Evidence checklist for credit card fraud cases

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 4 Nov 2026 · Digital evidence

Every card fraud case comes down to one factual dispute: did you authorise the transaction? Everything else, the amount, the merchant, the mode, is secondary. The evidence you gather is therefore not a general history of the fraud; it is a targeted set of records that answers that one question and fixes the dates on which you acted.

There is a second layer that victims miss entirely. Even a perfectly preserved record will not be read by a court unless it is admissible, and for electronic records admissibility runs through a certificate. Section 63 of the Bharatiya Sakshya Adhiniyam, 2023 governs the admissibility of electronic records, and section 63(4) requires a certificate to be submitted along with the electronic record at each time it is produced. That requirement, which was section 65B of the old Indian Evidence Act, 1872, is why the list below is organised around what you save and how you save it.

The two standards you have to satisfy

The bank and the court apply different tests to the same facts, and conflating them is a common error. The bank applies the Reserve Bank of India directions on limiting customer liability in unauthorised electronic banking transactions, in circular DBR.No.Leg.BC.78/09.07.005/2017-18 dated 6 July 2017. Those directions turn on when the issuer communicated the transaction to you and when you notified it, so the alert date and the complaint date are the decisive facts. The court, if a prosecution or a recovery suit follows, applies the ordinary law of evidence and asks whether the unauthorised use is proved and by whom it was committed.

What both need is the same thing: an unbroken record of dates. The checklist below is arranged from the day of the transaction forward.

The evidence checklist

1. The card statement for the disputed billing cycle, in full. Not one line highlighted, but the whole statement, so the context, the prior spending pattern and the disputed entries are all visible.
2. The transaction alerts, as originally received. The SMS in the message thread and the email in the mailbox, with the sender header, date and time intact. A forwarded copy is weaker than the original.
3. The bank's record of the disputed transactions. The transaction log showing the authorisation code, the merchant identifier, the entry mode, whether chip, contactless or card-not-present, and the amount and time of each entry.
4. Your written dispute to the issuer. The letter or dispute form in which you denied each transaction, with the date you sent it.
5. Every complaint reference number. The number from the bank, the number from 1930 or the national cyber crime portal, and the number of any police complaint.
6. The card block confirmation. Proof that you reported the card as compromised and the issuer blocked it, with the time.
7. Proof that you had the card, or were elsewhere. A location record, a ticket, an office attendance record, a purchase made with the same card moments later, or the physical card itself.
8. Communications with the merchant or the platform. The order confirmation, the delivery address, the consignee name for a fraudulent online purchase, and any response you received when you denied the sale.
9. Records of the contact that preceded the fraud. The phishing email with the full headers, the spoofed SMS, the number that called you, the website address, and any chat in which your details were sought.
10. The handset or device the fraud passed through. It is a communication device within the meaning of section 63 of the Bharatiya Sakshya Adhiniyam, 2023, and it may need to be produced in its original state.
11. Bank statements for the beneficiary account, if you have them. These are usually obtained by the investigating officer rather than by you, but any partial record you have should be preserved.
12. The certificate under section 63(4) of the Bharatiya Sakshya Adhiniyam, 2023 for each electronic record you intend to produce in court.

What each item proves, and how long it survives

Why the certificate matters more than the screenshot

The most common evidence mistake in card fraud cases is treating a screenshot as proof. A photograph of a phone showing an alert is a copy of a copy, and its authenticity can be challenged from several directions: the date is not verifiable from the image, the message thread can be edited, and the phone itself is the source. Section 63 of the Bharatiya Sakshya Adhiniyam, 2023 brings electronic records into the law of evidence, but section 63(4) makes the record admissible only when accompanied by the prescribed certificate. The certificate must identify the record and describe how it was produced, give particulars of the device involved, and deal with the conditions in the section, and it must be signed by the person in charge of the computer or communication device or the management of the relevant activity, and by an expert.

What that means in practice is simple. Keep the original on the original device. Produce the device or a properly certified copy, not a casual photograph. Where the record sits with the bank, such as the alert delivery log or the transaction log, ask the bank to furnish it, because the certificate must come from the person in charge of that system, and you cannot sign it yourself.

Do not clean the device

Almost everyone does the one thing that destroys the most useful evidence. They delete the messages, clear the call log, or restore the phone to factory settings after the fraud. Do not. The message thread, the caller identification, the timestamps and the application data are the raw material of the case. If you must hand the phone in, do so with the original messages intact and with the phone still functional, so that its storage can be examined if the court requires it.

The same logic applies to email. Do not forward the phishing message to a personal folder and delete the original. Keep the original in the original mailbox, which preserves the header information, including the sending server and the time stamps that a forensic examination relies on.

Evidence the bank holds and you must demand

Some of the most decisive items will never be in your hands. Ask for them in writing, and keep the request, because a bank that fails to produce its own log has created a fact you can rely on later. What to ask for is the alert delivery log showing the date the transaction was communicated to you, the complaint log showing when your dispute was received and by whom, the chargeback or retrieval record raised with the card network, and the fraud-monitoring notes on the account if any are recorded.

What weakens a case

• A dispute letter that gives a single aggregate figure instead of a transaction-wise denial.
• A claim that the card was in your possession that cannot be supported by anything independent.
• An admission that you shared a one-time password or a card verification value with a caller.
• A delay between the transaction and the first report, left unexplained in the file.
• Screenshots offered in place of the original records, particularly where the record could have been obtained from the bank.
• A phone that was reset, reformatted or replaced before any examination.

It is fair to say that the evidentiary position on a few questions is unsettled. Whether a bank's fraud-monitoring system should have detected an unusual pattern, and how much weight to give a card issuer's delivery log when the customer denies receiving the alert, are points on which courts and adjudicators have taken different views. None of that is within your control. What is within your control is whether the record shows that you denied the charge on a dated document, and whether the original electronic record still exists.

Filling the gaps with legal process

Certain items can only be obtained through legal process, and knowing that changes how you file. The transaction log at the network level, the subscriber and call records linked to a fraud number, and the CCTV footage at a terminal or an ATM are all in the hands of third parties who will release them to an investigating officer but not to a private complainant. The way to get them is to have them requisitioned by the investigating officer during investigation, or produced under an order of the court during the trial.

That is the practical reason to file the police complaint even where the bank route looks sufficient. The bank route produces money for the disputed transactions. The police route produces the records that identify a person. If the amount is significant enough to justify a recovery suit as well, the same records serve both, and our note on recovering money through a civil suit explains how that is sequenced. The behind-the-scenes sequence, from a preserved alert to a production order in court, is set out on our blog for victims who want to see the whole route at once.

When to involve a lawyer

Gathering evidence does not need a lawyer. Challenging its admissibility does, and the point at which admissibility becomes decisive is the point at which a case is actually before a court. Two situations justify advice earlier. The first is where the amount is large enough that the bank disputes liability under its board policy, because the file you built in the first week is then the whole case. The second is where a criminal case has been registered, either against the fraudster or against you, and the electronic records will be tested in cross-examination. On the first, a cyber crime lawyer in Kolkata can review the file and certify what is missing. On the second, timing and procedure matter, and the relevant guidance on criminal defence should be read before any statement is given. In either case, the first step is the same: keep the originals, and write down every date.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• Which police station handles credit card fraud in Kolkata
• What to do in the first 24 hours after credit card fraud
• Time limit to file a credit card fraud complaint
• Jurisdiction in credit card fraud cases: where to file
• Evidence checklist for UPI fraud cases in India
• Documents needed to file a credit card fraud complaint

Cyber crime lawyer in your city · Bank account freeze help · Contact