Cyber Fraud Evidence Checklist
Preserve. Document. Report.
Important: Do not delete, edit, or alter potential evidence. Preserve original records wherever possible. Take screenshots as additional copies, but retain the original messages, emails, transaction records, and files.
🚨 STEP 1: Record the Basic Details
☐ Date of the incident: ______________________
☐ Approximate time of the incident: ______________________
☐ Date and time fraud was discovered: ______________________
☐ Type of fraud:
☐ UPI Fraud
☐ Bank Fraud
☐ Credit/Debit Card Fraud
☐ Investment Scam
☐ Online Shopping Scam
☐ Job Scam
☐ Digital Arrest Scam
☐ Courier Scam
☐ Cryptocurrency Scam
☐ WhatsApp/Account Hacking
☐ Sextortion/Blackmail
☐ Social Media Impersonation
☐ Other: ______________________
☐ Approximate amount lost: ₹______________________
☐ How did the fraud occur?
📱 STEP 2: Preserve the Fraudster’s Details
If available, preserve:
☐ Fraudster’s name or alias
☐ Phone number(s)
☐ WhatsApp number
☐ Telegram username
☐ Instagram/Facebook/X/other social media username
☐ Email address
☐ Website URL
☐ App name or download link
☐ UPI ID
☐ Bank account number
☐ IFSC code
☐ Wallet address
☐ Cryptocurrency transaction hash
☐ Any other identifying information
Important: Take screenshots of profiles and save the full URL/profile link where possible.
💬 STEP 3: Preserve Communications
☐ WhatsApp chats
☐ Telegram chats
☐ SMS messages
☐ Email conversations
☐ Social media messages
☐ Voice messages
☐ Call logs
☐ Video call records/details
☐ Screenshots of conversations
☐ Emails with original headers, where available
☐ Caller ID information
☐ Any documents sent by the fraudster
☐ Any links sent by the fraudster
Do not rely solely on screenshots. Preserve the original conversations and emails wherever possible.
💳 STEP 4: Preserve Financial Evidence
For every fraudulent transaction, record:
Transaction 1
Date: ______________________
Time: ______________________
Amount: ₹______________________
Transaction ID / UTR: ______________________
UPI ID / Beneficiary: ______________________
Bank Account Number: ______________________
IFSC: ______________________
Payment Method: ______________________
☐ UPI
☐ IMPS
☐ NEFT
☐ RTGS
☐ Debit Card
☐ Credit Card
☐ Net Banking
☐ Mobile Wallet
☐ Cryptocurrency
☐ Other: ______________________
Repeat this section for every transaction.
Also preserve:
☐ Bank statement
☐ Transaction receipt
☐ UPI transaction screenshot
☐ SMS transaction alert
☐ Email transaction alert
☐ Credit/debit card statement
☐ Wallet statement
☐ Cryptocurrency transaction record
☐ Blockchain transaction hash
📧 STEP 5: Preserve Emails
Where email was involved:
☐ Keep the original email
☐ Take a screenshot
☐ Record the sender’s email address
☐ Record the recipient’s email address
☐ Preserve attachments
☐ Save suspicious links
☐ Preserve email headers where possible
☐ Do not forward the original email unnecessarily
🌐 STEP 6: Preserve Website and Social Media Evidence
If the fraud occurred through a website or social media platform:
☐ Screenshot the homepage
☐ Screenshot the relevant profile
☐ Save the complete URL
☐ Record the username/account ID
☐ Screenshot the advertisement or post
☐ Screenshot the product/service listing
☐ Screenshot the payment instructions
☐ Screenshot the terms and conditions, if relevant
☐ Save copies of invoices or receipts
☐ Record the date and time the page was accessed
Tip: Websites and social media profiles may be deleted or modified. Preserve the evidence as soon as possible.
📞 STEP 7: Preserve Call-Related Information
☐ Fraudster’s phone number
☐ Date and time of call
☐ Duration of call
☐ Call log screenshot
☐ Call recording, if lawfully available
☐ SMS received before or after the call
☐ WhatsApp call details
☐ Details of what the caller claimed
☐ Names/designations used by the caller
☐ Any instructions given during the call
📲 STEP 8: If Your Account or Device Was Hacked
Preserve:
☐ Login alerts
☐ “New device” notifications
☐ Password reset emails
☐ OTP messages
☐ Unauthorised login notifications
☐ Screenshots of compromised account
☐ Emails regarding changes to account details
☐ Evidence of unauthorised transactions
☐ Suspicious applications installed
☐ Suspicious files received
☐ Unusual device activity
☐ Relevant device information
Do not factory reset or wipe the device if it may contain important evidence, unless advised by an appropriate professional or investigating authority.
🔐 STEP 9: Preserve Evidence of Identity Theft
If your identity or personal information was misused:
☐ Screenshot fraudulent account/profile
☐ Preserve unauthorised loan/account details
☐ Preserve credit report entries
☐ Preserve suspicious SMS/email alerts
☐ Preserve KYC-related communications
☐ Record where your identity document may have been submitted
☐ Preserve evidence of unauthorised transactions
☐ Document any calls from financial institutions regarding the fraudulent activity
📸 STEP 10: Take Screenshots Carefully
For every important screenshot, try to ensure that it shows:
☐ Date
☐ Time
☐ Username/phone number/email
☐ Transaction ID
☐ URL
☐ Relevant message or content
Where possible, take full-screen screenshots rather than cropped images.
Keep the original screenshots unedited.
📝 STEP 11: Create a Chronological Timeline
Write down exactly what happened.
| Date | Time | Event | Evidence |
|---|---|---|---|
| ______ | ______ | Received first contact | Screenshot/Chat |
| ______ | ______ | Spoke to fraudster | Call log |
| ______ | ______ | Shared information | Chat/Email |
| ______ | ______ | Made payment | Transaction record |
| ______ | ______ | Discovered fraud | Bank alert |
| ______ | ______ | Contacted bank | Complaint number |
| ______ | ______ | Called 1930 | Complaint number |
| ______ | ______ | Filed cybercrime complaint | Acknowledgement |
Tip: Write the timeline while the events are still fresh in your memory.
🏦 STEP 12: Preserve Bank Complaint Records
Keep copies of:
☐ Bank complaint number
☐ Service request number
☐ Transaction dispute reference
☐ Emails sent to the bank
☐ Bank’s response
☐ SMS received from the bank
☐ Branch complaint acknowledgement
☐ Written complaint submitted to the bank
☐ Date and time of reporting
☐ Name/designation of bank representative, if available
👮 STEP 13: Preserve Cybercrime & Police Records
Keep copies of:
☐ 1930 complaint/reference number
☐ National Cyber Crime Reporting Portal acknowledgement
☐ Cybercrime complaint copy
☐ Police complaint
☐ FIR, if registered
☐ Investigating officer’s details
☐ Case number
☐ Any notices received
☐ Any correspondence with investigating authorities
📂 STEP 14: Organise Your Evidence
Create a secure folder:
📁 CYBER FRAUD CASE
→ 📁 01 – Identity Documents
→ 📁 02 – Bank Transactions
→ 📁 03 – UPI/Payment Records
→ 📁 04 – WhatsApp & Chats
→ 📁 05 – Emails
→ 📁 06 – Screenshots
→ 📁 07 – Call Records
→ 📁 08 – Social Media
→ 📁 09 – Website Evidence
→ 📁 10 – Cybercrime Complaint
→ 📁 11 – Bank Complaint
→ 📁 12 – Police/FIR Documents
→ 📁 13 – Timeline
Keep a backup in a secure location.
⚠️ DO NOT DO THIS
❌ Do not delete chats.
❌ Do not delete emails.
❌ Do not edit screenshots.
❌ Do not factory reset your phone unnecessarily.
❌ Do not transfer additional money to the fraudster.
❌ Do not confront or threaten the fraudster.
❌ Do not pay a third party claiming they can “guarantee” recovery of your money.
❌ Do not publicly share sensitive personal or financial information.
❌ Do not open suspicious links or files merely to collect evidence.
🚨 REPORT IMMEDIATELY
Once you have preserved the essential evidence:
1️⃣ Call 1930
2️⃣ Contact your bank or financial institution
3️⃣ Report the incident through the National Cyber Crime Reporting Portal
4️⃣ Consider approaching the police/cybercrime police station, depending on the circumstances
5️⃣ Seek professional legal advice if the matter is complex or involves significant financial loss, threats, blackmail, identity theft, or other serious consequences.
🛡️ FINAL CHECK
Before submitting your complaint, make sure you have:
☐ Written a timeline of events
☐ Preserved transaction records
☐ Saved screenshots
☐ Preserved original chats and emails
☐ Recorded phone numbers and UPI IDs
☐ Saved website and social media URLs
☐ Contacted your bank
☐ Called 1930
☐ Filed a cybercrime complaint
☐ Saved all complaint reference numbers
☐ Backed up your evidence securely
REMEMBER
PRESERVE FIRST. REPORT QUICKLY. DON’T DELETE.
Digital evidence can disappear quickly. Preserve what you have as soon as possible and provide it to the appropriate authorities when requested.
This checklist is intended for general awareness and does not replace professional legal advice or directions from investigating authorities.