Trading app scam: the evidence to preserve in 48 hours

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 1 Nov 2026 · Digital evidence

In a trading app scam, the evidence that decides your case is destroyed by time, not by anyone’s malice. Message histories expire, the app is pulled from the store, a “support” account deletes itself, and your phone quietly overwrites the very things a court would need. The rule is blunt: the first 48 hours decide the evidence. What you capture and how you capture it in those two days is what a police officer, a bank and eventually a court will work from months later. Section 63 of the Bharatiya Sakshya Adhiniyam, 2023 governs how that electronic material becomes admissible, and it rewards the person who kept the original device and the original data.

There is a second reason to move quickly. Preservation and recovery pull in opposite directions. Reporting the fraud to 1930 so the destination account can be frozen uses the same transaction records you need for evidence, and the freeze only works while the money is still parked. You therefore capture first, report within the hour, and keep capturing as the platform’s support desk responds to your freeze attempts. The sequence below sets out exactly what to save and in what order.

Why electronic evidence is fragile here

Fraud of this kind leaves a trail, but almost all of it is digital, and digital trails are easy to lose. The app itself may be hosted on infrastructure that a victim can never reach. The chat with the “investment advisor” may sit on a number that is disconnected the moment a complaint is made. Screenshots taken from a forwarded message prove little, because they can be edited; screenshots taken directly from the device on which the conversation occurred, kept alongside that device, are far stronger. A court will want to know where the material came from and that it has not been altered, which is precisely what a certificate under BSA section 63 is designed to record.

What to capture, in order

1. The app and its identifiers. Before anything is removed, note the exact name, the developer listed on the store, the download link, and any registration number shown inside the app. Screenshot the splash screen and the “about” page. Do not uninstall the application yet.
2. The full chat record. Export or screenshot the entire conversation with the advisor, the support desk and any group you were added to. Capture the first message, because it contains the inducement, and the last, because it contains the demand for a fresh payment.
3. The money trail. Download the bank statement covering the period of every transfer. Note each beneficiary name, account number, IFSC code, amount and timestamp. Where payments went to a UPI handle, record the handle exactly.
4. Your own portfolio screenshots. The app’s display of growing profit is the proof of what you were promised and shown. Capture the balance, the withdrawal page and any screen that refused a withdrawal.
5. The demands for more money. Screenshot the messages asking for tax, clearance or margin payments. These often contain the account details that allow the fraud to be traced.
6. Your report references. Save the 1930 acknowledgement, the portal complaint number and every email to the bank. These turn a set of screenshots into a documented timeline.

How each item matters

The section 63 certificate

Electronic records are admissible, but the law sets a condition. A person occupying a responsible official position in relation to the device or the activity must give a certificate identifying the record, describing how it was produced and confirming that the device was working properly and the data was not tampered with. That certificate is what allows your screenshots, exported chats and downloaded statements to be read as evidence rather than merely produced and forgotten. The practical consequence is that you should not delete the app from the phone, and you should not clear the chats, because the original device is usually what makes the certificate meaningful.

What the bank and the platform hold

Your evidence does not stand alone. The bank can produce a record of the debits and the destination of each transfer, and this is why the written dispute to the bank matters even where you expect it to refuse a refund. The cyber crime police can seek further records from the destination banks under the investigation. The platform itself, where it is a genuine intermediary with an Indian presence, can be required to preserve and produce records. The point of your 48-hour capture is to lock in what only you can provide: the inducement as you experienced it and the proof that the platform stood behind the promises made to you.

Capturing evidence without breaking it

The instinct to tidy up is the enemy of a good record. On a phone, a few habits protect the trail. Turn off any setting that automatically deletes messages, and do not let a storage-cleaning tool run over the app’s data. Take screenshots with the device clock visible in the status bar, so each image carries its own date. Where the platform permits an export of the chat, export it, but keep the conversation on the original device as well. If you have more than one phone, record on the one on which the fraud actually happened rather than forwarding everything to a second device.

Where a message is on a platform that removes content after a period, such as a disappearing-message setting, disable that feature the moment you realise what has happened and ask the other side to keep sending in normal messages. You cannot force the fraudster to cooperate, but you can make sure that what they have already sent stays. Where you have bank alerts by SMS or email, keep those as well; they carry an independent timestamp that supports your statement of when each transfer happened.

What the police can obtain that you cannot

Some of the most useful material is not in your hands at all. The investigating officer can seek subscriber details for the numbers and UPI handles involved, bank records from the destination accounts, and, where the platform is a genuine intermediary with an Indian presence, records that the platform is obliged to preserve and produce. What the police cannot reconstruct is your side of the story — the promise made to you, the screen that showed a growing balance, the moment you were told to pay a tax before withdrawing. That is exactly why the victim’s own capture is irreplaceable, and why the section 63 certificate that authenticates it is worth arranging early rather than at the end of the case.

Mistakes that destroy your own evidence

• Uninstalling the app. It feels like moving on; it is actually deleting the exhibit.
• Clearing chats to tidy up. Exported copies lose the evidentiary weight of the originals.
• Forwarding screenshots and relying on the forwards. A forwarded image proves much less than the conversation on the source device.
• Sending originals to a stranger who offers to “investigate”. Keep custody, share copies.
• Editing or cropping screenshots. A cropped image invites the argument that it was altered.
• Recording only the amounts. The who, when and by what means are what trace the fraud.

Why this matters to the case that follows

Evidence in a cyber fraud does not decay because someone erased it deliberately. It decays because nobody thought to save it while it was still there.

The criminal complaint, the bank refund claim and any civil suit all rest on the same record. Sections 66D and 66C of the Information Technology Act, 2000 and sections 318, 316, 336 and 351 of the Bharatiya Nyaya Sanhita, 2023 describe the offences, but it is the evidence that connects conduct to a person. In practice, victims who lose their case usually lose it not because the law failed but because the chat that contained the inducement no longer existed, or because the app had been removed before the police could examine it. Preserving the record is the cheapest and most decisive thing a victim can do.

When the trail is already cold

If more than a fortnight has passed and evidence has been lost, the position is weaker but not hopeless. The bank’s own records will still show the transfers, and the destination accounts can still be identified. What is gone is usually the narrative proof of the deception, and a lawyer may be able to reconstruct some of it from emails, payment records and the recollections recorded in a detailed complaint. It is worth speaking to an experienced office before assuming nothing can be recovered. A cyber crime lawyer in Kolkata can also advise on the certificate under BSA section 63 and on the sequence of steps that best protects whatever remains.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• Work from home scam evidence to preserve in first 48 hours
• Mutual fund scam evidence to preserve in the first 48 hours
• Loan app harassment: evidence to preserve in 48 hours
• Job Scam: The Evidence to Preserve in the First 48 Hours
• Investment scam evidence to preserve in the first 48 hours
• Instant loan app fraud: evidence to preserve in 48 hours

Cyber crime lawyer in your city · Bank account freeze help · Contact