Telegram investment scam evidence to preserve: 48-hour guide

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 3 Nov 2026 · Online fraud

A Telegram investment scam usually arrives as an invitation from a friend, a trading group or a self-styled mentor who posts profit screenshots. The money leaves through UPI, bank transfer or crypto within minutes. What decides whether you ever see it again is not the strength of your story but the quality of the record you preserve in the first 48 hours. Preserve the chat history, the payment proofs, the group and channel links, the UPI IDs and the wallet addresses before the scammer deletes the group or blocks you.

Indian law treats this conduct as cheating and, where an app or website is used, as computer-related fraud. The working provisions are section 318(4) of the Bharatiya Nyaya Sanhita 2023 for cheating, section 316 for criminal breach of trust where money was entrusted, and sections 66C and 66D of the Information Technology Act 2000 for identity misuse and cheating by personation through a computer resource. Your evidence must connect three things: the message that induced you, the account that received the money, and the transfer that moved it.

How a Telegram investment scam actually runs

Most groups follow a predictable script. A stranger adds you, or a contact forwards a link to a channel that looks professional. The channel posts daily profit claims, testimonials and screenshots of withdrawals. A small first deposit is returned with a bonus, which builds trust. Once you send a larger sum, the withdrawal is blocked behind a tax, a verification fee or an account upgrade. The group administrator then stops responding, removes you, or deletes the channel.

The accounts receiving your money are rarely in the scammer's own name. They are mule accounts opened with stolen or purchased identity documents, or crypto wallets controlled from outside India. That is why speed matters more than anger: a bank can freeze an account that still holds your money, but it cannot freeze money that has already been layered through five accounts.

Two features make the Telegram variant harder to investigate than an ordinary telephone scam. Accounts are disposable, so a channel can be abandoned for a new one within an hour and the numbers behind it are often virtual. Recruitment is also social, so victims share information, including screenshots of their own bank balances, that they would never give a cold caller.

• The recruitment phase: a direct message, a forwarded group link, or an advertisement in another channel.
• The proof phase: fabricated dashboards, fake withdrawal screenshots and small early payouts.
• The extraction phase: a large deposit followed by fees, taxes or a blocked withdrawal.
• The exit phase: deletion of the group, blocking of your number and removal of the channel.

Why mule accounts decide whether money is recoverable

A mule account is a bank account opened in one person's name but controlled by another, often using identity documents obtained fraudulently. Your money enters the mule account and is then split into smaller transfers or converted to crypto. Investigators may identify the account holder without reaching the person controlling it. This is why the first freeze request matters: it catches the funds while they are still in the first or second hop, before the layering is complete, and it flags the account so that later victims are not paid into the same one.

What the law says

Section 318(4) BNS covers dishonest inducement to deliver property, which is the core of an investment scam. Section 316 BNS applies where the money was handed over in trust and later misappropriated. Sections 66C and 66D of the IT Act 2000 cover the use of another person's identity and cheating by personation through a computer resource, and section 66 of the Act covers computer-related offences generally. Where obscene or morphed material is used to pressure you, sections 67 and 67B of the IT Act also become relevant.

Procedure matters as much as the section. A cognizable offence is registered under section 173 of the Bharatiya Nagarik Suraksha Sanhita 2023, and section 35 allows a zero FIR at any police station regardless of where the offence occurred. If the police refuse to register, section 175(3) BNSS lets you approach the magistrate, who can direct an investigation. Electronic records are proved under section 63 of the Bharatiya Sakshya Adhiniyam 2023, which requires a certificate in the prescribed form. RBI's directions on unauthorised electronic transactions govern how quickly a bank must act and how liability is shared.

Evidence to preserve in the first 48 hours

Do not tidy the chat. Do not delete the group in disgust. A complete, unedited record is stronger than a cleaned-up summary. The table below lists what to capture and why each item matters.

Where the scam ran through a broker app or a fake exchange website, also capture the URL, the login screen, the account dashboard and any deposit address shown to you. Where a Telegram bot confirmed your deposits or issued withdrawal instructions, capture the bot username and its messages. Each of these is a distinct digital footprint that an investigating officer can put to a service provider under the IT Act framework. Export the chat where Telegram allows it, but also keep screenshots with visible timestamps, and record a screen video scrolling slowly through the group, the profile, the payment messages and the withdrawal refusal. Send the whole set to your own email so that a device loss does not destroy the record. Preserve the original device: do not factory reset it, and do not uninstall Telegram until a forensic examination is completed or a lawyer advises otherwise.

Step-by-step: the first 48 hours

1. Stop all further payments. Do not pay the tax, verification fee or upgrade charge. Each additional transfer increases the loss and complicates tracing.
2. Call 1930 and file on cybercrime.gov.in. The national cyber crime helpline and portal create a formal record. Note the acknowledgement number and the date and time.
3. Inform your bank immediately. Ask for the transaction to be marked as unauthorised or fraudulent and request that the beneficiary account be frozen. Follow up in writing to the branch and the nodal officer.
4. Preserve the evidence set. Complete the table above before the group disappears. Keep the originals and make two backups.
5. File a written complaint at the police station. Attach the portal acknowledgement, the bank complaint and the evidence index. Ask for a receipt and, for a cognizable offence, a copy of the FIR under section 173 BNSS.
6. Write to the crypto exchange or wallet provider if any leg was in crypto, quoting the transaction hashes and asking for a hold on the receiving address.
7. Keep a chronology. A one-page dated timeline of every message, payment and refusal is the single most useful document you can hand to an investigator.

Where to file, and why jurisdiction matters

An offence that travels through several states creates a jurisdiction question. For most victims the practical answer is simple: file at the nearest police station and let the investigation follow the money. Section 35 BNSS permits a zero FIR, which is later transferred to the station with territorial jurisdiction. The National Cyber Crime Reporting Portal routes complaints to the appropriate unit, and the 1930 helpline creates a time-stamped record that supports the freeze request.

• Bank first: stops the bleeding and starts the dispute clock.
• 1930 or the portal: a national record plus routing to the right unit.
• Local police station: an FIR or a written complaint, whichever your case supports.
• Magistrate under section 175(3) BNSS: if the police decline to act.

If the beneficiary account is in another state, the investigating officer can seek assistance through the cyber crime coordination channels rather than requiring you to travel. Keep your own copies of every acknowledgement; they are the record a court will eventually read.

What decides the outcome

Recovery depends less on the amount than on where the money still sits. A transfer frozen within hours can be returned through the bank's dispute process. A transfer layered through mule accounts and converted to crypto is much harder to recover, though the trail can still support a prosecution. The quality of your evidence index, the speed of your first report and the accuracy of the beneficiary details are the factors that investigators and courts weigh most.

Two further factors are often overlooked. The first is whether you kept your own account secure: a victim who shared an OTP weakens the bank liability claim, though the criminal case is unaffected. The second is the honesty of your timeline. Investigations fail when a complainant changes the sequence of events between the portal, the bank and the police. Write the chronology once, verify it, and use the same version everywhere.

• Speed of reporting: the earlier the freeze request, the better the chance of holding funds.
• Precision of the beneficiary details: account number, IFSC, UPI handle and wallet address.
• Continuity of the record: unedited chats, visible timestamps and original devices.
• Consistency of your account: your statements to the bank, the portal and the police should match.
• Whether the group is still live: a live channel can be preserved and monitored; a deleted one cannot.

Mistakes that damage a Telegram scam case

The most common self-inflicted damage is deleting the group after being blocked. Others include editing screenshots, sending only selected messages, waiting for the scammer to refund before reporting, and paying the release fee. Do not confront the administrator with accusations before you have preserved the record; that merely warns them to delete it. Do not post the scammer's details on social media in a way that identifies innocent account holders whose identity was stolen for mule accounts.

Be careful what you sign. Some victims are approached by a so-called recovery agent who offers to retrieve the money for an upfront fee, or asks them to sign a settlement. Both are traps. Any offer to recover your loss for a fee, from someone you met online, is itself a second fraud.

• Deleting the chat or leaving the group before exporting it.
• Sending cropped screenshots without headers, timestamps or usernames.
• Filing only a social media complaint and no formal police or portal record.
• Continuing to pay release or tax charges.
• Resetting the phone or uninstalling the app before forensic examination.

When to involve a lawyer

A lawyer becomes useful when the bank denies liability, when the police station declines to register an FIR, or when the amount justifies a traced freeze and a restitution application. A cyber crime lawyer in Kolkata can prepare the evidence index, draft the section 175(3) BNSS application and coordinate with the bank's nodal officer. If your matter is in West Bengal, the state-focused cyber crime practice explains the local forum and filing sequence. Where the amount is significant, the case can also be pursued as a civil recovery against identifiable recipients, alongside the criminal complaint; the two tracks are not alternatives. For a first consultation, use the contact page. Do not wait for the group to vanish before taking the first step.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• Investment scam evidence to preserve in the first 48 hours
• Work from home scam evidence to preserve in first 48 hours
• Trading app scam: the evidence to preserve in 48 hours
• Electricity Bill Scam: Evidence to Preserve in 48 Hours
• AI voice cloning scam: evidence to preserve in 48 hours
• Mutual fund scam evidence to preserve in the first 48 hours

Cyber crime lawyer in your city · Bank account freeze help · Contact