Business email compromise: evidence to preserve in 48 hours

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 3 Nov 2026 · Online fraud

A business email compromise is not primarily a hacking story; it is a deception story. Someone studies your organisation, impersonates a supplier, a director or a bank, and sends a message that looks routine. The payment leaves as an apparently ordinary transfer. By the time your accounts team notices, the money may already have moved through mule accounts in other states. What decides recovery is rarely the eloquence of your complaint; it is the email headers, the payment record and the exact sequence you preserved in the first 48 hours.

The legal character of the offence is cheating and, where a computer resource or a communication device is used, computer-related fraud. Section 318(4) of the Bharatiya Nyaya Sanhita 2023 covers cheating and the dishonest inducement of delivery of property. Section 316 covers criminal breach of trust where funds were entrusted to a person who then misappropriated them. Sections 66C and 66D of the Information Technology Act 2000 cover identity misuse and cheating by personation using a computer resource or communication device. Your evidence must connect three things: the impersonation, the instruction, and the transfer.

How the deception is actually built

Most business email compromises follow a recognisable arc. The fraudster first gathers names, designations, email formats and pending invoices from public sources, from a compromised mailbox at a supplier, or by registering a lookalike domain a few characters away from the genuine one. Next comes a low-stakes test message, often a harmless query that draws a reply and confirms that the address is live and monitored. Then the payload arrives: a revised bank account for a genuine-looking invoice, or a director instructing an urgent payment that must be kept confidential and completed before the close of business.

The timing is deliberate. The fraudster targets month-end, a long weekend or a period when the usual approver is travelling, because any break in the routine reduces scrutiny. The reply-to address often differs from the display name, which is why the raw header is the single most valuable piece of evidence you will hold. A forwarded copy loses the routing data that a court and a bank both need.

What the law says

Cheating that induces the delivery of property is punishable under section 318 of the BNS. Where the offender was entrusted with property in the course of business, section 316 may apply. Forgery of a document or electronic record for the purpose of cheating is dealt with under section 336. If the fraudster threatens or coerces you into sending more money, that conduct falls under section 351, criminal intimidation.

On the technology side, section 66 of the IT Act punishes computer-related offences generally; section 66C punishes identity theft, and section 66D punishes cheating by personation through a computer resource or communication device. Electronic records, including email, invoices and bank statements, are proved under section 63 of the Bharatiya Sakshya Adhiniyam 2023, which requires a certificate in the prescribed form and, in practice, the original device or a true copy kept free of editing.

On the banking side, the Reserve Bank of India directions on unauthorised electronic transactions require a bank to act promptly on a reported unauthorised transaction and to fix liability by reference to the customer contribution to the loss. A business email compromise sits in contested territory, because the transfer was executed from the customer own account after an induced instruction. The bank will often call it authorised; the victim answer is that an authorisation procured by deceit is not a true authorisation.

Why the first 48 hours matter more than the amount

Money moves in layers. The beneficiary account receives your transfer, then forwards it to a second and then a third account, sometimes across states or through a payment aggregator. Each hop reduces the chance of a clean freeze. A bank can freeze an account that still holds your funds; once the funds are withdrawn, a freeze only stops future movement. The practical window is the gap between the transfer and the withdrawal, and that gap is usually measured in hours, not days.

That is why preserving evidence and reporting must run in parallel, not one after the other. Preserving the evidence takes twenty minutes; calling the bank fraud line takes minutes more. Both should happen in the same hour you discover the fraud, and a written complaint should follow the same day.

Step-by-step: what to do, in order

1. Do not delete anything. Leave the fraudulent message, the thread and the attachments untouched, and do not reply to it.
2. Capture the full email headers of the suspicious message, not merely a screenshot. Headers show the sending IP, the routing and the reply-to address.
3. Save the payment instruction, the attachment and the beneficiary account details exactly as they appeared.
4. Call your bank fraud helpline at once and ask for the transaction to be placed on hold or the beneficiary account to be frozen. Note the complaint reference and the time of the call.
5. Report on cybercrime.gov.in and dial 1930, quoting the bank reference. The operator can relay a freeze request to the beneficiary bank nodal officer.
6. Preserve your own bank statement showing the debit, together with any internal approval trail within your company.
7. Write a chronological note of who did what, with timestamps, while the sequence is still fresh.
8. File a written complaint at the police station with jurisdiction, or a zero FIR under section 35 of the BNSS, attaching the evidence index.

Evidence checklist

Documents to attach to the complaint

A complaint moves faster when it is complete on the day it is filed. Attach a one-page timeline; the raw message with headers; the fraudulent invoice; the payment instruction; the bank statement showing the debit; the portal and 1930 acknowledgements; and, where a company is involved, the board or delegated authority under which the payment was approved. Where the email was sent or received from a device you control, keep that device available, because a section 63 certificate may later be required from the person who produced the record.

What decides the outcome

Three factors drive most outcomes. The first is the speed of the freeze: whether the beneficiary account still holds the funds when the freeze request lands. The second is the quality of the email evidence: headers showing a spoofed or lookalike domain are far stronger than a forwarded screenshot, which loses the routing data. The third is the internal trail, which shows that the payment followed the ordinary process of the company and that the company was deceived rather than reckless.

A bank may resist by arguing that the customer authorised the transfer, so the protections for unauthorised transactions do not apply. The answer is that authorisation induced by deception is not true authorisation, and the criminal law treats the conduct as cheating. This area remains genuinely contested, and the outcome turns on how a court weighs the carelessness of the customer against the sophistication of the deception.

Civil recovery alongside the criminal case

A criminal complaint addresses guilt; it does not, by itself, put money back into your account. Alongside the police case you can pursue the beneficiary bank and, in suitable cases, the fraudster for the loss. A court can order restitution within the criminal proceeding, and a civil suit for recovery remains possible where the parties and the trail can be identified. The two run on the same evidence, which is another reason to preserve it properly rather than in fragments. Where the real dispute is with a bank over liability rather than with the fraudster, the pleading shifts toward contract and negligence; our page on civil litigation explains that track.

If a supplier domain was spoofed or a mailbox was compromised

Two variants of the fraud look different but are proved the same way. In a spoofed-domain attack the email arrives from an address that resembles a real supplier but was never registered by them; the header shows the discrepancy and the reply-to reveals the fraudster inbox. In a compromised-mailbox attack the email genuinely comes from the supplier real account, because the supplier own mailbox was breached. Here your power is limited, but the supplier duty to disclose and the bank freeze powers are the same, and the thread is your best evidence that you were following the genuine relationship rather than a fake one.

Where a mailbox was compromised, ask the supplier in writing to preserve their mail server logs and the login history of the account, and to confirm in writing which messages they did and did not send. That written denial is powerful: it separates the genuine supplier from the fraudster and shows the bank that the alteration came from outside your company. Keep the exchange, because it becomes part of the evidence index you attach to the police complaint.

If your own mailbox was the one compromised, change the password, revoke active sessions and enable two-factor authentication the same day, then note the times of those changes. Those steps protect you going forward and show the investigators that the account is now secure, which matters because a fraudster who still holds access can delete the very evidence you are relying on.

If you are wrongly named

Not everyone caught in a business email compromise is a wrongdoer. A junior employee who released a payment under a plausible instruction may be named alongside the fraudster, and a mule account holder may be an innocent victim of identity misuse whose documents were used to open the account. If that is your position, preserve your own records, avoid deleting anything, and take advice before giving a statement. The difference between a deceived employee and a complicit one is decided on the internal trail and the timing of the disclosures.

Common mistakes

• Replying to the fraudulent email to confirm details, which tips off the fraudster and can accelerate the withdrawal.
• Sending only a screenshot instead of the raw message with headers.
• Waiting for an internal enquiry before calling the bank, burning the freeze window.
• Deleting follow-up messages from the fraudster, which often reveal further attempts and a pattern.
• Assuming the police will not act; a zero FIR can be filed at any station under section 35 of the BNSS.

When to involve a lawyer

A single transfer that is frozen quickly may not need legal help. But where the amount is large, where the bank refuses the freeze, or where the police are slow to register the complaint, a lawyer can draft the complaint and the section 63 certificate, pursue the bank nodal officer and press a restitution claim inside the criminal case. For the first report, our cyber crime lawyer in Kolkata page sets out how a complaint is built, and our cyber crime legal services page covers the representation side. Business email compromise is a race against the withdrawal: preserve the headers, call the bank, report to 1930, and file the complaint the same day.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• Hacking of email evidence to preserve in 48 hours
• Work from home scam evidence to preserve in first 48 hours
• UPI Fraud Evidence: What to Preserve in 48 Hours
• Trading app scam: the evidence to preserve in 48 hours
• Loan app harassment: evidence to preserve in 48 hours
• Electricity Bill Scam: Evidence to Preserve in 48 Hours

Cyber crime lawyer in your city · Bank account freeze help · Contact