Digital arrest scam: evidence to preserve in first 48 hours
By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 2 Nov 2026 · Digital evidence
The first 48 hours after a digital arrest scam are crucial for preserving evidence that can help the police trace and freeze the fraudsters' accounts. You must save call logs, chat screenshots, transaction records, and the scammer's account details without deleting anything. This guide explains the specific evidence to collect and how to preserve it for use under the BSA 2023.
A digital arrest scam moves quickly. The fraudster keeps you on a video call, creates a sense of panic, and pushes you to transfer money within minutes. By the time you realise it was a fraud, the money may already be moving through multiple bank accounts. The first 48 hours are your window of opportunity. The evidence you collect during this period determines whether the police can trace the funds and whether your bank can process a chargeback. This article sets out exactly what to preserve and how to preserve it so that it stands up in a court of law.
The most important evidence is the record of the communication with the scammer. This includes the phone numbers used to call you, the video call platform (such as Skype or WhatsApp), the account names and profile pictures displayed, and the time and duration of each call. You should also preserve any messages, emails, or documents the scammer sent you, including fake police notices, fake court orders, or fake identification cards. Under Section 63 of the Bharatiya Sakshya Adhiniyam 2023, electronic evidence is admissible if it is preserved in a reliable format and accompanied by a certificate. The BSA replaces the Indian Evidence Act 1872 and sets out the procedure for proving electronic records. You do not need to be a technical expert to preserve this evidence, but you must act carefully and keep the original data intact.
What the law says about electronic evidence
The legal framework for electronic evidence in India is now governed by the BSA 2023. The key provisions are:
- Section 63 of the BSA 2023 deals with the admissibility of electronic records. It requires that the electronic record be produced in a form that is verifiable and that a certificate be provided identifying the record and the manner of its production.
- Section 63(4) of the BSA 2023 specifically addresses the certificate requirement for electronic evidence. The certificate must be signed by the person in charge of the computer or communication device and must describe the manner in which the record was produced.
- Section 173 of the BNSS 2023 governs the registration of an FIR. The evidence you preserve should be attached to the FIR or submitted to the investigating officer.
- Section 35 of the BNSS 2023 allows the police to attach property derived from a crime. The evidence you provide helps the police identify the beneficiary accounts and supports the attachment application.
- Section 66D of the IT Act 2000 punishes cheating by personation using a computer resource. The call logs and screenshots are direct evidence of this offence.
- Section 66C of the IT Act 2000 punishes identity theft. The fake identity documents and profile details are evidence of this offence.
- Section 318 of the BNS 2023 punishes cheating. The transaction records and communication logs establish the deception and the financial loss.
- Section 351 of the BNS 2023 punishes criminal intimidation. The threats made during the call are evidence of this offence.
- RBI directions on unauthorised electronic transactions require you to report the fraud promptly. The evidence you preserve supports your complaint to the bank and your chargeback request.
The BSA 2023 has changed the way electronic evidence is treated. The certificate requirement under Section 63 is strict, and courts may reject electronic records that are not properly authenticated. This is why you should not edit, crop, or alter any screenshots or recordings. Keep the original files and make copies for submission. If you have a call recording, preserve the original file and note the device on which it was recorded. If you have screenshots, keep the original images and avoid compressing them. The metadata associated with the files, such as the date and time, is also valuable evidence.
Step-by-step evidence preservation checklist
The following checklist is designed to be followed immediately after you realise you have been scammed. The order matters because some evidence can be lost if you delay.
- Do not delete anything. The first rule is to preserve the original data. Do not delete call logs, messages, emails, or screenshots. Do not clear your phone's cache or reset the device. If you have a call recording, do not delete it or transfer it in a way that changes the file.
- Document the communication. Write down the phone numbers, the names used by the scammer, the platform used for the video call, and the times of each interaction. Take screenshots of the call log, the chat window, and the scammer's profile. If the scammer sent documents, save them as they are.
- Preserve the financial trail. Download your bank statement for the relevant period. Note the transaction IDs, the amounts, the dates, and the beneficiary account numbers. If you used a UPI app, take screenshots of the transaction history and the beneficiary details. Save the SMS alerts from your bank.
- Record your own account of events. Write a detailed timeline of what happened, including the time of the first call, the instructions given by the scammer, the amount transferred, and the time of each transfer. This timeline will help the police and your lawyer understand the sequence of events.
- Preserve the scammer's details. Note the bank account numbers, IFSC codes, UPI IDs, and the names associated with the accounts. If the scammer used a website or an email address, save the URLs and the email headers. Do not try to access the scammer's links or download unknown files, as this may compromise your device.
- Create a secure backup. Make copies of all the evidence on a separate device or a secure cloud storage account. Do not use the same device that was compromised. Keep a physical copy of the important documents, such as bank statements and the FIR.
- Submit the evidence to the authorities. When you file your complaint on cybercrime.gov.in or at the police station, attach the evidence. Keep a copy of everything you submit. The investigating officer may ask for the original files or the device for forensic examination.
Evidence table: what to preserve and why
| Evidence type | What to preserve | Why it matters |
|---|---|---|
| Call logs | Phone numbers, time, duration, call type | Establishes contact and identifies the scammer |
| Chat messages | Screenshots of WhatsApp, Telegram, or email | Shows the instructions and threats |
| Fake documents | Notices, IDs, court orders sent by the scammer | Proves impersonation and forgery |
| Bank records | Statements, transaction IDs, beneficiary details | Traces the money and supports attachment |
| UPI records | App screenshots, payment history, UPI IDs | Identifies the recipient account |
| Call recordings | Original audio or video files | Captures the scammer's voice and threats |
| Your timeline | Written account of the events | Helps the police and court understand the sequence |
The table above is not exhaustive, but it covers the evidence that is most useful in a digital arrest scam case. The key principle is to preserve the original data and to document everything. The police and the court will rely on this evidence to establish the offence and to trace the money.
What decides whether your evidence is accepted
Several factors determine whether your evidence will be accepted by the police and the court. The first is authenticity. The evidence must be shown to be what it purports to be. This is why the BSA 2023 requires a certificate under Section 63. The second is integrity. The evidence must not be altered. If you edit a screenshot or trim a recording, its value drops. The third is relevance. The evidence must connect the scammer to the fraud and the money. The fourth is the chain of custody. If the evidence passes through multiple hands, the court will want to know how it was preserved. The fifth is the format. Electronic evidence must be submitted in a form that the court can read and verify. A lawyer can help you prepare the certificate and the submission.
In Kolkata and West Bengal, the cyber crime police station and the Bankshall Court have dedicated procedures for electronic evidence. The Calcutta High Court has also issued directions on the preservation and production of electronic records. A cyber crime lawyer in Kolkata can guide you through the process and ensure that your evidence meets the legal requirements. The blog has more resources on cyber crime procedures and evidence preservation.
Common mistakes that destroy evidence
Victims often destroy the very evidence that could help them recover their money. The most common mistake is deleting the call logs or chat messages after the scam. Some victims block the scammer's number, which may remove the chat history. Others clear their phone's cache or reset the device to remove malware, which can wipe the evidence. Another mistake is editing screenshots to highlight certain parts, which can raise doubts about authenticity. Some victims forward the evidence to friends or family, which can change the metadata. It is also a mistake to wait too long. The scammer's accounts may be closed, and the digital trail may go cold. The safest approach is to preserve everything immediately and to make a secure backup before taking any other action.
If you have already deleted some evidence, do not panic. The police may be able to recover it through forensic examination. Your bank records and the cybercrime portal's records can also provide a trail. Inform your lawyer about what was deleted so that the investigation can focus on the available evidence. The important thing is to stop deleting and to start preserving from this moment forward. You should also document what was deleted and when, because this information can help the investigating officer understand the timeline of the fraud and the steps you took to preserve the remaining evidence. If the device was compromised, you should consider getting it examined by a forensic expert before using it for any financial transactions. A forensic examination can reveal whether malware was installed and whether the scammer had access to your personal data.
When to involve a lawyer
You should involve a lawyer if the amount is significant, if the police are not acting on your complaint, or if you need to submit electronic evidence in court. A lawyer can help you prepare the Section 63 BSA certificate, draft the complaint, and coordinate with the investigating officer. A lawyer can also advise you on the best way to preserve the evidence without compromising its authenticity. Early legal advice ensures that your evidence is collected and submitted correctly, which improves your chances of recovery.
Need help with a cyber crime matter?
Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.
Call +91-9007000603 WhatsAppFrequently asked questions
What evidence should I preserve after a digital arrest scam?
Preserve the call logs showing the numbers and call times, screenshots of the video call and chat, bank statements with transaction IDs, the beneficiary account or UPI details, and any fake notices or identity cards the scammer sent. Keep every call recording in its original file. Do not delete or edit anything, and make a secure backup on a separate device.
Why are the first 48 hours important for evidence preservation?
The first 48 hours matter because the scammer's accounts may be closed and the digital trail may go cold within days. Reporting and preserving evidence quickly lets the police ask banks to freeze the beneficiary accounts and lets your bank act on a chargeback request before the money is withdrawn or routed abroad.
How do I preserve electronic evidence for court under the BSA 2023?
Keep the original electronic record and produce it with a certificate under Section 63 of the BSA 2023. The certificate must identify the record and describe how it was produced, and under Section 63(4) it is signed by the person in charge of the device. Do not edit, crop or compress the files. A lawyer can help you prepare the certificate.
Can I take screenshots of the scammer's messages?
Yes, screenshots are useful evidence, but keep the original files and avoid editing them. Do not crop out the sender's number, the date or the time. Save the original images as they are, note when they were taken, and keep the metadata intact, because the BSA 2023 Section 63 certificate concerns the original record rather than an edited copy.
What should I do if I deleted the call logs by mistake?
Do not panic. The police may recover deleted data through forensic examination of the device, and your bank records and the cybercrime portal's records can still provide a trail. Stop deleting anything at once. Inform your lawyer and the investigating officer clearly about what was deleted, when, and why it happened.
Is a call recording admissible as evidence in a digital arrest scam case?
Yes. A call recording is admissible if it is authentic and preserved without editing, and you should keep the original file rather than a copy. It must be accompanied by the certificate under Section 63 of the BSA 2023. The court then reads it together with your call logs, messages and bank records to establish the scam.
How should I store the evidence to prevent tampering?
Store the evidence on a separate device or a secure cloud account that was not compromised, and keep a physical copy of important documents like statements and the FIR. Avoid forwarding the files through messaging apps, because that can change the metadata and raise doubts about authenticity under the BSA 2023. Keep originals untouched and make copies only for submission.
Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.
Related articles
Cyber crime lawyer in your city · Bank account freeze help · Contact