AI voice cloning scam: evidence to preserve in 48 hours

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 2 Nov 2026 · Digital evidence

By the time a cloned-voice fraud victim understands what has happened, the strongest evidence of the deception is already sitting on a phone that is about to run out of battery. The call log, the recording, the bank debit alert and the chat messages that followed are time-sensitive in a way that most evidence is not: they are volatile, they are easily overwritten, and the platforms that host them do not keep them for long. What you do in the next two days frequently decides whether the case can be proved at all.

This is a preservation guide, not a legal argument. It tells you exactly which items matter, when each one disappears, and how to keep it in a form a bank, a police cyber cell and a court will accept. It assumes the fraud has already happened and the money is gone; the question now is what survives to support a complaint and a claim.

Why the first 48 hours decide an evidence case

Three clocks start running the moment the money leaves your account. The first is the recording itself, which an automatic call recorder may overwrite within days as new calls accumulate. The second is the fraudster's account, which will be drained and possibly closed once the money is layered away. The third is the message thread, which can be deleted by the other side or lost when a chat is archived or a number is blocked.

None of these clocks waits for you to feel ready. The practical rule is that anything you have not copied within two days may not exist a month later, and anything you have copied badly may be worth less than nothing because a doctored file invites the accusation that the whole story is manufactured.

There is also a fourth clock specific to the internet: the fraud reporting systems of the platforms themselves. A number that many users have reported may be taken down quickly, and once a messaging or telecom operator removes an account, the records tied to it become harder to reach rather than easier. Preservation and reporting therefore pull in the same direction, not against each other.

The evidence to preserve, item by item

• The original call recording. Not a re-recorded version played through a speaker, but the file the recorder created, with its name and timestamp untouched. This is the anchor of the whole case, because it is the fraud itself.
• The caller's number and the exact time. A screenshot of the call log showing the number, the date, the time and the duration, taken before the log rolls over or the entry is deleted.
• The bank alert and the transaction statement. The debit SMS or app notification, and the account statement showing the amount, the mode, the reference number and any beneficiary name.
• The payment demand. If a UPI request, a message or a link accompanied the call, capture it. It connects the voice to the transfer.
• The chat thread that followed. Any later messages, including from the same number, showing the pressure or the follow-up.
• Your written notice to the bank. The email you sent, the acknowledgement, and the date. This is evidence of your diligence, not of the fraud.
• The complaint acknowledgements. The 1930 reference and the cybercrime.gov.in acknowledgement, retained as they are.
• A short statement from the imitated person. If a real person's voice was cloned, his confirmation that he did not call is powerful corroboration and is easy to get early.

An hour-by-hour checklist for the next two days

1. Within the first hour: photograph or screenshot the call log entry and the bank alert, and place the phone on charge so nothing is lost to a shutdown.
2. Within the first hour: if the call was recorded, copy the file to a second device or to secure cloud storage without opening or editing it.
3. Within the first two hours: call 1930 and file on cybercrime.gov.in, and save both acknowledgements to the same folder.
4. The same day: email the bank a written unauthorised-transaction notice and keep the delivery and acknowledgement trail.
5. The next morning: download the full bank statement covering the transaction and store it with the alert.
6. Within 48 hours: write the chronology — one page, dated, listing the call, the words used, the demand, the transfer and every report made.
7. Within 48 hours: obtain the short statement from the person whose voice was imitated, if there was one.
8. Ongoing: make no edits, deletions or "clean-ups" of any original, no matter how messy the material looks.

Where each item lives, and how fast it disappears

Knowing where evidence sits tells you what is genuinely at risk. The call recording lives on the phone's internal storage and, if a recording app is used, inside that app's own folder; auto-deletion settings and storage pressure are what erase it. The call log survives until the phone's buffer rolls over, which on a busy phone can be a matter of days. The bank alert lives in the messaging app and, more durably, in the bank's notification history, which your statement reflects even after the SMS is gone. The chat thread lives both on the servers and on your device, so deleting it locally does not always delete it remotely — but the reverse is also true: it can vanish from your device while the platform still holds it, and only the police can retrieve it from the platform.

That last point matters more than it appears to. Some of the strongest records in a cloned-voice case — the telecom operator's log of the originating call, the number's registration details, the linkage between the account and the device — are records you cannot create yourself and will never see. They become available only through a lawful request, which means the FIR does double duty: it is the complaint, and it is the key that unlocks the evidence other people hold.

Records you cannot create, and who must fetch them

A victim can preserve his own material but cannot obtain the records held by the telecom operator, the bank or the app platform. Those come through the investigation, which is why the timing of the FIR is not a formality. The sooner the complaint is registered, the sooner the investigating officer can seek the call detail records, the beneficiary account details and the platform's account information before the relevant retention periods expire.

Where the matter is headed to court, a lawyer will normally take charge of the formal requests and of the certificate that accompanies electronic records under the Bharatiya Sakshya Adhiniyam, 2023. A victim's own duty is limited and clear: keep the originals safe, keep a copy off the device, and hand the collection over intact.

How to preserve electronic records so they stand up

The law treats electronic records as provable under section 63 of the Bharatiya Sakshya Adhiniyam, 2023, subject to the conditions that provision lays down, including the accompanying certificate where an electronic record is produced in proceedings. For a victim, that translates into three practical habits.

First, preserve originals rather than reconstructions. A screen recording of you scrolling through the chat is useful supporting material, but it is not a substitute for the underlying data. Second, keep a copy that is independent of the device — cloud storage, an external drive, or an email to yourself — because devices are lost, repaired and wiped. Third, record the chain of custody in plain words: when you copied each item, where you put it, and that you made no alteration. Banks and courts are far more comfortable with a documented copy than with an unexplained file.

What each piece of evidence actually proves

What decides whether your evidence is accepted

• Whether it is original. Files that have never been edited carry weight no reconstructed version can match.
• Whether the times line up. A recording, an alert and a statement that agree on chronology tell one story; a gap invites doubt.
• Whether the chain is documented. When you copied each item and where it has since lived matter more than people expect.
• Whether the copy is independent of the phone. Evidence that exists only on one device is one repair away from vanishing.
• Whether your conduct was prompt. A prompt complaint makes the whole packet more credible, and a delayed one makes every part of it easier to attack.
• Whether the account holder at the receiving end cooperates. Their records connect the fraud to the money, and they are obtained through the police and the banks.
• Whether your copy has ever been opened and saved. Some viewers and editors rewrite a file when they are saved; a recording that has been manipulated loses its claim to being the original.
• Whether the records held by others were secured in time. Operator and platform records are reachable only through the investigation, and only while they are still retained.

It is worth saying plainly that the rules around synthetic voice evidence are still maturing, and courts decide admissibility on the facts before them. A victim's job is narrow: hand over an intact, documented, original set and let the professionals argue about weight.

Mistakes that destroy evidence

• Re-recording the call by playing it aloud so it can be "saved somewhere safe". That creates a copy worth far less than the file it replaced.
• Deleting the call log or the fraudster's messages to "clean up" the phone.
• Blocking the number, which can remove the thread and foreclose later contact evidence.
• Sending recordings through messaging apps that compress and strip metadata.
• Writing on the bank's complaint in a way that contradicts the recording, or leaving out the amount or the time.
• Waiting a week to preserve anything, by which time a recorder has overwritten the call.

When a lawyer should see the evidence

The right moment is early — before the material is handed to anyone, including informally to the bank or a "recovery" helper. A quick review tells you whether the recording will hold, what is missing, and whether a certificate or further preservation step is needed. Victims in West Bengal usually begin with a cyber crime lawyer in Kolkata, and where the matter is heading to a magistrate it helps to understand the criminal defence position before the first filing. If you would like your collection checked against the standard a court will apply, contact the office and bring what you have; the initial assessment costs nothing.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• Work from home scam evidence to preserve in first 48 hours
• Trading app scam: the evidence to preserve in 48 hours
• Electricity Bill Scam: Evidence to Preserve in 48 Hours
• Telegram investment scam evidence to preserve: 48-hour guide
• Mutual fund scam evidence to preserve in the first 48 hours
• Job Scam: The Evidence to Preserve in the First 48 Hours

Cyber crime lawyer in your city · Bank account freeze help · Contact