Security and Privacy 2021
Lee, Lim, Kim, Kwon, Kim: 7 Days Later, Analyzing Phishing-Site Lifespan After Detected, ACM Web Conference 2025
ICANN advisory: DNS abuse obligations in the registrar and registry agreements, 5 February 2024