Build a verifiable incident timeline

  • Pair every event with the local date, time zone and the source that supports it.
  • Separate what you directly observed from what a bank, provider or other person told you.
  • Add case numbers and promised follow-up dates beside the related contact rather than in a separate unsorted list.

Build one timeline entry that another person can verify

Repeat this compact record for each alert, transaction, contact and promised follow-up.

When

Local date, time and time zone.

What happened

One observed event without guessing at motive or cause.

Proof and next step

The message, statement, case number or person supporting the entry, plus what is due next.

Start with events you can verify

  1. Start with the earliest reliable alert, transaction or loss time.
  2. For every contact, record the channel, department, reference and promised action.
  3. Keep a secure master and share redacted copies without passwords or full identity numbers.

Use a timeline that another reviewer can follow

A good incident timeline is compact, factual and linked to evidence. It should reduce questions instead of becoming another unstructured document.

One event per line
Use the local date, time and time zone, then describe one observed event. Separate an alert, transaction, phone call and account change into different entries even when they happened close together.
Source beside the event
Add the statement line, message filename, case reference or person that supports the entry. Keep original files unchanged and label any cropped, highlighted or redacted working copy.
Action and result
Record what you did, the official channel used and the immediate result. Write 'card locked in app' or 'case opened by fraud department' instead of vague notes such as 'handled bank.'
Next owner and date
End the entry with who must act next and when you will check again. This makes missed promises and unanswered document requests visible without relying on memory.

Keep a private master with the necessary references. Before sharing a copy, remove passwords, one-time codes, full account numbers and identity numbers that the recipient does not need.

Turn scattered records into a usable chronology

Use observed facts

Record time, channel, sender, action, amount and reference. Separate what you observed from what you infer. Keep original timestamps and time zones.

Capture outcomes

For each call, note the trusted number used, representative or department, case number, promised action and follow-up date. Avoid recording calls unless local law and the other party permit it.

Redact working copies

Keep a secure master, but remove full account numbers, identity numbers and access codes from versions you email or print.

Use a repeatable entry format

A useful line is: local date and time; what you observed; amount or account label; action taken; organization contacted; reference number; next deadline. Preserve the time zone when people or systems are in different places.

Attach evidence without rewriting it

Give files simple labels such as bank-alert and call-note, then refer to those labels in the timeline. Keep original messages and files unchanged; annotate a copy if explanation is needed.

Records that support the next step

For payment cases, connect the chronology to a clear card-dispute evidence file.

If the timeline begins with unfamiliar account access, start with the account-takeover containment order.

Questions about building the record

Should I include guesses about who did it?

Keep guesses in a clearly marked notes section. The main chronology should use facts you can support.

Can I record support calls?

Recording laws and company rules vary. Written notes and confirmation messages are a safer default unless you know recording is permitted.

General information only

Processes, rights and deadlines depend on your location, provider and policy. Use the relevant official service for your jurisdiction.

Primary sources