Home › Legal Articles › Digital evidence

Courier Parcel Scam Evidence: What to Preserve First

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 2 Nov 2026 · Digital evidence

If you have been targeted by a courier parcel scam, preserve call recordings, messages, transaction screenshots, and bank statements before anything is deleted. Section 63 of the Bharatiya Sakshya Adhiniyam 2023 governs the admissibility of electronic records. This guide lists the exact evidence to save in the first 48 hours and how to certify it for court.

If you have been targeted by a courier parcel scam, the evidence you preserve in the first 48 hours often decides whether you recover your money. The most important items are call recordings, call logs, WhatsApp and SMS messages, UPI transaction screenshots, bank statements, and the fraudster phone numbers. Section 63 of the Bharatiya Sakshya Adhiniyam, 2023, governs the admissibility of electronic records in court. Without proper preservation and certification, even strong evidence can be rejected.

The first 48 hours are critical because digital evidence is fragile. Call logs can be overwritten, messages can be deleted, and bank records can be harder to obtain later. The fraudster may also delete the account or change the number. Under Section 66D of the IT Act, 2000 and Section 318 of the BNS, 2023, the prosecution must prove that the fraudster deceived you. Your evidence is the foundation of that proof. This guide explains what to preserve, how to preserve it, and how to certify it under Section 63 of the BSA.

Why the first 48 hours matter

The first 48 hours are the window when the fraudster account is most likely to be frozen and when the digital trail is still fresh. The 1930 helpline golden hour freeze works best within 24 hours. The bank chargeback process under the RBI circular also depends on prompt reporting. If you wait, the money may be withdrawn and the evidence may disappear. The police investigation under Section 187 of the BNSS also depends on the evidence you provide early. The sooner you report and preserve, the stronger your case.

Digital evidence degrades in several ways. Call logs on mobile phones are often retained for a limited period. WhatsApp messages can be deleted by the sender or the recipient. SMS messages may be cleared automatically. UPI transaction records are available in the app and the bank statement, but the app data can be lost if the phone is reset. Bank statements can be obtained later, but the transaction narration may not identify the fraudster. Preserving the evidence early ensures that the court has a complete picture. The first 48 hours also give the police the best chance to trace the IP address and the bank account used by the fraudster.

What the law says about electronic evidence

Section 63 of the BSA, 2023, is the key provision for electronic evidence. It provides that electronic records shall be admissible as evidence if they are produced in the manner prescribed. The section requires a certificate from the person in charge of the computer or communication device, identifying the electronic record and describing the manner in which it was produced. The certificate must also state that the electronic record was produced by a computer or communication device during the ordinary course of activities. The certificate is a safeguard against tampering and is mandatory in most cases.

The IT Act, 2000, provides the substantive offences. Section 66 covers computer-related offences. Section 66C covers identity theft. Section 66D covers cheating by personation using a computer resource. Section 67 covers obscene material. Section 67B covers child sexual abuse material. In a courier parcel scam, Section 66D is the most relevant provision because the fraudster impersonates a courier company or a police officer. The BNS, 2023, provides the corresponding cheating and forgery offences under Sections 318, 316, 336, and 351. The BNS offence of cheating under Section 318 is the main charge in most courier scam cases.

The BNSS, 2023, provides the procedural framework. Section 173 requires the police to record the information. Section 175(3) allows the Magistrate to order an investigation. Section 35 deals with arrest. Section 187 deals with investigation. Section 480 deals with the disposal of property. Section 482 deals with the quashing of proceedings. Section 528 deals with the inherent powers of the High Court. The BSA and the BNSS together determine how electronic evidence is collected, preserved, and presented in court. The police can also seek the help of a cyber forensic laboratory to extract data from the fraudster devices.

The RBI circular on unauthorised electronic transactions also relies on evidence. To claim zero liability, you must report the transaction within three working days. The bank will ask for the transaction details and proof of the fraud. The evidence you preserve supports both the criminal case and the bank chargeback. The RBI directions do not prescribe a specific form of evidence, but the bank will assess the complaint based on the documents you provide. A clear timeline of the fraud, supported by screenshots and bank records, makes the bank chargeback easier to process.

The evidence checklist

Call recordings. If you recorded the fraudster call, preserve the original file. Do not edit or convert it. Note the date, time, and phone number. A recording is strong evidence because it captures the fraudster voice and the false claims.
Call logs. Take screenshots of the incoming call history. Include the fraudster number and the duration of the call. The call log helps establish the timeline of the fraud.
WhatsApp and SMS messages. Take screenshots of the full conversation. Include the fraudster profile name and number. Do not delete the chat. The messages often contain the payment demand and the fake courier details.
UPI transaction screenshots. Capture the transaction ID, amount, date, time, and the recipient UPI ID or account number. The transaction ID is essential for the bank chargeback.
Bank statements. Download the statement for the relevant period. Highlight the fraudulent debit. Keep both the PDF and a printed copy. The statement shows the money leaving your account.
Fake notices or links. Save any fake courier notice, court summons, or payment link the fraudster sent. Do not click the link again. The notice is evidence of the deception.
Email headers. If the fraudster contacted you by email, save the full email with headers. The headers can help trace the sender. A forensic expert can analyse the headers if needed.
Witness details. If someone was present when you received the call, note their name and contact details. A witness can corroborate your account in court.

How to preserve electronic evidence under Section 63 of the BSA

Preservation requires more than taking screenshots. You should keep the original device and the original files. If you used a phone, do not reset it or delete the app data. If you used email, keep the original email in the inbox. Section 63 requires a certificate that identifies the electronic record and describes how it was produced. The certificate should be signed by the person in charge of the device or the service provider. The certificate must be produced along with the electronic record when it is submitted to the court.

You should also make a hash of the electronic record if possible. A hash is a digital fingerprint that proves the record has not been altered. The police or the court may ask for a hash to verify the integrity of the evidence. If you are not technical, a lawyer or a cyber forensic expert can help you prepare the certificate and the hash. The cost of a forensic examination is usually modest compared to the amount at stake in a courier scam. The hash should be generated before you transfer or copy the file, and the hash value should be recorded in the certificate.

Do not rely on screenshots alone. Screenshots can be challenged as edited or incomplete. The original device and the original files are stronger evidence. If the original device is not available, the screenshots can still be admitted, but the court may give them less weight. Section 63 of the BSA allows electronic records to be proved by secondary evidence in certain circumstances, but the best practice is to preserve the primary evidence. If the phone is damaged or lost, a forensic image of the storage can sometimes be recovered, but this is not guaranteed.

You should also keep a written log of the evidence. Note when you received the call, when you paid, when you reported to 1930, and when you filed the police complaint. This log helps the court follow the sequence of events. The log should be signed and dated. If you send emails or letters, keep the sent items and the delivery receipts. A complete paper trail supports both the criminal case and the bank chargeback.

Common evidence mistakes

Deleting the chat or call log. This is the most common mistake. Once deleted, the evidence is hard to recover.
Resetting the phone. A factory reset destroys app data, including UPI and messaging records.
Editing screenshots. Edited screenshots are treated as unreliable. Keep the original files.
Not noting the time and date. The court needs to know when the fraud occurred and when the evidence was collected.
Waiting to report. Delay allows the fraudster to withdraw the money and delete the trail.
Not obtaining a Section 63 certificate. Without the certificate, the electronic record may be challenged.
Storing evidence only on the phone. If the phone is lost or damaged, the evidence is gone. Back up the evidence to a secure location.

What decides whether evidence is accepted

The court will consider several factors when deciding whether to accept electronic evidence. First, the authenticity of the record. The court will check whether the record was produced by the device in the ordinary course of activities. Second, the integrity of the record. The court will check whether the record has been altered. A hash or a forensic report can help. Third, the completeness of the record. A partial screenshot may be less persuasive than a full conversation. Fourth, the chain of custody. The court will check who handled the evidence and how it was stored.

The court will also consider whether the evidence was preserved promptly. If you report the fraud within 48 hours and preserve the evidence immediately, the court is more likely to accept it. If you wait for weeks, the court may question the authenticity. The police investigation under Section 187 of the BNSS also depends on the evidence you provide. The stronger the evidence, the more likely the police will trace the fraudster and recover the money. The court may also consider whether the evidence was obtained lawfully and whether it violates any privacy rights.

When to involve a lawyer

You should consult a cyber crime lawyer in Kolkata if the amount is substantial, if the bank disputes the evidence, or if the police investigation stalls. A lawyer can help you prepare the Section 63 certificate, coordinate with a forensic expert, and present the evidence before the court. For initial guidance, you can contact us to understand your options. Legal representation is not always necessary for small amounts, but it becomes important when the evidence is contested or the case goes to trial.

Need help with a cyber crime matter?

Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.

Call +91-9007000603 WhatsApp

Frequently asked questions

What evidence should I preserve first in a courier parcel scam?

Preserve the call recording and call log first, because they identify the fraudster and the false claims. Then save the WhatsApp or SMS messages, the UPI transaction screenshot with the transaction ID, and the bank statement showing the debit. Keep the original device and do not delete anything. Section 63 of the BSA 2023 requires the electronic record to be preserved and certified.

Why are the first 48 hours important for evidence in a courier scam?

The first 48 hours are when the digital trail is freshest and the fraudster account can still be frozen. Call logs and messages may be overwritten or deleted later. The 1930 helpline can initiate a freeze within the golden hour. Bank records and app data are easier to preserve immediately. Early preservation also supports the police investigation under Section 187 of the BNSS.

How do I certify electronic evidence under Section 63 of the BSA?

Section 63 of the BSA 2023 requires a certificate from the person in charge of the computer or communication device. The certificate must identify the electronic record, describe how it was produced, and state that it was produced in the ordinary course of activities. A lawyer or cyber forensic expert can help prepare the certificate. The certificate must be submitted along with the electronic record.

Can screenshots be used as evidence in a courier parcel scam case?

Yes, screenshots can be used, but they are weaker than the original device and original files. Screenshots can be challenged as edited or incomplete. The court may give them less weight. The best practice is to preserve the original phone and the original chat or call log. If the original is unavailable, screenshots can still be admitted under Section 63 of the BSA with a proper certificate.

What should I do if I already deleted the scam messages?

If you deleted the messages, try to recover them from a backup or from the service provider. WhatsApp and email services sometimes retain data for a limited period. You can also rely on bank statements and call logs. Report to 1930 and cybercrime.gov.in immediately. A forensic expert may be able to recover deleted data from the phone storage, but recovery is not guaranteed.

Do I need a forensic expert to preserve evidence in a courier scam?

Not always. For small amounts, a properly preserved phone and a Section 63 certificate may be enough. For large amounts or contested cases, a forensic expert can create a hash, image the device, and prepare a report. The expert can also analyse email headers and recover deleted data. The cost is usually modest compared to the amount at stake.

How should I store the evidence to keep it admissible?

Store the evidence in its original form on the original device. Make a backup copy on a secure storage device or cloud account. Do not edit, convert, or rename the files. Keep a written log of when and how you collected the evidence. If you transfer the files, record the hash before and after the transfer. A clear chain of custody helps the court accept the evidence.

What evidence supports the bank chargeback in a courier scam?

The bank chargeback needs the transaction ID, the amount, the date and time, the recipient UPI ID or account number, and proof of the fraud. A call recording or chat showing the false courier claim is strong supporting evidence. The bank statement and the 1930 complaint reference also help. Report within three working days to claim zero liability under the RBI circular.

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Cyber crime lawyer in your city · Bank account freeze help · Contact