Record what you observed
ScreenshotA screenshot of the text, call log, or message as it appeared to you.
Displayed caller numberWrite down the number shown by caller ID, even if you suspect it was spoofed.
Date and timeInclude the date, approximate time, and timezone if known.
Voicemail or audioKeep a voicemail or recording already available to you.
Spoken callback numberRecord any number the caller or voicemail told you to call.
Exact wordingSave the text or write a transcript of the important language.
URLsSave the link exactly as displayed. You do not need to open a suspicious link.
Names actually statedRecord product or company names the message itself used.
Opt-outIf you sent STOP or another opt-out, record what you sent and when.
Later contactNote any subsequent calls or texts after an opt-out or do-not-call request.
Complaint/reference numbersKeep ticket or reference numbers from official organizations you contacted.
Keep fact and inference separate
A screenshot can show what number appeared. It usually does not prove who actually controlled the call. A URL can show where a message pointed. It does not automatically prove who sent the message.
Record what you observed. Keep facts separate from assumptions about who sent it.
You do not need to provoke more contact
Do not click a suspicious link, call a suspicious number, provide personal information, or encourage more calls merely to create a larger record. Use what you already received and report suspicious activity through appropriate official channels.
What SpamPath does with a report
SpamPath can help organize observations and compare recurring identifiers. A match is a research lead, not automatic proof that two reports came from the same actor.