Cybercrime Evidence Checklist: What to Save Before It Disappears

Current position in plain English

Use the Debt-to-Income and FOIR Calculator to work through the related inputs before acting.

Decision table

For the connected rule, example or next step, see Reassessment Proceedings: Evidence File Before Replying.

How to apply the rule

Use two tracks at the same time: containment and complaint. Containment blocks further access; the complaint creates a traceable record for banks, payment operators and investigators.

Never rely on a phone number supplied inside the suspicious message. Open the official app or type the institution’s website address independently.

A fast, accurate complaint is better than a dramatic allegation. State what was authorised, what was not, when the alert arrived, when the bank was informed and which credentials or devices may have been compromised.

For cybercrime evidence checklist, first identify the legal or contractual relationship, then separate the amount, event and deadline. Use one chronology across the portal, institution and supporting records. This prevents a correct fact from being submitted under the wrong year, account, policy clause or complaint route.

For the connected rule, example or next step, see Appeal Readiness: What to Save Before Challenging a Tax Order.

Practical example

A victim screenshots only the final 'account blocked' message but deletes the investment group. A better file includes the group link, admin usernames, payment instructions, beneficiary accounts, UTRs, app download URL, call logs and a chronology of each transfer.

Action checklist

• Block and report the financial channel immediately.
• Export chats and save original emails with headers.
• Capture full-page screenshots showing URL, time and username.
• Download statements and UTR details.
• Record device, SIM and remote-access changes.
• Write a chronological incident note while memory is fresh.
• Back up evidence in two secure locations.
• Submit only relevant copies to official channels.

Evidence and document checklist

• Bank and wallet statements
• UTRs and payment receipts
• Phone and call logs
• Email headers and original .eml files
• Chat export and media
• Website/app links and installation files
• Identity documents sent to scammer
• Bank, 1930, cybercrime and police reports

Common mistakes

• Cropping out usernames or timestamps
• Forwarding evidence repeatedly and losing originals
• Editing the only screenshot
• Delaying the bank call to prepare a document
• Publishing personal data on social media
• Giving a recovery agent remote access

Red flags

Escalation route

Submit financial fraud promptly to the bank, 1930 and cybercrime.gov.in. Follow police instructions for device examination. Escalate service complaints separately to the relevant regulator; do not mix criminal allegations and consumer-service issues without explaining both.

When escalating, include the original complaint, acknowledgement, concise chronology, disputed amount, rule or clause relied upon and the exact relief requested. Do not send passwords, PINs, OTPs or unrelated identity documents.