After a social media scam, an Ontario investigation is a record of what you already hold. It is not a way to get the money back, and it is not a tour of every trick a stranger might try. If money is still moving, or someone is threatening you now, call your bank and the police. Investigation Hotline is a licensed Ontario firm at 1920 Yonge Street in Toronto. This page is about the file that can be written from messages, a profile, and payment records you still have. It is not legal advice.
The patterns, and what to do while a pitch is still unfolding, are online fraud and money scams. What a social media file is, when the question is bigger than one loss, is a social media investigation. The hire for that work is social media investigation support. This article stays on the report after the loss.
The loss is not the file
A usable file names a record and a date. Which messages still exist. What the profile showed when you saved it. Which transfer, card charge, gift-card receipt, or other payment you can point to. Who will read the report: you, counsel, or an insurer. Those are documentation questions.
“Get the money back” is not a question this report answers. Neither is “tell me their real name” when all you hold is a display name and a chat. A licensed report does not become a refund, a charge, or a police investigation. The bank, the platform, and the police have those jobs. The investigator’s page stops at what the records show.
Most people never need an investigator for this. A small transfer, a platform report, and a conversation with the bank may be the whole matter. The private file belongs when a decision still depends on a clear record of what was said and what was paid, and when those pieces are scattered across chats, screenshots, and receipts.
What the report can show
The report is what could be read, tied to a time. The messages you saved, in the order they happened. A public profile as it appeared on the date you captured it. A payment confirmation you hold, with the amount, the date, and the name or handle on that receipt. A note of what is missing: a chat you no longer have, a receipt you cannot find, a profile that has since changed.
Each item should be ordinary. What the message said. Who it appeared to come from, as the screen showed it. The date. Whether the investigator saw the original screen or a copy you provided. Counsel and an insurer can read that. They do not need a story about how clever the pitch was, and they do not need a claim that the chat proves a legal identity.
Name the reader before the file is written. You, counsel, and an insurer may each need the same records with a different cover note. Agreeing that at intake keeps the report from being rewritten once the pages exist. An empty gap is still a result. If a chat is gone, the note says it is gone. Leaving that out makes a missing record look like a finding that nothing was said.
What the report cannot show
A folder of chats does not identify the person behind a profile. A display name, a photo, and a city on a screen are what the screen showed. They are not a birth record, a bank account in someone else’s name, or proof of where that person lives. The report does not turn those into an identity.
It also does not recover the money. A dated list of transfers can help you, your bank, or counsel see what left and when. It does not reverse a payment, freeze an account, or promise that a platform will act. If the only goal is a refund, the conversation belongs with the bank and the police, not with a longer report.
This firm will not open the other person’s account or use a sign-in that belongs to them. It will not create a profile to message them, and it will not keep contacting them to see what they say next. It will not follow them, and it will not describe that work. A belief that the loss makes those steps reasonable does not change the rule. If the only request is “open the account and find out who they are,” there is no file.
The bank, the platform, and the report
Three other readers can be involved, and they do not do the same job. The bank looks at whether a payment can still be stopped. The platform looks at the account on its own system. The police look at whether a crime report belongs with them. A public report you choose to make is a different paper from this file. The investigator’s report is the set of pages you can still show, in an order a person who was not in the chat can follow.
Those jobs should stay separate. A stack of screenshots with no dates, sent to all three at once, makes each of them start from the beginning. A private report that only repeats the bank’s list of transfers, and never sets out the messages, leaves out the chat. A retelling of the chat that never names the payment leaves out the money. When both exist, they are labeled separately. One does not stand in for the other.
Keep a copy of what you hand over. If the only screenshots go to one office and you keep none, the private file has nothing left to read. The report can describe what you provided. It cannot recreate a chat you deleted and did not copy. Saying that at the start saves a search for a record that is already gone.
When counsel has already assigned the question, the pages are an exhibit, not a theory. Investigation support for counsel keeps the work inside the sentence the lawyer wrote. The investigator does not choose the legal argument, and does not promise that a judge, a bank, or a platform will accept the file. A dated record of what was saved is the deliverable.
A romance loss and a money pitch are different files
Some losses start as a relationship and become a payment. The question “is this relationship a lie” is a different page, whether you are being catfished. This article starts later, when messages or money already moved and someone needs that record kept in order. The report does not decide whether the feelings were real. It shows what was written and what was paid.
When the chat was a pitch for an investment, a coin, or a return, the money question has its own page. What an investigator can do after an investment scam is that file. This page still matters for the messages that led to the transfer, and only for those messages. One report should not pretend to be both the investment file and the chat file. Say which sentence you need answered.
What has to be true before a file opens
Bring the question in one sentence. You need the chats and the payments put in order, or you need a note of what you no longer have. Bring what you saved. Do not delete the messages because they are upsetting. Say whether the bank, the platform, or the police already have a report. Say who will read the result, and what would count as enough: one ordered record, or a written note that the chats are gone.
The way a file is scoped is the same here as on any other matter. The question, the limit, and the stop rule come before anyone reads the thread in detail. What the work costs follows that scope, including the chance that the record is too thin to support a longer file. Paying for a short note that says “these are the messages you have, and these are the gaps” is still a completed question. Paying for a search of someone’s private account is not.
Stop rules are part of the help. A threat happening now, call the police. A transfer that might still be reversed, call the bank before this conversation expands. No records left at all, the file may be a conversation rather than a report. A request to break into an account, the answer is no. A further day of reading is a new decision, not an automatic expansion because the first answer was painful.
When it is still a conversation
Stay with a conversation when there is no message and no payment to point to. A worry that “someone online might be a scammer” is the fraud page, not this file. A wish to learn every warning sign is not a report. Neither is a request to identify a stranger from a photo and a first name.
Open a file when the sentence is specific. You still have the messages, the profile capture, or the payment records, or you can say exactly what was lost. You know who the report is for. You are not asking anyone to recover the money, to open an account, or to keep talking to the other person. You can accept a report that stops at what those pages show.
That is the use of a private investigator after a social media scam in Ontario. The report shows what was written, shown, and paid, on the dates you can document. It does not undo the loss, and it does not operate the other person’s account. The investigator confirms the scope and the cost first.
To learn more, contact Investigation Hotline at
