One of the most common problem I encounter investigating a cybercrime is that the reporting person and/or victim fail to provide any records and/or documentation to support their claim that they had been victimized — more so in cases involving online fraud.
One of the simplest and quickest methods of documentation is printing out the webpage offer, sale or service. The URL (or webpage address) and the date and time the printout was made will usually be found at the bottom of the page.
Solicitations and purchases done via email should follow the same practice. Print out the emails offering the sale of items and/or services. Likewise, print emails reflecting the receipt of funds and delivery notices, etc.
In addition, all emails involving the transaction should not be deleted, but saved in a separate folder.
And finally, obtaining any bank or credit card statements reflecting the transactions would greatly assist in the investigation.
Again, prevention is the key. “If it’s too good to be true…”