How to document harassment by text or chat

Harassment records are strongest when they preserve each contact, show the sequence across channels, and separate what happened from assumptions about who was behind it.

Start with safety

If you are in immediate danger, call emergency services when safe to do so. In the US, call 911. In the UK, call 999. If someone may monitor your phone, use a safer device and account. Refuge’s helpline site specifically advises leaving and visiting from a safe device when monitoring is a concern.

The US National Domestic Violence Hotline is available 24/7 at 800-799-SAFE (7233), by text at START to 88788, and by chat at thehotline.org. Refuge runs the free, 24-hour National Domestic Abuse Helpline in the UK at 0808 2000 247 and nationaldahelpline.org.uk. These services can discuss safety options; they do not replace emergency response.

Preserve first, organize second

Do not begin by cropping the worst lines. Preserve the entire conversation in its native app and make a supported export where available. Include participant identifiers, dates, times, attachments, reactions and enough context to interpret replies. Keep the source phone and do not silently rename speakers or correct wording.

Create a separate working copy for highlighting and redaction. Record when and how it was made. Store an additional copy somewhere the other person cannot reach, but consider whether cloud alerts or shared accounts could reveal it. A trusted advocate can help make a device-safety plan.

An incident log should have one row per event: date and time, location or channel, exactly what you observed, people present, related file names, any report reference, and practical impact. Write promptly and factually. “Three messages arrived between 11:42 p.m. and 11:47 p.m.” is more useful than “they always terrorize me.” The free incident-log tool runs in the browser without uploading entries.

A step-by-step documentation workflow

The safest useful workflow is preserve, log, export, secure, and report through the appropriate route. Do not delay urgent help to finish paperwork.

1. Preserve the source. Leave messages in the native app. Capture the account page, number, username, URL, date, time, reactions, replies, and attachments. For disappearing or live content, make a lawful capture promptly and note the method.
2. Record the event. Add one factual incident-log entry. Include location, witnesses, related calls or approaches, immediate impact, and any action taken. Distinguish “account displayed this name” from “this person sent it.”
3. Export when available. Keep the platform export and original media. For a short exchange, take overlapping screenshots that show sequence. Never type a reconstruction and label it as the original.
4. Make a protected backup. Use storage and an account the other person cannot access. Consider whether a shared cloud plan, notification, recent-files list, printer queue, or email account could reveal the copy.
5. Do not retaliate. Do not threaten, impersonate, publish private details, access another account, or arrange confrontations. Those actions can increase danger and complicate any report.
6. Keep report records. Save police, platform, employer, landlord, school, or court reference numbers; names and roles of recipients; dates; and the exact files supplied.

Keep the preserved archive separate from the working report. Highlighting, adding notes, and redacting should happen on a copy. If a later incident connects to an earlier one, add a cross-reference rather than rewriting the old entry from memory.

Online harassment and unknown accounts

Online conduct can move quickly across direct messages, comments, email, payment notes, game chat, and new profiles. Record the full URL and username, not just the displayed name. Preserve profile pages and message headers where visible. A platform report confirmation and the original notification email may supply useful identifiers or timing.

An anonymous-looking account is not proof of anonymity, and a familiar phrase is not proof of authorship. Phone numbers and caller ID can be spoofed. Screenshots may document what appeared on the device, but ordinary users usually cannot reliably identify the network origin. Do not accuse someone publicly based only on a contact label, writing style, or number display.

Carriers and platforms may hold limited account or connection records for limited periods, but availability, legal process, retention, and privacy rules vary. Police may seek records where the law and investigation permit. A private person should not pay an unverified “tracing” service or attempt to break into an account. Preserve promptly and provide identifiers to the proper investigator.

Neighbor harassment

Record each event rather than one long narrative. Note noise duration, words used, property affected, witnesses, calls to management or police, and the response. Preserve lawful doorbell footage or messages in original form. Local recording and surveillance rules differ, so do not secretly record private conversations without checking the law.

Keep ordinary evidence too: letters, repair requests, photographs, delivery records, case numbers and lease provisions. Report through the channel appropriate to the conduct. A housing manager, police officer and civil court may need different information. Avoid confrontation undertaken only to obtain a recording.

Workplace harassment

Keep the exact message, date, account, participants and surrounding exchange. Note witnesses, the work setting, how the conduct affected work, and when you reported it. Save the applicable policy and the employer’s acknowledgment. Use an approved HR, manager, union or safeguarding route where safe.

Do not forward trade secrets, client records or unrelated coworkers’ private data to a personal account merely to build a file. Ask a lawyer or union representative how to preserve evidence you may not lawfully remove. Keep your factual chronology separate from legal labels. The related HR complaints guide addresses complaint organization.

Ex-partner harassment and stalking

Repeated contact across new numbers, accounts and platforms can be clearer when shown in one chronology while each original remains preserved. Record unwanted approaches, third-party contact, gifts, location references, account access alerts and police incident numbers. Do not publish the material publicly; that can increase risk and expose private information.

In England and Wales, section 1 of the Protection from Harassment Act 1997 prohibits a course of conduct amounting to harassment when the person knows or ought to know it amounts to harassment. Section 2 creates an offense, section 3 provides a civil remedy, and section 4 addresses putting people in fear of violence. Whether conduct meets a provision is fact-specific. The Act is not a label for every unpleasant message.

In the US, protective and restraining orders are created by state, tribal and territorial law, with different relationships, conduct, forms and proof requirements. Use the relevant court’s current self-help material or an advocate rather than assuming one national standard.

US protective orders and federal stalking law

A state protective-order application commonly asks for specific recent events, the relationship, requested protections, and supporting documents, but eligibility and procedure differ. Some courts use separate orders for domestic violence, stalking, harassment, elder abuse, or workplace violence. Use the issuing court’s forms and self-help instructions. An advocate can help with safety planning and service concerns.

Federal law is not a general replacement for state reporting. Under 18 U.S.C. § 2261A, the federal stalking offense includes specified interstate, foreign-commerce, jurisdictional, intent, course-of-conduct, and harm elements. The statute covers certain uses of mail, interactive computer services, electronic communication services, and electronic communication systems. Whether conduct meets every element is a question for authorities and courts, not something a message log can decide.

Report immediate threats to emergency services. For nonemergency online crime, the US Department of Justice directs people to the appropriate federal or local reporting route by crime type. Keep any complaint confirmation. If intimate images or threats to distribute them are involved, the Cyber Civil Rights Initiative Safety Center provides specialist information; state and federal laws may apply.

England and Wales legal framework

The Protection from Harassment Act uses “course of conduct” to mean conduct on at least two occasions in relation to one person. Sections 1 and 2 address harassment; section 4 addresses a course of conduct causing fear, on at least two occasions, that violence will be used, with the statutory knowledge test. Section 7 explains that conduct includes speech and that aiding, abetting, counseling, or procuring another person’s conduct can count for course-of-conduct purposes. The facts and available defenses matter.

Stalking protection orders are civil orders police can apply for under the Stalking Protection Act 2019. Government statutory guidance describes them as an early-intervention tool and explains interim orders, prohibitions, requirements, notification, and breach. A victim does not personally apply for this order, although other civil or criminal routes may be available.

Communications offenses changed in 2024. The Online Safety Act 2023’s false and threatening communications offenses and the offense of encouraging or assisting serious self-harm were brought into force on 31 January 2024 by the cited commencement regulations. Older provisions still need careful date and conduct analysis: section 13 of the 2023 Act repealed the Malicious Communications Act 1988 section 1 offense for England and Wales and Northern Ireland, and section 189 amended Communications Act 2003 section 127. Do not select a charge from an online checklist. Police and prosecutors apply the law in force when and where the conduct occurred.

Report emergencies to 999. Nonemergency routes include police on 101 or an online local-police report, the relevant platform, and an employer, school, or housing provider where the conduct falls within their responsibility. Keep each reference number. Refuge can help with domestic-abuse safety planning, and stalking services may provide specialist support.

Blocking while preserving

Blocking can reduce new contact but it is not an evidence-storage method. Export and back up what you need first, if doing so is safe. Apple’s current support page explains that blocked callers can still leave voicemail without a notification and that messages are not delivered; it does not state that blocking erases the existing conversation. Sync, retention settings and manual deletion can still affect history.

For WhatsApp, use current in-app help and prompts because features can change. Preserve the chat and attachments before blocking or reporting. Reporting may offer to send recent messages to WhatsApp; understand the prompt before confirming if privacy or safety matters. Blocking one account may not stop contact through another.

Do not respond in anger. A hostile reply can escalate risk and obscure the record. If police, HR, counsel or a safety advocate recommends one clear no-contact message, keep it brief and preserve it. Otherwise silence and blocking may be safer.

Secure the device and accounts

Change the device passcode where safe, then review Apple or Google account sessions, email access, password-manager access, recovery contacts, shared cloud storage, location sharing, linked desktops, family plans and biometric enrollment. Use unique passwords and multifactor authentication that the other person cannot access. Be cautious: abruptly changing shared access can alert someone and increase danger. A specialist advocate can help sequence changes.

Do not store the only copy on a work phone, shared family account or device the other person can unlock. Document suspicious login alerts before dismissing them. If account compromise is disputed or technically complex, preserve the device and seek qualified help rather than installing untrusted “spyware detector” tools.

When an abusive person may monitor the phone

Device changes can be visible and can escalate danger. Use a safer device to seek help if possible. A safety advocate can help decide whether and when to change passwords, stop location sharing, remove unknown devices, replace a SIM, or preserve a monitored phone for investigation.

Check linked WhatsApp devices, Apple Account devices, shared albums and calendars, family-location services, email forwarding, account recovery contacts, and carrier-account access. Do not assume a factory reset is the best first step. It can destroy records, trigger alerts, and leave another compromised account unchanged. Write down suspicious settings and obtain specialist help before changing them when risk is high.

Reporting and presenting

Bring a concise chronology and focused examples, while keeping the complete source available. Ask the recipient whether they want printouts, a PDF, native files or a portal upload. Provide report numbers and follow-up dates. Keep a copy of what you submitted and how.

A message export supports your account of what you received and preserved. It does not prove pre-import genuineness, authorship or the legal definition of harassment. Courts, police and employers make their own decisions. For evidence fundamentals, see preserving messages and authenticating texts.