Mutual fund scam evidence to preserve in the first 48 hours

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 1 Nov 2026 · Digital evidence

Two victims lose the same amount to the same mutual fund scam. One recovers something, the other recovers nothing — and the difference is usually not how much they lost but what they kept. A mutual fund scam is committed over a screen, and the proof lives on the screen. Chats, call logs, payment confirmations, a fake website, a downloaded app. All of it is fragile. Chats can be deleted by the other side, apps update and lose data, screenshots get cropped, and a phone reset erases the original. The first 48 hours are when you capture it, or lose it.

"Preserve" here has a legal meaning and not just a practical one. Under the Bharatiya Sakshya Adhiniyam, 2023, electronic records are admissible on conditions, and section 63 is the provision that governs this. Preserving evidence in a way that later fails section 63 is almost as bad as losing it. So the task in the first two days is twofold: collect everything, and collect it in a form a court will accept.

What the law says about electronic evidence

The BSA 2023 section 63 carries forward the rule that an electronic record, including the content of a communication, must be proved by a certificate given by the person in charge of the device or the relevant activity, identifying the record and the manner of its production, and the particulars a court requires. Where the record is produced from a computer or device under your control, your certificate supports it; where it comes from a service provider, their officer's certificate supports it. The practical consequence is that you must be able to show the record is what it claims to be, unaltered, and traceable to its source.

The Information Technology Act, 2000 frames the offence the evidence must prove. Section 66C punishes identity theft; section 66D punishes cheating by personation using a computer resource; section 66 covers unauthorised access. The evidence you keep is the proof of these: the false identity used, the representation made, the payment induced. The BNS 2023 sections 318, 316, 336 and 61 describe the cheating, breach of trust, forgery and conspiracy — each proved by particular documents, not by the number of screenshots.

Two further statutes matter. The IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 require a platform to preserve and produce records and to act on lawful requests, which is how a chat hosted on a third-party service is officially obtained. The DPDP Act, 2023 is relevant where the scammer harvested your personal data: it frames your rights over that data and reinforces why preserving evidence of what was collected matters.

The evidence checklist — what to capture

Step-by-step preservation in the first 48 hours

1. Stop the bleeding. Do not send more money and do not "verify" with the scammer. Call 1930 or file on cybercrime.gov.in, and write to your bank the same day, before you start collecting.
2. Do not delete, reset or reinstall. Every "cleanup" erases metadata. Leave the chats and the app in place until the data is exported.
3. Export, then screenshot. Export the whole chat thread to a file where the app supports it, and supplement with full screenshots that show the contact's number or handle and the timestamps. Cropped screenshots that hide the sender are weak evidence.
4. Record the infrastructure. Note the phone numbers, the UPI IDs, the bank account and IFSC, the website domain, and the app name and version. This is what a domain and account trace is built from.
5. Secure the originals. Keep the original phone or computer untouched if possible, and back the exports to cloud storage you control. Do not edit the images.
6. Ask the service provider. Where the chat ran on a third-party platform, request the records through the platform's grievance and law-enforcement channel. Under the IT Rules 2021 a platform must deal with lawful requests and preserve records, which gives the police a route to the platform's own copy.
7. Make a BSA 2023 section 63 certificate. Prepare a signed certificate identifying each electronic record, the device it came from and how it was produced. Where the record comes from the bank or the platform, obtain their officer's certificate instead.
8. Verify provenance. Where possible, have the electronic evidence examined in a manner that records its hash or otherwise shows it is unaltered, so no later objection claims tampering.

What decides whether the evidence survives

Electronic evidence is tested on authenticity, completeness and provenance. Authenticity asks whether the record is what it purports to be — an unedited chat, a genuine screenshot, a real statement. Completeness asks whether the thread is whole or cherry-picked; a conversation with the incriminating lines removed invites a tampering objection. Provenance asks where the record came from and who controls it — your own device, the platform, or the bank. A record from a neutral source such as the bank or a platform's preserved copy is stronger than a screenshot you took, because it is harder to attack as altered.

Two practical consequences follow. First, corroborate: a chat proved alongside an independent bank statement is far stronger than either alone. Second, keep the chain intact from capture to court — who held the device, when the export was made, and whether anyone had access to it afterwards. Section 63 of the BSA 2023 is satisfied by a certificate, but a certificate that contradicts the rest of the record does more harm than good.

Common mistakes

• Blocking or reporting the scammer inside the app, which can remove the chat from your side before it is exported.
• Taking screenshots that crop out the sender's number or the timestamp, leaving the conversation unattributable.
• Sending screenshots to friends and then deleting them, splitting the record across devices.
• Recording a summary of the conversation instead of keeping the original words.
• Waiting to "sort it out later" and letting automatic app updates or storage cleanup overwrite the data.
• Editing, enhancing or annotating images, which invites an alteration objection.

Preserve first, analyse later. An unaltered original beats a perfect explanation of a lost one.

Turning evidence into a case file

Evidence becomes a case when it is organised and matched to the sections. Group it: the identity evidence (who they claimed to be), the inducement evidence (what they promised), the payment evidence (where the money went), and the loss (the amounts and dates). Match each group to the offence — the false identity to IT Act sections 66C and 66D, the inducement to BNS 2023 section 318, the forged papers to section 336, the network to section 61. That structure is what a police officer drafts an FIR from and what a magistrate reads on an application under section 175(3) of the BNSS. A criminal lawyer in Kolkata can then build both the prosecution file and the recovery claim from the same preserved set, and coordinate the local cyber cell through cyber crime representation in West Bengal.

Preserving evidence held by a third party

Not all the evidence is on your phone. The scam often runs through a messaging platform, a payment gateway, a social media page or a hosted website. Each of those holds its own records, and your copy is only one version. The first 48 hours are also when you should put the third parties on notice, because their retention periods are not designed for your case. A platform may delete a page after a complaint, a web host may rotate logs, and a payment gateway may hold transaction metadata only for a limited period.

The route is the grievance mechanism first. Under the IT Rules 2021, an intermediary must publish a grievance officer, act on complaints within the prescribed timelines, and preserve records for the period the rules require. Write to the grievance officer with the specific URLs, account handles, transaction identifiers and the date of the fraud, and ask for preservation. Then ask the police to issue a lawful request for the same records. Your letter is not the production request, but it fixes the date on which you asked, which matters if a later dispute arises about whether the platform had notice.

What a BSA 2023 section 63 certificate should contain

The certificate is not a covering letter. It is a statement by the person in charge of the device or the relevant activity that identifies the electronic record, describes the manner in which it was produced, and gives the particulars the court requires to satisfy itself about authenticity. In practice, a sound certificate for a victim's own records does four things. It identifies the device and the application from which the record was taken. It states the date and time of the export and who performed it. It identifies each file or exhibit by name and, where possible, by a hash value. And it declares that the record has not been altered since export.

Where the record comes from the bank or the platform rather than from you, the certificate must come from that organisation's officer, not from you. A victim's certificate cannot authenticate a bank's server log. This is why the corroborating records should be requested in parallel with the export, so that both certificates exist when the case file is assembled. A record proved twice, once from your device and once from the institution, is far harder to attack than a screenshot alone.

Storing the evidence without breaking the chain

Storage is part of preservation. Keep at least two copies in locations you control, and keep a written note of when each copy was made and from which device. Do not rename files in a way that loses the original timestamp, and do not pass the only copy through a messaging app that compresses images. If the original device can be left untouched, leave it untouched, because the device itself may be required for examination.

The chain from capture to court should be describable in a sentence: this file was exported from this device on this date by this person, stored here, and not modified. If that sentence cannot be said truthfully, the evidence is weaker than it looks. Preservation is not about having many screenshots; it is about being able to account for each one.

When to involve a lawyer

You can collect and export the evidence yourself. Involve a lawyer when the electronic record needs a section 63 certificate drafted correctly, when a platform or bank is refusing to preserve or produce records, when the police need a specific request drafted to a provider, or when the same evidence must support both a criminal complaint and a civil recovery suit. Early involvement mostly means fewer gaps to explain later.

The honest position is that not every fraudulent rupee can be recovered, whatever the evidence. What good preservation guarantees is that the case you do bring is provable, so that the fault lies with the facts rather than with a lost chat.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• Work from home scam evidence to preserve in first 48 hours
• Trading app scam: the evidence to preserve in 48 hours
• Job Scam: The Evidence to Preserve in the First 48 Hours
• Investment scam evidence to preserve in the first 48 hours
• Loan app harassment: evidence to preserve in 48 hours
• Instant loan app fraud: evidence to preserve in 48 hours

Cyber crime lawyer in your city · Bank account freeze help · Contact