The Importance of Preserving Evidence
Why Is Evidence Important?
When you become a victim of cybercrime, the evidence you preserve can be crucial in understanding what happened, identifying the offender, tracing financial transactions, and supporting legal proceedings.
Unlike traditional crimes, cybercrimes often leave behind digital evidence that can be easily deleted, altered, or lost. A message may be deleted, a social media account may disappear, or a fraudster may deactivate a phone number or website.
Do not delete anything—even if it appears insignificant.
What Evidence Should You Preserve?
Depending on the nature of the cybercrime, preserve:
💬 Communications
- WhatsApp and other messaging conversations
- SMS messages
- Emails
- Social media messages and comments
- Chat histories
- Voice messages
Take screenshots where appropriate, but retain the original messages and conversations wherever possible.
💳 Financial Evidence
Preserve:
- Bank statements
- Transaction receipts
- UPI transaction details
- UTR / transaction reference numbers
- UPI IDs
- Beneficiary account details
- Credit or debit card transaction records
- Wallet transaction details
- Cryptocurrency wallet addresses
- Blockchain transaction hashes
📞 Information About the Suspect
Record:
- Phone numbers
- Email addresses
- Usernames
- Social media profile links
- Website URLs
- Bank account details
- UPI IDs
- Cryptocurrency wallet addresses
Even if the account or profile is later deleted, the information you preserved may assist investigators.
🖥️ Digital Evidence
Where relevant, preserve:
- Screenshots of fraudulent websites
- Emails and their headers, where available
- Downloaded files
- Suspicious applications
- Website URLs
- Login alerts
- Security notifications
- Device notifications
Avoid altering or deleting potentially relevant files.
Why Should You Preserve the Original Evidence?
Screenshots are useful, but the original source of evidence should be preserved whenever possible.
For example:
- Keep the original email rather than only a screenshot.
- Do not delete the original WhatsApp conversation after taking screenshots.
- Preserve transaction records downloaded directly from your bank.
- Keep the original files received from the offender.
The authenticity and integrity of digital evidence may become important during an investigation or legal proceeding.
What Should You NOT Do?
❌ Do Not Delete Messages
Even embarrassing or threatening messages may be important evidence.
❌ Do Not Edit or Alter Evidence
Avoid cropping or modifying original screenshots where possible.
❌ Do Not Immediately Block the Offender
First preserve relevant information such as the profile URL, username, phone number, and messages. Once the necessary evidence is secured, you can block the offender.
❌ Do Not Factory Reset Your Device
If the device itself may contain relevant evidence, avoid resetting or wiping it unless advised by an appropriate professional or investigating authority.
❌ Do Not Forward Suspicious Files Unnecessarily
If you receive malicious files or links, preserve them safely and avoid opening or forwarding them unnecessarily.
Create an Evidence Folder
Create a dedicated folder on a secure device or storage location and organise your evidence.
For example:
📁 Cyber Crime Evidence
→ 📁 Bank Transactions
→ 📁 Screenshots
→ 📁 WhatsApp Chats
→ 📁 Emails
→ 📁 Call Records
→ 📁 Social Media
→ 📁 Website Links
→ 📁 Police & Bank Complaints
Add dates to your files where possible.
Example:
UPI_Transaction_15July2026.pdf
WhatsApp_Chat_15July2026.pdf
Fraudulent_Website_15July2026.png
Maintain a Timeline
Write down the events in chronological order.
For example:
10:15 AM – Received WhatsApp message.
10:30 AM – Spoke to the alleged bank representative.
10:45 AM – Shared information.
10:50 AM – Received OTP.
10:52 AM – ₹50,000 transferred from account.
10:55 AM – Contacted bank.
11:05 AM – Called 1930.
A clear timeline can help you explain the incident accurately to your bank, the police, cybercrime investigators, or your lawyer.
Report the Incident
Once your evidence is preserved:
- Contact your bank or financial institution immediately.
- Call 1930 if you have suffered financial cyber fraud.
- File a complaint through the National Cyber Crime Reporting Portal.
- Provide the relevant evidence to the investigating authorities when requested.
- Keep copies of all complaint acknowledgements and reference numbers.
Remember
Evidence can disappear. Preserve it before it is lost.
Your screenshots, messages, transaction records, emails, phone numbers, and digital traces may help establish what happened and support an investigation.
When in doubt: Preserve first. Delete later—if ever.