Everything: the full message with its headers, any attachments, the identity claimed, the banking details supplied and the dates. Keep it whether or not you proceed.
Preserve the approach exactly as received
An unsolicited approach is a record worth keeping intact. Save the original message rather than a screenshot where possible, including full sender information, and keep any documents attached to it without editing them. Note what was said in calls, when, and by whom. If money was requested, record the account details given and the reason offered for urgency. This material matters for two reasons: it lets an adviser assess quickly whether the approach corresponds to anything in the official framework, and if a payment has already been made it is the evidence any bank or authority will ask for. Do not send identity documents, financial statements or a passport copy to an unverified recipient while that assessment is pending.
Hypothetical example: a software architect is sent a polished payment packet by an intermediary but cannot find the same instruction on a government site. Preserve the official page, the date accessed, the applicant's identity records, proof of funds and the government-issued payment confirmation if payment is authorized. The first review should compare every payee and reference number against the official source, then list any unanswered eligibility or processing question. Do not treat a consultant's letter as a substitute for a programme record. Because the payment must be by the applicant to the U.S. government, an intermediary account or a company payer requires direct official clarification before action.