Phishing evidence: what to preserve in the first 48 hours

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 3 Nov 2026 · Digital evidence

The money lost in a phishing attack can sometimes be recovered. The evidence that proves the fraud can almost never be recovered once it is gone. Messages are auto-deleted, browsers clear their caches, and counterfeit pages are taken down within hours of a campaign ending. That is why the technical work of preservation, rather than the drafting of the complaint, is the part of a phishing case most likely to decide its fate. A complaint with strong evidence moves; a complaint built on memory alone stalls.

This guide sets out what to keep, how to keep it in a form a court will accept, and what habits quietly destroy the very proof you will later need. The governing rule is Section 63 of the Bharatiya Sakshya Adhiniyam 2023, which deals with the admissibility of electronic records, and the practical requirement that the person producing the record supplies the supporting certificate the section calls for.

Why the first 48 hours decide the case

Two clocks are running at once. The banking clock rewards speed, because the liability bands under the Reserve Bank of India's framework for unauthorised electronic transactions turn on how quickly the customer reported. The evidentiary clock is less forgiving still: a phishing landing page is often hosted for a day or two and then removed, the sending domain is abandoned, and the short-code or sender identifier that carried the lure is retired. Once the infrastructure is gone, the investigating officer has nothing to seize and no digital trail to follow, and the case survives only on the victim's own preserved record.

There is also a third clock, the attribution clock. An investigating officer who acts fast can serve a request on the payment aggregator and the beneficiary's bank while transaction logs are still held in the ordinary course. Those logs, more than any statement by the victim, are what connect the money to a real account holder. Your preserved lure is what tells the officer which logs to ask for.

What counts as evidence

A screenshot is useful, but a screenshot is an image of a claim. The underlying record is stronger: the exported email with routing headers, the source message file, the statement file downloaded from the bank's own portal. Preserve both, and preserve the original files rather than cropped or edited versions, because an edited copy invites the argument that the record has been altered.

What the law requires

Section 63 of the Bharatiya Sakshya Adhiniyam 2023 governs the proof of electronic records. It treats information contained in an electronic record as a document, but it attaches conditions: the computer or device output must have been produced in the ordinary course of the activities of the person lawfully in control, and the record must be accompanied by the certificate the provision specifies, identifying the electronic record and the device and dealing with the integrity of the process. In practice the person who produced the record, or the bank or platform that produced it, supplies that certificate. This is why a victim who keeps clean originals, and keeps them where they can be produced by the right person, is in a far better position than one who relies on a re-typed summary.

The Information Technology Act 2000 supplies the definitional scaffolding. Section 2(1)(t) defines an electronic record, and the Act recognises the legal effect of electronic records generally, which is why an exported message file carries the same weight as a paper document when the authentication requirements are met. Section 66C, which punishes the fraudulent use of another person's password or unique identification feature, and Section 66D, which punishes cheating by personation using a computer resource, are the charges your evidence is meant to support. On the general side, cheating under Section 318 of the Bharatiya Nyaya Sanhita 2023 is the natural companion charge.

Two practical points follow from the statute. First, the certificate is not a form the victim fills in alone; it must come from the person or institution that lawfully controlled the device producing the output, which is why the bank's own statement file and the platform's own export carry more weight than anything the victim formats. Second, the integrity requirement means the record should be capable of being shown not to have been tampered with, and the cleanest way to demonstrate that is to keep the original and avoid editing it. Victim-produced screenshots are still admitted, but they stand in a weaker position precisely because no institution vouches for them.

How to preserve it, step by step

1. Stop deleting. Do not clear the message thread, the browser history, the app cache or the call log until the case is over.
2. Export the fraudulent email with its full headers to a file, and save the SMS thread as a screenshot series that shows the sender, the date and the full message.
3. Screenshot the counterfeit page in full, including the address bar, and copy the exact URL into a plain text file before it disappears.
4. Download the official bank statement covering the date of the debit, and keep the PDF as your bank issued it.
5. Record the time you first noticed the loss, because the reporting-time question is decided by that moment.
6. File with 1930 and with your bank's nodal officer, and save both acknowledgement numbers and the emails you send.
7. Keep a single backup of all of it in one folder, on a device the fraudster never touched, and note in a plain text file which file is which.

What destroys your evidence

• Deleting the lure because it is embarrassing or because a message tells you to — the deletion is itself unrecoverable.
• Forwarding the email instead of exporting it, which loses the routing headers that identify the sender.
• Re-typing the message into a complaint instead of producing the original record.
• Applying filters or edits to screenshots, so that the record no longer speaks for itself.
• Waiting until the counterfeit page is taken down, when the URL can no longer be captured live.
• Reporting only to the bank and never to 1930, so that no police record exists to carry a freezing request.

There is one more reason not to postpone preservation. A victim who reports late is often asked, quite fairly, why the delay occurred, and the answer shapes how the bank and the police read the whole account. A file that shows the lure was captured on the day it arrived, the bank was written to the same evening and the portal complaint was lodged within hours reads as the conduct of someone who was deceived. A file assembled three weeks later, from memory and forwarded copies, invites the suspicion that the story has been reconstructed rather than recorded. The evidence does not only prove the fraud; it proves that you behaved as a victim should.

If you are the one being investigated

Preservation matters just as much when a mule account has been traced to you and you did not know you were part of a fraud. In that setting the useful evidence runs the other way: the messages that show you were told the funds were legitimate, the correspondence with whoever asked you to open the account, and any payment you made onward. Produce them early and in original form. The position here is genuinely different from that of a victim, and it is best addressed with advice tailored to the allegations rather than a generic complaint; the firm's note on criminal defence sets out how that track works.

Where the trail survives even when the page dies

It is tempting to assume the case collapses the day the counterfeit page is removed. It does not, because the most valuable records in a phishing investigation are not stored on the fraudster's server at all. They sit with the bank that processed the debit, the payment aggregator that carried it, the wallet the funds reached, and the networks connecting them. When a victim reports promptly, those institutions preserve and produce the relevant logs, and a police request can reach them through a channel that a direct request from a customer cannot open.

A second store of the trail sits with the platforms that carried the lure. An email provider holds the sending records, and a telecom operator holds the message metadata behind a spoofed sender identifier. These too are recovered through an official preservation or production request, not by the victim. This is the practical reason the first 48 hours matter so much: the institutions retain such data in the ordinary course, but only for a limited period, and a request made late may find that the gap has already closed.

Common questions about proof

Victims often ask whether a screenshot is enough. It is not, on its own, though it helps. They ask whether they should hand over the phone to the police. There is no duty to surrender the whole device, and the better course is to produce the specific records and, where the officer needs more, to cooperate through a documented request rather than an informal handover. They also ask whether the bank needs the same evidence. The bank's reversal process is administrative, but a clean evidence file shortens it, because the nodal officer must judge whether the transaction was genuinely unauthorised.

Keep the originals. The moment a record is edited, copied by hand or deleted, the argument moves from what happened to whether your account of it can be trusted.

When to involve a lawyer

For a simple reversal, you can preserve evidence yourself and file the complaint without a lawyer. The need arises when the amount is significant, when the bank disputes that the transaction was unauthorised, when the case must be taken into a courtroom, or when the same evidence is being used against you. An advocate experienced in cyber crime matters will know how to get the Section 63 certificate from the right source, how to frame a seizure request so the police ask for the correct logs, and how to keep the criminal and civil tracks aligned. If the matter is contested in West Bengal, going through a cyber crime lawyer in West Bengal who appears before the Bankshall Court and the City Sessions Court, with an appeal route to the Calcutta High Court, keeps the two tracks consistent. To have your evidence file reviewed before you file, use the contact page.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• Business email compromise: evidence to preserve in 48 hours
• Work from home scam evidence to preserve in first 48 hours
• UPI Fraud Evidence: What to Preserve in 48 Hours
• Trading app scam: the evidence to preserve in 48 hours
• Loan app harassment: evidence to preserve in 48 hours
• Electricity Bill Scam: Evidence to Preserve in 48 Hours

Cyber crime lawyer in your city · Bank account freeze help · Contact