Step 01
Evidence Preservation
First, we captured a dated, organised record of the impersonation: archived page URLs, screenshots of the fraudulent booking conversations, and payment solicitation records — material that would remain usable even as the impersonators changed their page name.