Instant loan app fraud: evidence to preserve in 48 hours

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 2 Nov 2026 · Digital evidence

Loan app fraud is proved or lost on the phone. The app, the permission prompt, the sanction screen, the fee demand, the mandate and the recovery calls all exist only as data on a device that the victim is usually in a hurry to clean. Investigators see this constantly: a complainant who has already uninstalled the app, cleared the chat and blocked the numbers, and who therefore has a bank statement and nothing else. A bank statement proves money moved. It does not prove who took it, why, or on what representation.

The first 48 hours are decisive for two reasons. The app's local data survives until the app is removed or its storage is cleared, and the beneficiary account survives until the money is withdrawn. Both windows are short. The steps below are ordered so that preservation happens before reporting, because reporting takes time and the device is the only source that cannot be reconstructed later.

Why electronic evidence needs special handling

Under section 63 of the Bharatiya Sakshya Adhiniyam 2023, an electronic record is admissible as a document, but where it is produced by a device or process outside the court, it must be accompanied by a certificate in the prescribed form identifying the record, describing how it was produced, and confirming the integrity of the device and the process. This is the successor to the old section 65B certificate, and its purpose is the same: to prove that the printout or copy is what it claims to be.

That certificate is signed by the person in control of the device, which in the first instance is you. A screenshot without a certificate is vulnerable to objection. A screenshot with a certificate, a hash value and a description of how it was taken is far harder to dislodge. Section 63 also matters for the app's own server-side records: when the investigating officer obtains data from the app operator or the app store, the certificate comes from that custodian, not from you.

Two practical consequences follow. First, do not factory reset the phone and do not delete the app before imaging or capturing. Second, keep the original handset available. If the phone must be used, note the IMEI, the model, the OS version and the date of capture in a short written statement.

The evidence set, in the order to capture it

1. The app itself and its install trail

• Screen recording of the app opening, the loan amount shown, the tenure, the interest and the fee deduction.
• Screenshots of the app store listing, the developer name, the package name, the install date and the permissions requested.
• The install source. Whether it came from Google Play, the App Store, a website link or a WhatsApp APK matters, because the sourcing route determines which intermediary can be asked to act.
• The app's privacy policy and terms as displayed inside the app, captured page by page, including the version or last-updated date.

2. The permission and data access record

This is the most under-collected category and often the most important. On Android, the permission manager shows which permissions were granted and when; on iOS, the privacy report shows which data each app accessed. Capture those screens. If the app read contacts, SMS, call logs, photos or the clipboard, that access is the foundation of the data protection complaint and of the section 66 IT Act argument about unauthorised access.

Also capture the contact list as it stood at install, so that later extortion calls to those contacts can be linked to the scrape. And capture any screen that shows the app demanding access as a condition of the loan.

3. The money trail

• Bank or UPI statement covering the full period, exported as a PDF from net banking rather than photographed.
• The UPI transaction reference numbers for every payment, both the fee paid to the app and the disbursal received.
• The e-mandate or auto-debit registration details: the mandate ID, the maximum amount, the frequency, the payee name and the date of registration.
• Any payment page that shows the payee as a personal name rather than a company, which is itself evidence of a breach of the digital lending directions.

4. The communications

Every call from the recovery agent should be recorded where lawful, with the number noted at the start. In India, recording a call to which you are a party is generally permissible for the purpose of a complaint; do not publish or circulate it. Capture the call log with timestamps and durations. Export WhatsApp chats with the media included, and photograph the screen as a backup because exports can lose context. Note the language of the threats and the exact words used, since criminal intimidation under section 351 BNS and extortion under section 308 BNS turn on the threat conveyed.

If the app sent morphed images or threatened to send them to contacts, preserve the images, the message, the sender ID and the time. Do not forward them to anyone outside the investigating officer and your lawyer.

5. The identity trail

Screenshots of the app's about page, its registered address if shown, the named lender or NBFC, the grievance officer's details and any RBI or registration number displayed. If the app displays a registration number, capture it as shown; whether it is genuine is for the investigation to check, and a fabricated registration number supports a forgery charge under section 336 or 340 BNS.

Evidence item, why it matters, and where it lives

The table explains why the order matters. Items stored only on the device are captured first. Items held by the bank or the app store are requested in writing so that a custodian certificate can follow. An investigating officer who is handed an organised evidence set with a timeline will move faster than one who is handed a phone and asked to find things.

What to do in the first 48 hours, step by step

1. Do not uninstall, do not reset, do not clear storage. Put the phone on charge, disable auto-updates for the app, and stop using the app.
2. Capture a screen recording walking through the app from the loan offer to the repayment page. A continuous recording is stronger than a set of still images because it shows the sequence.
3. Photograph the permission list from the device settings, not from inside the app. The system record is independent of the app's own claims.
4. Export the bank statement as a PDF for the full period and download the UPI transaction history. Do not rely on SMS alerts alone.
5. Write a short timeline on one page: date of install, date of sanction, date and amount of each payment, date of each threat. Sign and date it. This document becomes the cover sheet for the FIR.
6. Prepare the section 63 BSA certificate for the screenshots and recordings you captured, describing the device, the process and the hash if you can compute one.
7. Report to 1930 and cybercrime.gov.in and keep the acknowledgement numbers. Attach the timeline, not the raw files, at this stage; the portal limits attachments.
8. Hand the device to the investigating officer only against a written acknowledgement listing the model, IMEI and the items inside. Where the phone is your only phone, tell the officer and ask for a forensic imaging at a cyber lab instead of seizure.
9. Write to the bank and the app store asking them to preserve records, quoting the complaint number. A preservation request sent early is what stops the trail from disappearing.
10. Do not delete the app after the FIR. Wait until the officer confirms in writing that the data has been extracted or that it is no longer needed.

What decides whether the evidence holds up

The first test is authenticity. A screenshot that cannot be tied to a device, a date and a process is easy to challenge. A screen recording made on a named handset, with the device clock visible and the IMEI recorded, is much harder to challenge. The second test is completeness. Investigators and courts look for the whole exchange, not the single most damaging message. A chat produced in fragments invites the argument that context was removed.

The third test is custody. Every transfer of the device or the files should be documented. Where the phone goes to a forensic lab, the chain of custody record is part of the case. The fourth test is corroboration. Electronic evidence that is supported by an independent record, such as the bank's own transaction log or the telecom operator's call detail record, survives objections that a standalone screenshot would not.

The fifth test is the certificate. Section 63 BSA is not a formality. Cases have turned on the absence of a certificate, and the omission is usually the complainant's, not the investigator's, because the complainant never prepared one.

Mistakes that destroy the evidence set

• Uninstalling the app to stop the harassment. This is the single most damaging act in these cases.
• Clearing the chat and blocking the numbers before capturing them. Blocking removes the sender ID from easy view and often deletes the thread.
• Sending screenshots to relatives and friends for advice. The images get compressed, stripped of metadata and re-shared, and the original is lost.
• Photographing the bank statement instead of exporting it. A photograph of a screen is weak evidence of a bank record the bank can produce properly.
• Recording a call and then editing it. An edited recording is worse than no recording, because the objection to it contaminates the rest of your evidence.
• Waiting for the police to collect the phone before capturing anything yourself. The app's cache does not wait for a police appointment.

Where the harassment is ongoing, preservation and protection have to happen together. Threats to publish images should be reported the same day and a request made for takedown and number blocking. Our cyber crime lawyers in West Bengal handle these urgent applications, and the criminal defence page explains what happens if a counter-complaint is filed against you.

When to involve a lawyer

You can complete the preservation steps yourself. A lawyer becomes necessary when the evidence is already partly lost and needs to be reconstructed from bank and telecom records, when the certificate under section 63 BSA has to be drafted correctly for a trial, when a preservation or takedown order is needed urgently, or when the accused has filed a counter-complaint and your own evidence set is being used against you. The earlier that review happens, the less there is to repair.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• Loan app harassment: evidence to preserve in 48 hours
• Trading app scam: the evidence to preserve in 48 hours
• UPI Fraud Evidence: What to Preserve in 48 Hours
• Work from home scam evidence to preserve in first 48 hours
• Mutual fund scam evidence to preserve in the first 48 hours
• Job Scam: The Evidence to Preserve in the First 48 Hours

Cyber crime lawyer in your city · Bank account freeze help · Contact