Text Message Evidence in Harassment and Stalking Matters: Proving the Pattern

Harassment and stalking matters are rarely about one message. Civil harassment, anti-stalking, and protective order laws in most states turn on conduct over time, so the evidence has to show a pattern: how often the messages came, whether they escalated, whether they continued after a clear request to stop, and that one person was behind every number and account. A handful of screenshots shows that something unpleasant was said. A complete, verifiable record shows what actually happened.

This guide is for counsel and advocates on either side: petitioner's counsel building the record, and respondent's counsel testing it. Real harassment and abuse happen and can escalate, so client safety comes before evidence. If a client is in immediate danger, call 911. Where the harassment involves a current or former partner, the National Domestic Violence Hotline (1-800-799-7233, or text START to 88788) can help with safety planning.

What do courts look for in harassment text evidence?

Typically, proof that the messages came from the respondent, that they form a pattern, what they said in context, and their effect, measured against the elements of the specific order or claim. Statutes differ on course of conduct, intent, and the required level of fear or distress, so map the evidence to your jurisdiction's elements.

• Attribution. Who sent each message, across every number, app, and account.
• Pattern. Frequency, duration, time of day, and escalation in tone or content.
• Content and context. What was said, read alongside what came before and after.
• Notice to stop. Any clear request to stop contact, and any existing no-contact order, with the messages that followed.
• Effect. Changes the client made because of the contact, such as new routes, a changed number, or missed work.

How do you preserve harassing messages without the client engaging?

Capture everything in its original form, keep the client out of the conversation, and log what happens off the phone. Preservation should never require the client to keep communicating with the person harassing them.

1. Do not delete, and do not reply. Replies can muddy the pattern and may put the client at risk. Any communication, including a single request to stop, should follow counsel's advice.
2. Export the full threads. Use a backup-based export for iPhones and an SMS backup for Android, the platform's data download for social media direct messages, the app's chat export for WhatsApp, and Google Takeout for Google Voice.
3. Screenshot anything ephemeral. Disappearing messages, stories, and messages the sender might unsend. Recent iPhone versions let senders edit or unsend iMessages for a short window after sending, so capture quickly and note what the client saw.
4. Capture identifiers. Screenshot the contact or profile screen showing the full number, username, or URL for every account involved.
5. Save voicemails as audio files. If the client is considering recording calls, check local law first: consent rules vary by state, and some require every party's consent.
6. Keep an incident log. Drive-bys, gifts, contact through friends, and messages that reached third parties belong in a dated log with any supporting proof.

How do you prove who sent messages from unknown or changing numbers?

Build attribution from several directions at once: the content of the messages, the context around them, third-party records, and the respondent's own statements. Rarely does one piece settle it; together they usually tell a coherent story.

• Distinctive characteristics. Under Federal Rule of Evidence 901(b)(4) and state equivalents, references to private facts, nicknames, writing style, and timing tied to known events can identify the sender. A message that arrives minutes after a court appearance and references it is circumstantial evidence of who sent it.
• Number history. Earlier use of the same number by the respondent, announcements of a number change, or the number appearing on applications, invoices, or social profiles.
• Carrier and app records. Subscriber information and call or message detail records can sometimes be obtained by subpoena. The federal Stored Communications Act generally bars providers from disclosing message content in response to a civil subpoena, so content usually has to come from devices. See subpoenaing phone records for what carriers typically retain.
• App-based and spoofed numbers. Internet calling and texting apps can generate numbers not tied to a carrier account, and spoofing tools exist. Provider records, login data, and content links become more important.
• Admissions. The respondent's own statements, in any channel, are opposing-party statements under Rule 801(d)(2).

For the foundation testimony itself, see authenticating text messages under Rule 901.

How do you show the pattern of harassment?

Present three layers: a complete chronological log across every channel, a summary of frequency and escalation, and a short set of key messages shown in context. The log proves completeness, the summary shows the pattern at a glance, and the key messages show what was actually said.

A chart like this can be offered as a summary of voluminous records under Federal Rule of Evidence 1006, with the underlying log made available, or used as an illustrative aid where the court's rules allow. Keep the counting method simple and stated, because the other side will check it.

What about messages sent to friends, family, or an employer?

Treat them as part of the same pattern, but collect them from the people who received them. Contact routed through third parties, such as messages to a sibling, comments on a friend's post, or calls to a workplace, is common in stalking matters and often matters to the course-of-conduct analysis.

• Identify recipients early. Ask the client who else has been contacted, how, and when.
• Collect from their devices with consent. The client's screenshot of a friend's screenshot is weak foundation. The recipient's own export, or the recipient's phone, is much stronger.
• Line up the witness. The recipient is usually the person who can authenticate the message, so confirm they are willing and available to testify.
• Merge into the master log. Mark third-party messages clearly so the court can see which contacts went to the client and which went around them.

What will respondent's counsel scrutinize?

Completeness, attribution, authenticity, and context. Petitioner's counsel should anticipate each, and respondent's counsel should test each, because both sides are better served by a record that is complete and verifiable.

• Excerpts that omit the respondent's side of an exchange or provocations before it; Rule 106 allows the adverse party to require other parts that in fairness ought to be considered
• Mutual contact that complicates the picture of unwanted messages
• Gaps in attribution for new numbers or anonymous accounts
• Screenshots without native exports, which are easier to alter or fabricate
• Time zone or timestamp errors that break the claimed sequence
• Required communications, such as co-parenting logistics under an existing order, mixed in with genuinely unwanted contact

Respondents may also face parallel criminal exposure, which raises Fifth Amendment considerations and calls for coordination with criminal defense counsel. On either side, counsel should never coach a client to exaggerate or fabricate, and should raise concerns about altered evidence promptly. For more on hearsay issues in message evidence, see hearsay and text messages.

What goes in the hearing file?

A compact set that lets the court see the pattern quickly and lets either side verify any entry.

• The complete Bates-numbered message log, with participants and date range stated
• The frequency and escalation summary, cross-referenced to log pages
• Key messages with surrounding context
• The attribution packet: subscriber records, number history, admissions
• The incident log and any third-party witness statements
• Voicemail audio with transcripts
• Copies of any prior request to stop and any existing orders
• The original device available, in case authenticity is challenged

Elements, remedies, and procedures differ by state and by type of order, so clients and advocates should confirm them with a licensed attorney where they live.