Investment scam evidence to preserve in the first 48 hours

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 1 Nov 2026 · Digital evidence

The first forty-eight hours after an investment scam is discovered decide what evidence exists at the end of the case. Two things happen in that window, and they pull in opposite directions. The fraudsters delete accounts, groups and applications, and the victim, in a hurry to report, deletes or resets the very device that holds the proof. The evidence that survives is the evidence that was preserved deliberately, in a form a court can accept. Under section 63 of the Bharatiya Sakshya Adhiniyam, 2023, an electronic record is admissible only when accompanied by a certificate identifying the record and the device, signed by the person in charge of the device and an expert, and the certificate is far easier to give truthfully while the original device and data are still intact.

The practical aim is not to collect everything. It is to collect the things that establish four facts: that a representation was made, that it was false, that money was paid because of it, and who received the money. Every item below serves one of those four. Anything that serves none of them can wait.

Why speed beats completeness

Digital evidence has a short life in a fraud case. Chat groups are deleted, profiles are renamed, applications stop loading, and accounts are closed once they are flagged. A screenshot taken on the first day captures a state of the account that may not exist on the third. The same is true of bank records: the beneficiary account into which your money settled will be emptied and abandoned quickly, and the receiving bank's record of where the funds went next exists only in its own systems, retrievable by an investigating officer through a lawful request. Your report creates the basis for that request. Your screenshots create the basis for the report.

There is a second reason for speed. Section 63 requires a certificate from the person in charge of the device. If the device is reset, the application uninstalled, or the chat cleared "to free space", the certificate can no longer be given honestly, and the record may be excluded or its weight reduced. The victim who preserves the device intact gives the prosecution a clean chain; the victim who tidies up gives the defence an opening.

What to preserve, and how

The list below is ordered by how quickly each item disappears. Work down it rather than across it.

Two technical points make the difference between evidence and clutter. First, keep the original, not just the copy: an exported chat file with its metadata is stronger than a photograph of a screen, and a screenshot of a screenshot is weaker still. Second, keep a hash of each exported file where you can — a hash is a value computed from the file's contents, and it allows anyone to check later that the file has not been altered. Section 63(4) of the Bharatiya Sakshya Adhiniyam, 2023 specifically provides for hash values in the certificate, and a hash taken at the moment of export is the simplest way to demonstrate integrity.

The first six hours

Report before you organise. Call 1930 and file on cybercrime.gov.in with the transaction references in hand; the freeze request depends on those numbers, not on a tidy folder. Then write to your bank in a single email listing every disputed transaction, and ask for a written complaint reference. Take screenshots of the application and the chat while you are on the call, because the group may be closed at any moment. Write your chronology in the same sitting, while you still remember which message prompted which payment.

Six to twenty-four hours

Export the chats properly. Note the platform's own preservation tools: most large platforms allow you to download your account data, and some allow you to report an account while asking that its content be preserved. Send that request and keep the acknowledgment. Compile the payment trail into a single table — date, amount, reference number, beneficiary — and reconcile it against the bank statement so that no payment is missing. Preserve the call log and any voice notes. If the scheme had a website, capture the pages as PDFs with the date visible, and note the domain; a page that loads today may be gone tomorrow.

Do not, at this stage, confront the operators. A message demanding your money back tells them that the account is about to be reported, and the response is usually to delete the group and move the funds. Preservation comes first; confrontation is a decision for later, taken with advice.

Twenty-four to forty-eight hours

Complete the formal record. Lodge the police complaint with a copy of the chronology and the evidence index attached. Obtain the section 63 certificate while the device is still in the state it was in when the events happened — the certificate identifies the electronic record, describes the device, states the particulars of the person who produced it, and gives the hash. If the matter may go to a civil court as well, keep one complete set of the same material for that proceeding, and keep a note of where each original is held.

Also, at this stage, review what you have not preserved. The most commonly missed items are the payment gateway's confirmation page, the merchant name shown on the card statement, the invitation link that brought you into the group, and the exact time at which the first withdrawal was refused. Each is small, and each is difficult to reconstruct later.

Chain of custody, in plain terms

Chain of custody means being able to say, at every point, who held the material and what happened to it. For a victim this is simpler than it sounds. Keep the original device with you until it is handed over against a receipt. Keep exported files in the form in which they were exported, without editing them. If you must copy a file, record the date, the source and the destination. Keep the acknowledgment from every platform, bank and portal. Do not pass the material through a chain of friends and relatives for "safe keeping" — each handover is a question the defence will ask, and most of the answers will be unsatisfactory.

Where the material is on a phone that must continue to be used, the practical approach is to preserve the exports and the screenshots first, then seek advice on how to secure the device without destroying the data. Resetting the phone to remove the fraud application is the single most destructive act available to a victim, and it is done routinely out of fear.

What decides whether the evidence survives a challenge

Four factors decide admissibility and weight. The first is authenticity: can the record be tied to the device and to the person who produced it? That is what the section 63 certificate addresses. The second is integrity: has the file changed since it was created? A hash answers that, and an unedited export answers it better than a re-typed transcript. The third is completeness: a chat produced in fragments invites the argument that the rest of the conversation says something different. The fourth is corroboration: an electronic record that matches the bank statement and the platform's own logs is much harder to attack than one that stands alone.

One honest limitation belongs here. The law on the application of section 63 to different kinds of electronic records is still developing, and courts have taken varying views on how strict the certificate requirement is in practice. What is not unsettled is the direction of travel: the certificate is required, the hash matters, and the original device matters. A victim who complies with the strict view loses nothing; a victim who ignores it may lose the record.

Mistakes that destroy the evidence

Do not uninstall the fraud application, clear the chat, delete the account or reset the phone. Do not "clean up" screenshots by cropping out the date, the time or the handle. Do not re-type a chat into a document and present it as the chat. Do not forward the material to a group for advice. Do not let anyone else hold the device, and do not accept an offer from a stranger to "extract" the data. Do not send the only copy of a document to the police and keep none; keep a complete duplicate set. And do not wait for the investigation to begin before preserving — the police will ask for what you kept, not for what you remember.

When to involve a lawyer

Evidence work is the part of a fraud case where early advice is cheapest and most effective. A cyber crime lawyer in Kolkata can review the export and the certificate against the requirements of section 63 of the Bharatiya Sakshya Adhiniyam, 2023, identify what is missing while it can still be obtained, and prepare the evidence index that an investigating officer and a court will actually use. For matters that may also become a recovery claim, a civil litigation practice can advise on preserving the same material for the civil record. The evidence you keep in the first two days is the evidence the case will be built on. Keeping it properly is not a technicality; it is the case.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• Work from home scam evidence to preserve in first 48 hours
• Trading app scam: the evidence to preserve in 48 hours
• Mutual fund scam evidence to preserve in the first 48 hours
• Job Scam: The Evidence to Preserve in the First 48 Hours
• Loan app harassment: evidence to preserve in 48 hours
• Instant loan app fraud: evidence to preserve in 48 hours

Cyber crime lawyer in your city · Bank account freeze help · Contact