Job Scam: The Evidence to Preserve in the First 48 Hours

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 2 Nov 2026 · Digital evidence

In the first 48 hours after a job scam, the evidence you save matters more than the words you write. Chat threads get deleted when the account is blocked, scam websites go offline within days, and call records are overwritten. Before you call anyone, sit down and export the conversation, photograph the payment screen, and note the exact time of every message and transfer. That record is what makes the difference between a complaint the cyber crime unit can act on and one that cannot be investigated.

Job scam cases are proved through documents, not testimony. The false promise lives in a chat, the payment lives in a bank statement, and the fake employer lives in a cloned website. Under section 63 of the Bharatiya Sakshya Adhiniyam, 2023, an electronic record is admissible when produced with the prescribed certificate, and that certificate is far easier to give when the original device and the original export still exist. Losing the phone, factory-resetting it or clearing the chat is the most common self-inflicted defeat in these cases.

What you should collect before you do anything else

The order below assumes you are on the device that carried the conversation. If the recruiter spoke to you on a call, the call log and any recording are separate items. If the offer came by email, the email headers are part of the record and should be exported, not just screenshotted.

1. Export the full chat, not selected screenshots. WhatsApp, Telegram and most messaging apps allow an export of the conversation with media. Send the export to yourself by email and keep the original thread on the device. A screenshot of four messages leaves out the context that proves the inducement.
2. Photograph or screen-record the recruiter's profile. The display name, the profile photo, the phone number, the "about" text and the group name all identify the account. A profile can be changed or deleted within hours.
3. Save the offer letter and every attachment. The PDF, the letterhead, the seal and the email address it came from. If the letter carries a company name, note the exact spelling and the domain used; cloned domains often differ by one character.
4. Capture the website before it disappears. Open the recruiter's site and save the page, or print it to PDF. Note the URL, the registration details shown in the footer and the "contact us" address. If the site has a careers page listing the same job, save that too.
5. Download the bank statement covering the payment period. The UTR number, the beneficiary account, the IFSC code and the timestamp are the identifiers the freeze request needs. A screenshot of the debit alert is not enough; the statement is the record.
6. Preserve the UPI or payment app receipt. Where the payment was made through a UPI app, the transaction detail page carries the payee's VPA and the reference number. Export it or photograph it before the app updates.
7. Keep the call log and any recording. If the "HR interview" happened on a video call and you recorded it, keep the original file. If you did not record it, note the date, duration and the number used while your memory is exact.
8. Write a dated timeline. One page, chronological, with each message, call and payment. This is not evidence itself, but it is the index the investigating officer will use, and it prevents inconsistencies between your complaint and your statement.

Why each item decays

How to keep the record admissible

Section 63 BSA replaced the old certificate requirement for electronic records. The record must be produced along with a certificate identifying the electronic record, describing the manner of its production, and giving the details of the device and the person in control of it. In practice this means three things for a job scam victim: keep the original device, keep the original export file unedited, and be able to explain how the export was made.

Do not "clean up" a chat export. Do not crop a screenshot to remove an embarrassing message. Do not forward the thread to a friend and then produce the forwarded copy as the original. Editing a record does not make it inadmissible in every case, but it gives the defence an obvious line of attack and it weakens the certificate you can honestly give.

Where the conversation happened on a platform that does not offer an export, a screen recording made while scrolling slowly through the thread is better than isolated screenshots. Record the profile, the first message, the payment demand and the last message in one continuous file. Keep the file's metadata intact and note the date and time it was made.

A record is only as strong as the chain that connects it to the accused. The chat identifies the number, the number is registered to a subscriber, the subscriber is a person. Every link in that chain has to be preserved in the first week, because the service provider's logs are what the police will request.

The documents the bank and the portal will ask for

When you write to the bank's nodal officer or file on cybercrime.gov.in, keep a single folder with the following. It saves days of back-and-forth.

• The 1930 acknowledgement number and the portal acknowledgement, saved as PDFs.
• The bank statement showing the debit, with the beneficiary account and UTR highlighted.
• The offer letter and the email it arrived from, including headers.
• The chat export and a short typed summary of who said what and when.
• Proof of the recruiter's identity as presented to you — the profile, the website, the phone number, the "employee ID" if one was given.
• Your own KYC and account details, because the bank will verify that the complainant is the account holder.
• A signed complaint narrating the sequence in dates, not adjectives.

Where the payment was made from a joint account or a family member's account, the complainant should be the account holder or an authorised person, and the relationship should be stated in the complaint. A mismatch between the complainant and the debited account is a common reason a freeze request is returned.

Preserving evidence against a company or a website

Job scams often present as a registered company with a website, an office address and a GST number. Do not assume the registration is genuine because a number was quoted. Save the registration details as displayed, then verify them independently through the public registry. If the company exists but denies the recruiter, save the denial — a written denial from the real company is powerful evidence that the offer was fabricated.

Where the recruiter used a social media page or a job portal, save the listing, the page URL and the account handle. Portals remove fraudulent listings when complained to, so the listing should be captured before you report it. Reporting to the platform is still necessary, but capture first.

Keeping the chain of custody intact

Chain of custody is the record of who held the device or the file, and when. It sounds like a formality until the defence suggests the chat was planted or the screenshot was edited. Keep the phone yourself if you can, do not lend it out, and if you must hand it to the police, ask for a receipt or a seizure memo that describes the device and its condition. Note the model, the IMEI and whether a screen lock is set.

If the investigating officer asks for the phone, provide the export and a copy of the file on a pen drive as well, and keep a duplicate. Do not factory reset the device after handing over a copy, and do not install "cleaner" apps that promise to free storage by deleting media.

What the first 48 hours should look like, hour by hour

Hour one. Stop paying. Do not argue with the recruiter and do not warn them that you are reporting; that gives them time to delete the account. Export the chat and photograph the profile.

Hour two. Call 1930 with the transaction details and file on cybercrime.gov.in. Save both acknowledgement numbers.

Hours three to six. Email the bank's nodal officer with the UTR and a request to freeze the beneficiary account. Download the statement and keep the payment receipts.

Hours six to twenty-four. Give the written complaint at the police station under section 173 BNSS, attaching the acknowledgements and the evidence folder. Ask for the FIR copy and note the number.

Day two. Save the fake website, verify the company's registration, and write down the timeline. If the recruiter is still responding, preserve those messages too — they may contain admissions or further demands that strengthen the case.

What decides whether the evidence survives scrutiny

Whether the record is the original. An export from the device, with its metadata, is stronger than a screenshot forwarded through three phones. The court will ask how the record was produced and who controlled the device at the time.

Whether the chain of custody is documented. A file that passed through six hands without a note is easier to challenge than one that stayed with the complainant until it was handed over against a receipt.

Whether the record matches the bank's record. The chat should show the same amounts and dates as the statement. A discrepancy between the two is the first thing the defence will use.

Whether the account can be tied to a person. The chat identifies a number or a handle. The subscriber record, obtained by the police, ties that identifier to a name. Without that link the record proves a conversation, not who conducted it.

How quickly it was preserved. A record captured on the day of the fraud is presumed to reflect what happened. A record assembled a month later invites the suggestion that it was reconstructed.

Mistakes that destroy the record

• Deleting the chat after blocking the number. The block is sensible; the deletion is not.
• Recording over the original call recording or converting it to a compressed format that loses metadata.
• Sending the only copy of a document to the police and keeping none. Always keep a duplicate.
• Editing a screenshot to hide your own words. A partial record is more damaging than an awkward one.
• Waiting for the "company" to confirm the refund before saving anything. By then the website and the account are gone.
• Relying on the platform's own copy. Platforms remove content on complaint; your export is the only copy you control.

When to involve a lawyer

If the amount is substantial, if the recruiter is still in contact and making demands, or if the police have asked you for a statement, the evidence should be organised before it is handed over. A lawyer can prepare the section 63 BSA certificate correctly, draft the complaint so that the sections pleaded match the documents, and keep a duplicate record that survives the investigation. For the complaint and forum strategy see cyber crime lawyer in Kolkata; for how these cases are written up and tracked, the blog carries the practical notes.

Evidence preserved properly in the first two days is useful for years. Evidence reconstructed after a month is usually a set of screenshots nobody can tie to an account.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• Work from home scam evidence to preserve in first 48 hours
• Trading app scam: the evidence to preserve in 48 hours
• Mutual fund scam evidence to preserve in the first 48 hours
• Investment scam evidence to preserve in the first 48 hours
• Loan app harassment: evidence to preserve in 48 hours
• Instant loan app fraud: evidence to preserve in 48 hours

Cyber crime lawyer in your city · Bank account freeze help · Contact