# The Evidence-Preservation Mistake That Invalidates Fraud Cases Under SAMA CFF: Why Screenshots and Email Forwards Fail Chain-of-Custody Standards
A fraud investigation manager at a Saudi bank discovers evidence of internal theft: an employee has been diverting customer payments for eighteen months. The IT department forwards the suspect's emails, takes screenshots of transaction logs and exports a spreadsheet of account activity. Three months later, when the institution moves to terminate the employee and file a report with SAMA, legal counsel delivers unwelcome news: the evidence cannot be used. The screenshots have no provenance, the forwarded emails have altered metadata and the exported spreadsheet has no verifiable link to the source system. The case collapses.
This scenario repeats across Saudi financial institutions because evidence collection is often treated as an IT task rather than a forensic discipline. The Saudi Arabian Monetary Authority's Combating Fraud and Forgery Framework (SAMA CFF) requires regulated institutions to maintain effective fraud detection and investigation capabilities, and while the framework does not prescribe specific technical methods, it implicitly demands that evidence be collected, preserved and handled in a manner that supports disciplinary action, regulatory reporting and, when necessary, legal proceedings. SAMA CFF fraud evidence preservation chain of custody requirements mean that every piece of evidence must have a documented, unbroken record of who collected it, when, how and who has handled it since—and common IT practices fail every one of these tests.
This article explains why screenshots, email forwards and casual exports break chain-of-custody standards, describes the four forensic-collection steps that SAMA CFF investigations require, and shows how proper evidence handling protects both the investigation's integrity and the institution's ability to act on findings.
Why Screenshots and Email Forwards Are Not Forensic Evidence
When an internal fraud allegation arises, the instinct is to gather proof quickly. An IT administrator logs into the suspect's email account, takes screenshots of incriminating messages, forwards key emails to the investigation manager and exports transaction data to Excel. The evidence looks compelling, but it has four fatal flaws.
First, screenshots have no metadata. A screenshot is a picture of a screen at a moment in time. It does not prove when the underlying email was sent, whether it has been altered or even that it ever existed in the email system. Any competent legal or HR advisor will reject screenshots as primary evidence because they can be fabricated in minutes.
Second, forwarded emails have altered headers. When an email is forwarded, the message gains a new set of metadata: the forwarder's name, the forwarding timestamp and a new message ID. The original headers—critical for proving authenticity—are embedded in the body as plain text, which can be edited. Courts and disciplinary panels routinely exclude forwarded emails because their integrity cannot be verified.
Third, exported data has no audit trail. An Excel file exported from a core banking system or payment platform contains rows and columns, but no record of when the export was performed, by whom, from which system or whether any rows were added, deleted or modified afterward. Without a cryptographic hash or a documented extraction process, the file is merely a claim, not evidence.
Fourth, casual collection breaks chain of custody. Chain of custody is the documented, unbroken record of who collected evidence, when, how and who has handled it since. If an IT administrator logs into a suspect's account without documenting the access, copies files to a USB drive without recording the action and hands the drive to an investigation manager without a signed transfer log, the chain is broken. Any subsequent finding is vulnerable to challenge on the grounds that evidence could have been tampered with at any point.
These are not theoretical risks. Institutions across the Kingdom have seen fraud cases collapse, disciplinary actions overturned and regulatory findings questioned because evidence was collected informally. SAMA CFF requires that institutions be able to substantiate their fraud findings, and substantiation depends entirely on evidence that can withstand scrutiny.
The Four Forensic-Collection Steps SAMA CFF Investigations Require
Proper evidence collection is not complicated, but it is disciplined. Four steps—write-blocking, hashing, timestamping and documented custody transfer—transform informal data gathering into forensic-grade evidence handling.
1. Write-Blocking
Write-blocking ensures that the act of collecting evidence does not alter the evidence itself. When an investigator accesses a suspect's laptop, mobile device or email account, the operating system or application may automatically update timestamps, create temporary files or modify logs. A write-blocker is a hardware device or software setting that allows read-only access, preventing any change to the original data.
For digital devices, this means attaching a hardware write-blocker between the device and the forensic workstation before creating an image of the hard drive or storage. For email accounts and cloud applications, it means using administrative access that logs every action and does not trigger read receipts, folder updates or other metadata changes. The principle is simple: the original evidence must remain in exactly the state it was found.
2. Hashing
Hashing creates a unique digital fingerprint of the evidence at the moment of collection. A cryptographic hash function (such as SHA-256) processes a file, email or disk image and produces a fixed-length string of characters. If even a single bit of the original data changes, the hash changes completely. By recording the hash at the time of collection and verifying it before analysis, investigators can prove that the evidence has not been altered.
In practice, this means hashing every email file, every transaction log and every disk image immediately after collection, recording the hash value in the investigation file and re-hashing the evidence before each use. If the hashes match, the evidence is intact. If they do not, the evidence has been compromised and cannot be relied upon.
3. Timestamping
Timestamping records the exact date and time of collection, using a trusted time source. Many fraud cases hinge on sequence: did the suspect access the account before or after a control was implemented? Did the transaction occur before or after the customer reported the fraud? Without a verifiable timestamp, these questions cannot be answered.
Timestamping also protects the institution. If a suspect claims that evidence was fabricated or planted after the fact, a cryptographically signed timestamp from a trusted authority (such as a national time service or a blockchain-based timestamping service) provides objective proof of when the evidence was collected.
4. Documented Custody Transfer
Documented custody transfer means that every time evidence changes hands, the transfer is recorded in writing, with the date, time, names of the transferring and receiving parties, and a description of what was transferred. This creates an unbroken chain from collection to presentation.
A custody log is a simple table: date and time, evidence description, transferred from, transferred to, purpose of transfer, signatures. Every entry must be completed at the moment of transfer, not reconstructed later. If evidence is stored, the log records who placed it in storage, where and when. If it is analyzed, the log records who accessed it and for what purpose. If it is copied, the log records the copy and the hash of the copy.
This discipline ensures that if the evidence is challenged—by the suspect, by legal counsel, by a regulator or by a court—the institution can demonstrate an unbroken, documented chain of custody from the moment of collection to the moment of presentation.
How Proper Evidence Handling Protects Investigation Outcomes
The purpose of forensic evidence handling is not bureaucratic compliance; it is to protect the institution's ability to act on investigation findings. Fraud investigations are not academic exercises. They lead to disciplinary action, regulatory reporting, civil recovery and, in serious cases, criminal prosecution. Each of these outcomes depends on evidence that can withstand challenge.
Disciplinary action requires that the employee be given the opportunity to respond to allegations. If the evidence is a screenshot or a forwarded email, the employee's legal advisor will argue that it could have been fabricated or altered, and HR will hesitate to proceed. If the evidence is a forensically collected, hashed and timestamped email file with a documented chain of custody, the argument collapses.
Regulatory reporting under SAMA CFF requires that institutions report material fraud incidents and demonstrate that they have investigated and addressed the root cause. If the regulator questions the evidence, the institution must be able to show how it was collected, by whom and how its integrity was preserved. Informal evidence handling invites regulatory doubt and follow-up scrutiny.
Civil recovery and criminal prosecution both depend on evidence that meets legal standards of admissibility. Courts require proof that evidence has not been tampered with, that it was collected lawfully and that its chain of custody is intact. Forensic evidence handling is not a luxury for criminal cases; it is the baseline for any case that might reach a courtroom.
Beyond these formal outcomes, proper evidence handling protects the investigation itself. When evidence is collected forensically, investigators can be confident in their findings. They can trace transactions, reconstruct timelines and identify co-conspirators without worrying that a procedural misstep will invalidate months of work. The discipline of forensic collection is the foundation of investigative confidence.
Common Gaps in Current Practice
Most Saudi financial institutions have fraud investigation procedures, but many do not address evidence preservation in forensic terms. Common gaps include:
- No write-blocking protocol. IT staff access suspect accounts and devices directly, without read-only safeguards, altering metadata in the process.
- No hashing requirement. Evidence files are copied and shared without recording cryptographic hashes, leaving no way to verify integrity later.
- No trusted timestamping. Collection times are recorded in investigation notes, but not cryptographically signed or linked to a trusted time source.
- No custody log. Evidence is emailed, stored on shared drives or handed between team members without a written record of transfers.
- No forensic training. Investigation managers and IT staff are not trained in forensic evidence handling, and do not realize that common practices break chain-of-custody requirements.
These gaps are not the result of negligence; they reflect the fact that fraud investigation is often treated as an extension of IT support or internal audit, rather than a specialized forensic discipline. Closing the gaps requires a shift in approach: evidence must be treated as fragile, valuable and subject to challenge from the moment it is identified.
How to Build Forensic Evidence-Handling Capability
Building forensic evidence-handling capability does not require a dedicated forensic lab or a team of certified examiners. It requires a clear protocol, basic tools and training for the people who will collect and handle evidence.
Develop a forensic evidence-collection protocol. The protocol should specify write-blocking methods for common evidence types (email accounts, laptops, mobile devices, transaction logs), hashing algorithms and tools, timestamping procedures and custody-log templates. It should be approved by legal, HR and compliance, and incorporated into the institution's fraud investigation policy.
Equip the investigation team. Basic forensic tools include hardware write-blockers for disk imaging, forensic software for email and file collection, hashing utilities and access to a trusted timestamping service. These tools are not expensive, but they must be procured, tested and maintained.
Train investigation managers and IT staff. Training should cover the principles of chain of custody, the four forensic-collection steps, the use of forensic tools and the completion of custody logs. It should be practical, scenario-based and tailored to the institution's systems and investigation procedures.
Engage external support when needed. For complex cases—multi-party fraud, cross-border schemes, cases involving encrypted communications or sophisticated concealment—external forensic expertise ensures that evidence is collected to the highest standard and that the investigation can withstand any challenge.
When to Engage External Forensic Investigation Support
Not every fraud allegation requires external support, but certain cases benefit from independent, forensically rigorous investigation from the outset.
High-stakes cases. When the suspected fraud involves senior employees, large amounts, regulatory reporting obligations or potential criminal prosecution, the stakes are too high to risk procedural errors. Independent investigation ensures that evidence is collected properly and that findings are credible.
Complex schemes. When fraud involves multiple parties, offshore accounts, shell companies or sophisticated concealment techniques, forensic accounting and transaction analysis are essential. External investigators bring specialized skills in tracing funds, reconstructing ledgers and identifying control failures.
Contested cases. When the suspect is likely to challenge the evidence—because they have legal representation, because the institution's procedures are weak or because the evidence is circumstantial—forensic-grade evidence handling is the only way to protect the investigation's integrity.
Regulatory scrutiny. When SAMA or another regulator is aware of the case or has requested information, the institution must be able to demonstrate that the investigation was independent, thorough and properly documented. External investigation provides that assurance.
The firm's Fraud Investigation and Forensic Accounting service provides independent, evidence-led investigations of suspected internal or external fraud, with evidence handling suitable for disciplinary, regulatory and legal action. The process follows four phases: Contain (scope, preserve evidence and protect the investigation), Analyze (transactions, records and digital evidence), Establish (interviews and fact-finding) and Report (findings, root cause and recommendations). Deliverables include an investigation report, an evidence file and recommendations to prevent recurrence. Features include case scoping and evidence preservation, transaction and ledger analysis, interviews and fact-finding, and root-cause and control-failure analysis. The service is delivered as needed, billed by the hour, and the firm can usually start within one to two business days of engagement, faster for urgent cases. The investigation is confidential: access is limited to named people and every piece of evidence has a recorded chain of custody.
Closing: Protect Your Ability to Act on Fraud Findings
Fraud investigations are only as strong as the evidence they rest on. Screenshots, email forwards and casual exports may look convincing in an internal presentation, but they will not survive challenge by a suspect's legal advisor, a regulator's scrutiny or a court's admissibility standards. SAMA CFF requires that institutions maintain effective fraud investigation capabilities, and effectiveness depends entirely on evidence that can substantiate findings and support action.
The four forensic-collection steps—write-blocking, hashing, timestamping and documented custody transfer—are not burdensome. They are the baseline discipline that transforms informal data gathering into evidence that protects the institution's ability to act. Every fraud investigation manager, internal audit head and compliance officer at a Saudi financial institution should ask: if our next fraud case goes to court, will our evidence hold up?
If the answer is uncertain, the time to address evidence-handling procedures is now—before the next case, not after it collapses.
