Home › Legal Articles › Digital evidence

Evidence checklist for UPI fraud cases in India

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 4 Nov 2026 · Digital evidence

A UPI fraud case is proved with two sets of records: what shows the money moved, and what shows you were made to move it. The first is bank and payment-system data. The second is your phone. Both are electronic, and both need the certification that the Bharatiya Sakshya Adhiniyam, 2023 requires before a court will look at them.

Most UPI fraud cases are not lost because the fraud did not happen. They are lost because the record of it was never secured in a form a court can use. The evidence in these cases is almost entirely electronic - bank statements, payment application logs, call records, chat threads, screenshots - and electronic records are admissible only on the conditions and with the certificate that section 63 of the Bharatiya Sakshya Adhiniyam, 2023 prescribes. Knowing that before you start collecting changes what you collect.

There is also a division of labour that victims do not always appreciate. Some records are yours and must be preserved by you, because nobody else can produce them and a later reconstruction is worthless. Other records - the beneficiary account's transaction history, the account-opening documents, the call data records, the internet protocol logs - cannot be obtained by you at all; they come to the investigating officer through the powers the BNSS gives the police. A credible case has both: your records showing what you saw, and the police records showing what the money did.

The two things your evidence has to prove

Everything you collect should be doing one of two jobs.

That the money moved. The debit, the amount, the date and time, the beneficiary, and the identity of the transaction in the banking system so that the trail can be followed.
That you were induced to authorise it. The deception - a false promise, an impersonation, a fake payment request, a job or investment offer, a threat. This is the element that separates a fraud from an ordinary payment dispute, and it is what the offences of cheating, cheating by personation and identity theft under the Bharatiya Nyaya Sanhita, 2023 and the Information Technology Act, 2000 are built on.
That you reported it. Not strictly part of the offence, but it decides the bank's liability and it kills the argument that you accepted the loss.

The checklist, in the order it will be asked for

1. The transaction itself

The bank statement for the whole month, not just the day, downloaded as a PDF from net banking or collected as a stamped copy from the branch. The UPI transaction identifier shown in the payment application, together with the reference the bank used, because these are different numbers and the investigating officer will ask for whichever one the bank's records carry. The bank's alert - SMS or email - for that debit, retained because it fixes the time at which the bank communicated the unauthorised transaction to you. If the funds were routed onward, note the entries that show it.

2. The deception

The chat thread, SMS, email or social media message in which the inducement came; the caller's number and the call timings from your phone's call log; the link you were sent; the name and description of any application you were asked to install; and the screen of any payment request you approved. Where you recorded the call, keep the recording in its original file. Where the inducement came through an advertisement or a listing, keep the page as a saved copy with the address shown, not merely a screenshot of the text.

3. Identity, and the accounts in the chain

Your own identity and account details as the person entitled to complain, in masked form where accepted. The beneficiary details exactly as they appear - the virtual payment address, the account name shown, the bank name if displayed. If you have any record of a person who introduced the transaction, a name, a photograph or a number used in the conversation, include it, but state precisely what you know and how you know it. An over-stated identification is worse than none.

4. The record of your complaints

Every reference number you have generated: the bank's complaint number and acknowledgement, the 1930 call reference, the acknowledgement on the National Cyber Crime Reporting Portal, any email to the bank's nodal officer with the sent mail kept, and the FIR or Zero FIR number. These records show the sequence and the speed of your response, which is what the RBI directions on unauthorised electronic transactions measure liability by.

What only the police can obtain

Do not waste weeks trying to collect what is not yours to collect. The following come through the investigating officer, generally by way of a written request to a bank, a payment system participant, a telecom operator or a platform:

The transaction history, beneficiary details and account-opening record of the receiving account.
The complete trail of the funds across accounts, including the entries that show where they were withdrawn or moved.
Call data records for the numbers used against you.
Internet protocol logs and device identifiers from the platforms used, obtained under the IT Act 2000's framework for intermediaries and production powers.
Forensic examination of a seized device, and the examiner's report.

Platforms and banks process personal data under the Digital Personal Data Protection Act, 2023 and are answerable for how they handle it, but that legislation does not give or take away a victim's right to their own records, and it does not substitute for a lawful request or an order.

One practical note about asking for records. Keep the request narrow and dated. An officer who is asked for everything at once will get nothing at once. A request that names one account number, one transaction reference and one date can be answered by a bank within days, and each answered request strengthens the next. Where the material requires a court order, ask for that in writing too, so that the file shows the material was sought rather than forgotten.

The certificate that makes electronic evidence admissible

This is the part most victims have never heard of, and the part that quietly decides cases. Under section 63 of the Bharatiya Sakshya Adhiniyam, 2023, information contained in an electronic record is treated as a document and is admissible without further proof or production of the original only if the conditions in the section are satisfied. Section 63(4) then requires a certificate, submitted along with the record at each instance it is being submitted for admission, which identifies the record and describes how it was produced, gives particulars of the device involved, and deals with the matters in the conditions - and which purports to be signed by the person in charge of the computer or device or of the relevant activities, and by an expert. The Schedule to the Act sets out the format, with the party's part and the expert's part, and provides for device identifiers, hash values and a hash report.

Three consequences follow for an ordinary victim. First, a screenshot is a copy of an electronic record, not the record itself, and it is the record that has to be certified. Second, for your own phone, you are usually the person in charge of the device, so you are the one who signs - which is why it matters that you still have the device and can describe it accurately. Third, the requirement is not always applied with the same rigour at every stage, and parties sometimes supply the certificate later in the proceedings; the safe course is to have it ready at every stage, because a court that insists on it will not wait.

What to preserve in the first 48 hours

Do not reset, restore or replace the device on which the conversation happened.
Do not delete, archive or clear the chat thread, and do not uninstall the application you were induced to install.
Take screenshots that show the number or handle, the date and the message in one frame where possible.
Export the chat with media if the application provides the option, and keep the exported file unedited.
Download the bank statement and the alert, and store both on a second device or in cloud storage.
Write a dated note of what happened, in your own words, while the sequence is fresh. It is not evidence in itself, but it is what keeps your instructions to the investigator and your evidence consistent months later.

How each piece of evidence is tested

Record	Who can certify or produce it	Typical pitfall
Screenshots from your phone	You, as the person in charge of the device	No visible date, number or amount; or the device having been reset since
Bank statement or payment record	Your bank, through its authorised officer	A single-day statement that hides the surrounding entries and the onward movement
Application transaction log	The payment application or the bank	Application data lost to an update or a device change
Chat export or message thread	You, from the original device or account	A partial export, or a thread already edited or trimmed
Call recording	You, with the original file unaltered	Poor clarity, or a copy that cannot be shown to be the original
Email from the fraudster	You, and the service provider if headers are needed	Forwarding instead of retaining the original message with its headers

Note where that table puts you and where it puts the bank. Your side of it is proof of deception; the bank's side is proof of movement and destination. A case that has only the deception attracts sympathy and produces no recovery, and a case that has only the movement produces a genuine dispute about who authorised what.

Common mistakes in UPI fraud evidence

Sending only screenshots to the police and keeping the original thread on a phone that is then wiped.
Collecting the statement for one day, so nothing shows where the money went next.
Copying a transaction reference by hand from a screenshot, with a character wrong.
Recording a call only after the fraud is suspected, when the inducement is already over.
Storing everything on the same phone that holds the evidence, with no copy anywhere else.
Overstating an identification - naming a person as the fraudster when the only link is that their account received the money, which is often a mule account and not the mind behind the fraud.
Waiting for the certificate question to arise in court before locating the device whose record it certifies.

When to involve a lawyer

Collecting and preserving records is something a careful complainant can do alone, and the checklist above is written to be used that way. A lawyer becomes necessary when the records have to be converted into admissible form: preparing the certificate under section 63(4) of the Bharatiya Sakshya Adhiniyam, 2023, taking out the production of records that the police have not asked for, protecting a device that the accused or a bank is disputing, or answering a case in which a person whose account received the money is claiming to be a victim himself. In the last of those, the same evidence set is being read in two directions, and the certification and the chain of custody have to be handled properly from the beginning. A cyber crime lawyer in Kolkata can take the evidence file from collection to court, and where an innocent account holder has been implicated, the defence side of the same question is dealt with at criminal defence.

Need help with a cyber crime matter?

Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.

Call +91-9007000603 WhatsApp

Frequently asked questions

What evidence do I need for a UPI fraud case?

You need records of the transaction and records of the deception. The first set is the bank statement, the UPI transaction identifier and the bank's alert. The second is the chat, call log, link or payment request that induced the transfer. Add every complaint reference number. Records that the police must obtain separately are the beneficiary account details, call records and the onward fund trail.

Are screenshots enough as evidence in a UPI fraud case?

Screenshots alone are usually not enough. A screenshot is a copy of an electronic record, and under section 63 of the Bharatiya Sakshya Adhiniyam, 2023 the electronic record itself must be admissible on the conditions in that section, with a certificate under section 63(4). Keep the original device and the unaltered thread, and use screenshots only as a supporting copy.

What is a BSA 63(4) certificate?

It is the certificate required by section 63(4) of the Bharatiya Sakshya Adhiniyam, 2023 for an electronic record to be given in evidence. It identifies the record and describes how it was produced, gives particulars of the device, and addresses the conditions in the section, and it must be signed by the person in charge of the device or the relevant activity and by an expert.

Who signs the certificate for the evidence on my own phone?

You do, as the person in charge of the device, along with the expert's part required by the statute. That is precisely why the device must be preserved: the certificate describes the device involved in producing the record, and a phone that has been reset or replaced makes that description impossible to give honestly. Keep the original phone until the case ends.

Should I delete the fraud chat after reporting the UPI fraud?

No. Deleting the thread, clearing the application data or resetting the phone removes the original electronic record and leaves only screenshots, which are copies. Even after the police have seen the messages, the original record may be required in court, and a court that asks for the certified original when only a copy exists is a problem that no explanation repairs afterwards.

Can the police get bank records and call records that I cannot?

Yes. The beneficiary account's transaction history and account-opening records, the onward fund trail, call data records, and platform logs are obtained by the investigating officer through written requests and orders to the bank, telecom operator or platform. A victim has no power to requisition them, which is why an early and properly registered police complaint matters more than a large private file.

How long do phone operators keep call records?

Call detail records are retained only for a limited period and are then discarded, which is why the police request them early in an investigation. The exact retention period is a matter of the applicable licence conditions and the operator's practice rather than a single figure a complainant can rely on. The practical rule is that a call-based fraud should be reported within days, not months.

What if my UPI fraud evidence is on a phone that was stolen or replaced?

Recover what you can from a backup, a linked device or the service provider, and state the loss of the device plainly in your complaint. Bank records, the payment application's own logs and message backups may still exist independently of the device. The missing device weakens the certification of your own screenshots, so the case should lean more heavily on the bank and platform records.

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Cyber crime lawyer in your city · Bank account freeze help · Contact