The complete original message including sender information, every attachment unedited, the account details supplied, the identity claimed, and a dated note of anything said by telephone.
Preserve the approach exactly as it arrived
Whether the approach is legitimate or not, the record is worth keeping intact. Save the original message rather than a screenshot where that is possible, since full sender information can matter. Keep attachments in their original form without opening and resaving them. Write down the dates and content of any calls, the name and organisation claimed, and any reason given for urgency. If a payment has already been made, this material is what a bank or an authority will ask for. In the meantime, do not send passports, financial statements or identity documents to an unverified recipient while the approach is being assessed.
Retain dated official pages, payment instructions from an official source, identity records, and all communications, but do not treat promotional attachments as controlling proof. Compare the account name, legal authority, and stated conditions before sending funds. A receipt from an agent does not establish payment to the U.S. government. Hypothetical example: an elevator-systems designer is sent a branded invoice with a private bank account; the payee information is the record that decides whether the instruction matches an official program.
Preserve the web address and access date for each official page, while treating screenshots or forwarded files as leads that require independent confirmation.