Work from home scam evidence to preserve in first 48 hours

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 1 Nov 2026 · Digital evidence

Fraudsters delete accounts, websites and phone numbers quickly. The recruiter who replied to you yesterday may be unreachable by the weekend, and the account that received your money may be closed by the next week. What survives is what you saved. The first 48 hours are not for writing long complaint letters; they are for capturing the record in a form a court will accept.

There is a second reason to move fast. Section 63 of the Bharatiya Sakshya Adhiniyam, 2023 makes electronic records admissible only when the record is produced along with a certificate identifying it and the device it came from. If you delete the chat, reformat the phone or lose the original email, you can still print a screenshot, but its weight drops sharply. Preservation is a legal step, not just a housekeeping one.

What the law expects you to keep

The offence you are documenting is cheating under section 318 of the Bharatiya Nyaya Sanhita, 2023. Where the promises were made through a computer or phone, section 66D of the Information Technology Act, 2000 applies, and section 66C covers identity theft where your documents were used to open an account. Each of those offences is proved through messages, payment records and account details, not through your memory.

Section 63 of the BSA, 2023 is the gatekeeper. Sub-section (4) requires a certificate signed by the person in charge of the computer or device, or by a person occupying a responsible position in relation to its operation. The certificate must identify the electronic record, describe the manner in which it was produced, and give particulars of the device. It must also state that the record was produced by the device during the period it was used regularly, and that the information was fed in the ordinary course of activities. A certificate signed after the fact, without the original device, invites cross-examination.

This is why the safest sequence is: do not delete anything, do not reset the phone, export a copy for the complaint, and keep the original device available. The copy goes to the police and the bank. The original stays with you for the certificate and for any forensic examination.

The evidence checklist, in order of value

1. The full chat thread, exported with media. WhatsApp and Telegram both allow an export that includes images and documents. Export to email rather than to a new phone. A thread that starts with the job offer and ends with the demand for money is the spine of the case.
2. The offer letter and its email headers. Save the original email, not a forwarded copy. The header shows the sending server, the reply-to address and the time. A PDF attachment should be saved separately without re-saving it through an editor.
3. The payment trail. Download the bank statement covering the payment dates. Note the UTR or reference number, the amount, the beneficiary name and the beneficiary account number. For UPI, save the in-app transaction details screen as well as the SMS alert.
4. The recruiter's profile and website. Take a full-page screenshot showing the URL bar and the date. If the website has an about page, a team page and a registration number, capture all of them. A website can be taken down within hours of a complaint.
5. Call recordings and voice notes. If you recorded a call in which the demand was made, keep the original file and note the date, time and number. Do not edit or trim it.
6. Your written chronology. One page: what you were promised, what you paid, when, to which account, what the recruiter said after payment, and what you did next. This is the document every investigator reads first.
7. The complaint acknowledgements. The 1930 reference number, the cybercrime.gov.in acknowledgement, the bank dispute ticket and the police receipt. These prove the timeline of your reporting.

How to make the record court-ready

A screenshot is a copy of a copy. A court wants to know that the record is what it claims to be. Three steps make the difference. First, keep the original device and the original application installed, with the account still logged in where possible. Second, create a hash of the exported files, a SHA-256 value, and record it in your chronology. A hash is a digital fingerprint; if the file changes by even one character, the hash changes. Third, sign the section 63 certificate describing how the export was made and on which device.

Where the police seize the phone, ask for a receipt and a list of items taken. The device may go to a forensic laboratory for imaging. The image, not your phone, should be used for analysis. If the phone is returned, check that the data is intact before you use it again.

Email evidence needs the same care. Save the message as an EML file rather than a screenshot of the inbox. The EML preserves the header chain. If the recruiter used a free email service, the header still shows the IP address of the sending device in many cases, which can be matched with subscriber records during investigation.

What not to do with the evidence

• Do not delete the chat after taking screenshots. The original thread is the record; the screenshot is only a copy.
• Do not crop screenshots so that the sender's number, the time or the date disappears.
• Do not forward the thread to ten friends and then produce the forwarded copy as the original.
• Do not edit the call recording to remove background noise or long pauses.
• Do not reset, update or repair the phone before the certificate is signed and the export is complete.
• Do not upload the only copy to a cloud account you may lose access to. Keep one local copy and one offline copy.

How the record travels through the investigation

Once the complaint is filed, the record passes through several hands and each transfer is a chance to lose it. The cyber cell receives the portal complaint and the attachments. It then writes to the bank for the beneficiary account details and to the platform for the subscriber records linked to the phone numbers and the email address. Those replies come back as electronic records, and each one needs its own section 63 certificate from the service provider.

If the case is registered as an FIR, the investigating officer prepares a case diary and may send the seized phone to a forensic laboratory. The laboratory creates a bit-by-bit image of the storage and works on the image, not the original. That image becomes the record produced in court. Your export is not a substitute for the image, but it helps the officer know what to look for.

At the charge sheet stage, the prosecution must show the court what was collected and how. A victim who kept a written index of the files, with dates and descriptions, makes that stage faster. An index is not evidence by itself, but it tells the court and the defence that the record was preserved deliberately rather than assembled later.

If the matter goes to trial, the person who signed the certificate may be called to explain the export. That is why the certificate should describe the actual method used: the application, the device, the date of export and the destination email. A certificate copied from a template without those details invites questions that are hard to answer.

What decides whether the evidence is accepted

The first factor is authenticity. The court asks whether the record is what it purports to be. A complete thread, an original email and a bank PDF are easier to accept than a collage of cropped images. The section 63 certificate is the formal answer to the authenticity question, and a certificate that matches the device and the export method is much stronger than a generic printout.

The second factor is continuity. The record must connect the offer to the payment and the payment to the beneficiary. If the chat is on one phone, the payment on another and the offer letter in a third email account, the chronology must explain the links. Investigators lose time when the victim cannot show which account paid which demand.

The third factor is completeness. A thread that begins after the first payment leaves out the inducement. A bank statement that covers only one transfer hides the pattern. A website screenshot without the URL bar proves very little. Completeness matters more than volume.

The fourth factor is preservation of the original. Where the prosecution relies only on prints and the original device is unavailable, the defence will argue that the record could have been altered. The BSA does not make prints inadmissible, but it makes them contestable. Keeping the device removes that argument.

When to involve a lawyer

Preservation itself does not need a lawyer. The certificate and the complaint do not either, though both are stronger when drafted carefully. A lawyer becomes useful when the bank disputes the claim, when the police treat the complaint as a civil dispute, or when the case reaches trial and the electronic record is challenged. A cyber crime lawyer in Kolkata can review whether your export satisfies section 63, draft the certificate and the complaint, and prepare the record for the forensic examination. If the matter reaches a bail hearing, the strength of the preserved record is often what decides whether the accused is released; the bail page sets out how that stage is argued.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• Trading app scam: the evidence to preserve in 48 hours
• Mutual fund scam evidence to preserve in the first 48 hours
• Job Scam: The Evidence to Preserve in the First 48 Hours
• Investment scam evidence to preserve in the first 48 hours
• Loan app harassment: evidence to preserve in 48 hours
• Instant loan app fraud: evidence to preserve in 48 hours

Cyber crime lawyer in your city · Bank account freeze help · Contact