Online harassment rarely arrives as one tidy piece of evidence. It may begin with a message, move to a false account, continue through comments and then disappear when the sender deletes the content.
If you are deciding whether to report the behaviour or ask for professional help, your first task is not to identify the person yourself. It is to protect your safety and preserve an accurate record of what happened.
If you are in immediate danger, contact the police first
Call 999 if there is an immediate danger to life, violence is being used or someone is threatening violence. For a situation that is not an emergency, contact your local police service.
You do not need to build a complete evidence file before making a report. Police.uk says you can report threatening messages without first gathering screenshots, texts, videos or photographs. If you can safely retain details such as the sender name, username, platform, date and content, they may still be useful.
If the behaviour involves stalking, repeated unwanted contact or threats, do not delay a police report while waiting for a private investigation.
What should you save?
Good online harassment evidence preserves the original context, source and timing of each incident. Start with the material that shows what happened, where it happened and when it happened.
1. The complete message or post
Capture the full screen where possible. A cropped sentence may remove the username, date, platform or surrounding conversation that gives it meaning.
Keep the original message, email or file as well as any screenshot. Do not edit the screenshot or add marks over the original copy.
2. The account details
Record the visible username, profile name, profile address and user identification number if the platform shows one. A display name can change. The profile address or platform identifier may give a more stable reference.
3. The date, time and web address
Write down when you saw the content and when it appears to have been posted. Save the full web address for public posts and profiles.
If the platform shows a different time zone, record that rather than silently converting it.
4. The surrounding pattern
Keep a simple incident log. Record each contact, false profile, threat, mention of private information or approach to another person.
In England and Wales, the Protection from Harassment Act 1997 defines a course of conduct as conduct on at least two occasions, and conduct includes speech. That does not mean two unpleasant messages automatically prove a criminal offence. The full circumstances and impact matter, and the police or a legal adviser should assess them.
The law and reporting routes differ across the United Kingdom. If you are in Scotland or Northern Ireland, use the advice and reporting route for your jurisdiction.
5. Reports already made
Save the reference number and confirmation for every report made to a platform or the police. Record what content you reported and when.
This helps show what action has already been taken and prevents later confusion about which version of the content was available at the time.
Protect the accounts you control
If you suspect that an email or social media account has been accessed, use the provider’s official account recovery process. Check for changes you did not make, unknown logins, sent messages you do not recognise and altered security settings.
The National Cyber Security Centre recommends using two step verification on important accounts such as email and social media. Use a strong, separate password for each important account and do not approve a login request you did not initiate.
Do not share passwords with an investigator. If forensic examination is justified, agree the lawful scope and access method before anyone handles your device or account.
When can a private investigator help?
A private investigator may be useful when the immediate safety and reporting steps are already in hand, but the material is fragmented or the sender is using false identities.
The work may include:
- building a clear chronology across several accounts or platforms
- preserving public material with its source, date and context
- comparing repeated usernames, language, images and other visible identifiers
- examining a device or account that you lawfully control and have authorised for review
- separating confirmed facts from assumptions about who is responsible
- preparing an organised report for your solicitor, the police or a platform
An investigator cannot compel a social media company or internet provider to disclose subscriber information. They must not enter private accounts or devices without authority. They should not promise that an anonymous person can always be identified.
The Crown Prosecution Service notes that cyberstalking and online harassment may overlap with other conduct, including unwanted messages, false profiles, identity theft and attempts to damage a person’s reputation. That is one reason a complete chronology can be more useful than a folder of disconnected screenshots.
What should you bring to the first conversation?
You do not need to organise everything perfectly. Bring what you have and explain what outcome you need.
Useful starting information includes:
- links to the accounts, posts or messages involved
- screenshots and original files
- dates and times
- the platforms used
- any known connection between you and the sender
- police or platform reference numbers
- details of threats, location information or private material that increase the risk
- the result you need, such as preserving evidence, identifying a lawful line of enquiry or preparing material for legal advice
Be careful about certainty. Similar writing, shared photographs or a familiar username may support an enquiry, but none proves identity on its own.
Get the evidence into a usable order
If online harassment is continuing, your safety comes first. Report immediate risk to the police and follow the platform’s reporting process.
If you need help preserving a pattern of conduct, assessing what can be investigated lawfully or organising evidence for the next step, read how UKPI handles online harassment investigations or review the wider cyber investigations service.
You can then request a confidential consultation and explain what has happened, what you have saved and what decision the evidence needs to support.
Sources
- Police.uk guidance on reporting threatening messages
- GOV.UK guidance on reporting stalking
- Protection from Harassment Act 1997
- Crown Prosecution Service guidance on communications offences
- National Cyber Security Centre guidance on social media safety
- National Cyber Security Centre guidance on recovering a hacked account