Pig butchering scam: the evidence to preserve in 48 hours
By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 5 Nov 2026 · Digital evidence
To preserve evidence in a pig butchering scam within 48 hours, immediately screenshot all chat conversations, save bank transaction records, and export your crypto wallet addresses without altering any metadata. Section 63 of the BSA 2023 governs the admissibility of this electronic evidence in Indian courts.
In the first 48 hours after discovering a pig butchering scam, your priority is to secure digital evidence before the scammer deletes their profiles or moves the funds. Start by taking comprehensive screenshots of all communications, saving bank transaction records, and exporting your crypto wallet addresses. This evidence forms the bedrock of your criminal complaint and civil recovery efforts in India.
Courts require electronic evidence to meet the standards set under Section 63 of the Bharatiya Sakshya Adhiniyam (BSA) 2023. Without properly preserved evidence, your complaint may fail at the threshold. The scammer's digital footprint, including chat histories, transaction IDs and website links, is often the only way to trace the defrauded money. You must act quickly and methodically.
Why the first 48 hours decide the case
The first two days are a race against deletion. Scammers routinely wipe chat histories, close accounts and rotate wallet addresses once a victim stops paying. Platforms comply with preservation requests only when the police formally ask, and that request depends on the details you supply. Every hour you wait reduces the chance that the money is still sitting in a freezeable account.
Banks and payment aggregators can hold a beneficiary account only while the funds remain. In most pig butchering cases, the money is layered through several mule accounts within hours. If your complaint reaches the bank while the first layer still holds the funds, a freeze is possible. If it arrives after the layers have dispersed, recovery becomes a long investigation rather than a quick reversal.
What the law says
Section 63 of the BSA 2023 governs the admissibility of electronic records. It requires that electronic evidence be authenticated through a certificate signed by the person responsible for the device or the management of the relevant affairs. This section replaces the requirements under the Indian Evidence Act 1872. For pig butchering scams, the BSA 2023 allows screenshots and digital records to be presented as primary evidence if the certification requirements are met.
Under the Information Technology Act 2000, Section 66D penalises cheating by personation using computer resources. Section 66C penalises identity theft. These provisions require proof that the scammer used false identities or fraudulent platforms. The RBI's circular on unauthorised transactions emphasises the importance of timely reporting and evidence submission. If you provide clear evidence of the fraud within three working days, your bank may be liable to compensate you under the zero-liability framework.
Section 173 of the Bharatiya Nagarik Suraksha Sanhita (BNSS) 2023 mandates the police to register an FIR for cognisable offences based on the evidence you provide. Section 175(3) of the BNSS 2023 allows you to approach the Superintendent of Police if the police refuse to register the FIR. Section 482 of the BNSS 2023 preserves the High Court's inherent powers to direct a proper investigation when the police fail to act. The quality of your evidence directly influences the speed and effectiveness of the investigation.
Step-by-step evidence preservation
- Capture all chat conversations: Take screenshots of every message, including the scammer's profile information, phone numbers and timestamps. Do not crop or edit the images. If you are using WhatsApp or Telegram, export the chat history as a text file or PDF.
- Save bank transaction records: Download the bank statements showing the transfers to the scammer's account. Note the transaction IDs, dates, amounts and beneficiary account details. Request a formal statement from your bank if needed.
- Document crypto wallet addresses: If you transferred cryptocurrency, save the wallet addresses and transaction hashes. Use a blockchain explorer to capture screenshots of the transactions. Do not attempt to move the remaining funds without legal advice.
- Preserve the fraudulent website or app: Take screenshots of the investment platform, including the URL, login page and dashboard. If the website is still live, use a web archiving tool to create a permanent record. Do not interact with the platform further.
- Record all communications with the scammer: Save emails, SMS messages and call logs. If you had phone calls, note the dates, times and the phone numbers used. Do not delete any call records.
- Create a timeline of events: Write down a chronological account of how the scam unfolded. Include dates, amounts and the methods used by the scammer. This timeline will help the police and your lawyer understand the case quickly.
- Obtain a certificate under Section 63 of the BSA 2023: Prepare a certificate stating that the electronic records are authentic and were obtained from your devices. This certificate is mandatory for admissibility in court.
Evidence checklist
| Evidence type | How to preserve | Why it matters |
|---|---|---|
| Chat logs | Screenshots and exported text files | Proves the scammer's false promises |
| Bank statements | Downloaded PDFs and transaction IDs | Traces the money trail |
| Crypto transactions | Wallet addresses and blockchain explorer screenshots | Identifies the recipient wallets |
| Website screenshots | Full-page captures with URLs | Shows the fraudulent platform |
| Call logs | Saved call history and screenshots | Corroborates the scammer's contact |
| Timeline | Written chronological account | Helps investigators understand the fraud |
What decides the outcome
Courts assess the authenticity and integrity of the electronic evidence. If the screenshots are blurry, cropped or lack metadata, the defence may challenge their admissibility. The Section 63 certificate under the BSA 2023 is critical. Without it, the court may exclude the evidence entirely. The chain of custody also matters; you must show that the evidence has not been tampered with.
The completeness of the evidence is another factor. If you only provide partial chat logs, the court may draw adverse inferences. The bank's ability to trace the funds depends on the accuracy of the transaction details you provide. If the wallet addresses are incorrect or incomplete, asset tracing becomes difficult. The speed of preservation is also crucial; scammers often delete their profiles within hours of receiving the money.
The jurisdiction of the court also affects the outcome. If the scammer operates from another state or country, the investigation may require coordination with multiple agencies. The BNS 2023 and IT Act 2000 provide extraterritorial jurisdiction, but enforcement depends on international cooperation. Properly preserved evidence strengthens your case in both criminal and civil proceedings, and it gives the prosecution something concrete to work with.
Common mistakes
- Deleting chat logs after reporting: Never delete any communication. Even innocent messages can provide context for the investigation.
- Editing screenshots: Do not crop or enhance images. The court requires original, unaltered evidence. Editing can lead to allegations of tampering.
- Failing to obtain a Section 63 certificate: Without the certificate under the BSA 2023, the electronic evidence may be inadmissible. Always prepare the certificate.
- Interacting with the scammer after discovery: Do not confront the scammer. They may delete evidence or move the funds. Block them after preserving the evidence.
- Waiting too long to preserve evidence: The first 48 hours are critical. Scammers often erase their digital trails quickly. Act immediately.
Internal links
For a detailed guide on the legal process, read our blog on cyber crime complaints. If you need assistance with evidence preservation and filing, contact our legal team. We can help you prepare the Section 63 certificate and draft the FIR.
How to document crypto transactions properly
Crypto transfers are the hardest part of a pig butchering case, and they are also the part where victims most often lose the trail. When you send funds to a wallet address, save the full address, the transaction hash, the network used and the exact amount. Do not rely on a screenshot of a wallet app alone. Open a blockchain explorer, search for the transaction hash, and capture the page showing the sender, the receiver, the block number and the timestamp.
If the platform showed you a deposit address that changed with each transfer, save every address. Scammers often rotate addresses to frustrate tracing. A record of each address lets an investigator map the flow from your wallet to the receiving wallets. If the exchange or wallet provider you used has a transaction history export, download it as a CSV and keep it with your other records.
Do not move remaining funds without advice. Moving funds can destroy the link between your wallet and the scammer's wallet. If you hold assets on the same platform, stop using it and preserve the login records. A lawyer or a forensic accountant can advise on the safest way to secure remaining assets while keeping the evidentiary chain intact.
What not to do with the evidence
Do not annotate screenshots with arrows or comments. Do not merge multiple screenshots into a single image. Do not rename files in a way that hides the original timestamp. Courts and investigators prefer original files with metadata intact. If you need to explain a screenshot, do it in a separate written note rather than editing the image.
Do not send the only copy of your evidence to a police station and keep nothing. Always keep a duplicate. If you submit a device for forensic examination, back up the data first and record what was handed over. Keep a receipt for any device or document you give to the police.
Do not confront the scammer with the evidence. Confrontation gives the scammer time to delete accounts, change wallet addresses and warn accomplices. Preserve first, report second, and let the investigation handle the confrontation. This sequence protects both the evidence and your safety.
Coordinating with the cyber crime cell
Once your evidence is preserved, share it in an organised form rather than as a scatter of files. The cyber crime cell receives a large volume of complaints, and a clear bundle moves faster. Label each file by date and type, and attach a one-page index that lists what each file proves. If the investigating officer asks for the original device, hand it over only after backing it up and obtaining a written receipt.
Keep a copy of the acknowledgement number generated by the portal. Quote it in every follow-up letter to the bank, the police and the platform. A consistent reference number links your complaint across agencies and prevents the case from being reopened as a fresh complaint. If the scammer's profile is still live, report it to the platform as well and save the report confirmation.
When to involve a lawyer
If the amount involved is significant or the scam involves complex crypto transactions, involving a lawyer early is advisable. A lawyer can guide you on the precise evidence required, help you obtain the Section 63 certificate, and ensure that your FIR is drafted correctly. Legal intervention also helps in coordinating with the bank and the cyber crime cell. Do not wait until the evidence is lost; consult a lawyer within the first 48 hours.
Need help with a cyber crime matter?
Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.
Call +91-9007000603 WhatsAppFrequently asked questions
What is the most important evidence to preserve in a pig butchering scam?
The most important evidence is the chat logs showing the scammer's false promises and the bank transaction records showing the money transfers. These establish the deception and the money trail. Crypto wallet addresses and transaction hashes are equally critical because they allow investigators to trace funds across wallets.
How do I preserve WhatsApp chats for a legal case?
Export the chat history as a text file or PDF using WhatsApp's export feature. Take screenshots of the scammer's profile and the messages. Do not delete the chat. Store the exported files in multiple locations. Section 63 of the BSA 2023 requires a certificate for admissibility.
What is the Section 63 certificate under the BSA 2023?
Section 63 of the BSA 2023 requires a certificate to authenticate electronic evidence. The certificate must be signed by the person responsible for the device or the management of the relevant affairs. It confirms that the electronic record is authentic and has not been tampered with. Without it, the court may exclude the evidence.
Can I use screenshots as evidence in an Indian court?
Yes, screenshots can be used as electronic evidence under the BSA 2023. However, they must be accompanied by a Section 63 certificate. The court may also require the original device to verify authenticity. Unedited and complete screenshots, with timestamps intact, are far more reliable than cropped or annotated images.
How long should I keep the evidence of a pig butchering scam?
Keep the evidence until the criminal case and any civil proceedings are fully concluded. This could take several years. Store the evidence in multiple secure locations, including cloud storage and physical backups. Do not delete any evidence, even if the case appears to be closed or the scammer has disappeared.
What should I do if the scammer deletes their profile?
If the scammer deletes their profile, your preserved screenshots and exported chats become even more critical. Report the deletion to the cyber crime cell. The police can request the platform to retrieve deleted data. Your timeline of events helps establish the scammer's identity and the sequence of the fraud.
Can I record a phone call with the scammer as evidence?
You can record a phone call with the scammer, but admissibility depends on the circumstances. In India, recording a conversation without consent is treated cautiously by courts. Consult a lawyer before relying on such a recording in a criminal complaint. A recording made openly and lawfully is more likely to be accepted.
Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.
Related articles
Cyber crime lawyer in your city · Bank account freeze help · Contact