KYC update scam evidence to preserve in the first 48 hours

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 2 Nov 2026 · Digital evidence

A KYC update scam is proved by records, not by memory. The message that announced a frozen account, the link that opened a fake bank page, the caller's number, the OTP alert and the debit entry are all electronic records. Each one has a short life: messages get deleted, call logs roll over, apps update and screenshots lose their metadata. The first 48 hours are the window in which you can capture the record in a form a court will accept. After that, you are reconstructing instead of preserving.

This is not only about winning a criminal case. The bank decides your liability on the basis of what you can show, and the RBI's 2017 circular on unauthorised transactions turns on when and how you reported. A well-preserved set of records makes the bank's freeze and reversal process faster and makes a later civil suit viable. A poorly preserved set leaves you with a story that no institution can verify.

Why the first 48 hours matter in law

Electronic records are admissible under Section 63 of the Bharatiya Sakshya Adhiniyam 2023, but the section comes with a condition. The record must be produced together with a certificate identifying the electronic record, describing how it was produced, and confirming that the device was operating properly. The certificate is normally signed by the person in charge of the device or the management of the relevant activity. Without it, a court may refuse to rely on the record even if the screenshot is genuine.

That requirement shapes what you do on day one. A photograph of a message on your own phone is easier to certify than a forwarded copy. An original email with full headers is stronger than a screenshot of the subject line. A bank statement downloaded from the bank's own portal carries its own authenticity. The aim is to keep the record in its original environment and to note who captured it, when and from which device. The BNSS 2023 investigation then builds on that material: the police can seek call detail records, IP logs and account statements from the bank and the telecom provider, but they can only ask for the right window if your complaint fixes the time.

Hour one: capture before you clean anything

1. Do not delete the message, chat or call log. Keep the phone charged and do not reset it, update the app, or run a cleaner. The original notification and the sender ID are part of the record.
2. Take a full-screen screenshot that shows the sender, the time and the text. Include the status bar with the date and network. If the message contains a link, capture the link text before tapping anything else.
3. Photograph the screen with another device as a backup. A second-device photograph showing the phone and the message in one frame is useful evidence of the original context, even though it is secondary.
4. Record the caller's number and the exact time of the call. If there were several calls, note each one. Do not call the number back.
5. Capture the fake page if it is still open. Save the full URL, the page title and the fields you entered. Do not log in again or submit another form.
6. List the apps you installed at the fraudster's request. Note the app name, the permissions granted and whether screen sharing or accessibility access was enabled. Uninstall only after the police or your lawyer advises it; the app itself may contain the remote-access record.
7. Write a short timeline while it is fresh. The time of the message, the call, the link, the OTP, the debit and the first complaint. Memory fades faster than people expect, and a contemporaneous note is treated as more reliable than a reconstruction written weeks later.

Hours two to six: bank and payment records

Download the statement covering the debit from the bank's official portal or app and keep the PDF or CSV untouched. Note the transaction reference, the beneficiary name and account or UPI handle, the amount and the exact time. If the bank sent an SMS or email alert, preserve that as well. The alert often contains a reference number that the bank's fraud team uses to locate the transaction internally.

Call the bank's 24-hour fraud line and ask for the transaction to be marked as unauthorised. Ask for the complaint number and the email address to which you should send the documents. Send one email that lists the transaction, attaches the statement and the screenshots, and states clearly that the OTP was obtained by deception. That email becomes the written record of the date and time you reported, which is the central fact under the RBI liability circular.

If the payment went through a UPI app or a card network, raise a dispute in the app as well and save the ticket number. Ask the bank to preserve the IP log, the device fingerprint and the beneficiary account details for the investigation. A written preservation request is not a statutory freeze, but it puts the bank on notice and makes it harder for records to be routine-deleted.

Hours six to twenty-four: the police record

Call 1930 and file the portal complaint, then give a written complaint at the police station. Carry printed copies of the statement, the screenshots and the timeline. Ask for the FIR number or, if the station treats it as a non-cognizable matter, a written acknowledgement. The FIR should name the offence under Section 66C and 66D of the IT Act 2000 and the corresponding cheating provision, Section 318 of the BNS 2023, so that the investigation covers both identity theft and dishonest inducement.

Hand over copies, not your only original device. If the investigating officer needs the phone, ask for a receipt and for the device to be returned after the necessary forensic examination. Keep a second copy of every screenshot in cloud storage and on a separate drive. The police may also require a certificate under Section 63 BSA 2023 when the electronic record is sent to the forensic laboratory or produced in court, so tell the officer that you can sign a certificate identifying your device and the records you captured.

The evidence map

The Section 63 certificate, in plain terms

The certificate is not a formality to be signed at the end of the case. It should identify the electronic record, state the device on which it was created or stored, describe the process by which it was produced, and confirm that the device was working properly at the relevant time. If you captured the screenshot yourself, you are the person best placed to sign it. If the record is a bank statement, the bank's authorised officer provides the certificate. If the record is a call detail record, the telecom provider does. A court is entitled to ask for the certificate before admitting the record, and a missing certificate is one of the most common reasons electronic evidence is excluded.

Keep the hash value or an integrity check where the device or software provides one. It is not mandatory in every case, but it answers the obvious challenge that a screenshot could have been edited. Never crop a screenshot to remove context. A full-screen image that shows the sender, the time and the message is harder to attack than a tightly cropped picture of the text alone.

Mistakes that destroy good evidence

• Deleting the fraudulent message after taking a screenshot. The screenshot proves the content; the original message proves the sender and the metadata.
• Resetting the phone or uninstalling the remote-access app before the police examine it. The app can show when it was installed and what permissions it held.
• Forwarding the message to friends and then deleting the original thread. Forwarded copies lose the original sender details.
• Editing the screenshot to highlight a line. Any edit invites the argument that the record was altered.
• Sending only a photograph of a screen to the bank. The bank needs the transaction reference and the official statement, not an image of a chat.
• Waiting until the bank refuses before preserving anything. By then the call log may have rolled over and the app may have updated.

What decides whether the evidence is accepted

Continuity. A court wants to know that the record produced is the same record that existed on the day. The Section 63 certificate, the original device and an unbroken chain of custody supply that answer.

Contemporaneity. A complaint and a timeline created within hours are more persuasive than a detailed statement prepared after the bank has refused. The date on the bank email and the 1930 ticket does most of this work.

Completeness. A screenshot that shows the sender, the full message and the time is stronger than a fragment. A statement that covers the whole period of the debit is stronger than a single line entry.

Corroboration. The bank's own records, the telecom call detail record and the portal complaint should tell the same story. Where they conflict, the institution's record usually prevails, which is why you should ask for the bank's record in writing rather than rely on your own note.

Who captured it. A record captured by the victim is admissible, but a record produced by the bank or the telecom provider carries more weight because it comes from an independent source. Ask the investigating officer to obtain those records rather than trying to obtain them yourself.

When to involve a lawyer

You can preserve the basic record yourself in the first 48 hours, and you should. A lawyer becomes useful when the bank disputes the authenticity of your screenshots, when the police ask you to sign a certificate you do not understand, when the amount is large enough to justify a forensic examination, or when the case moves to court and the electronic record has to be proved formally. For the court process in Kolkata, see the cyber crime lawyer in Kolkata page. If you need help assembling the file before you approach the bank or the police, use the contact page to arrange a short consultation.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• Telegram investment scam evidence to preserve: 48-hour guide
• AI voice cloning scam: evidence to preserve in 48 hours
• Rental deposit scam evidence to preserve in first 48 hours
• OLX army officer scam evidence to preserve in first 48 hours
• Electricity Bill Scam: Evidence to Preserve in 48 Hours
• Digital arrest scam: evidence to preserve in first 48 hours

Cyber crime lawyer in your city · Bank account freeze help · Contact