Digital Evidence in a Cyber-Fraud Complaint
A businessman complains that BDT 8,00,000 was transferred from his bank account through six mobile-banking transactions he did not authorise. He received a phishing SMS the previous evening asking him to 'verify' his account by clicking a link, and he entered his PIN on a page that looked like his bank's. He reports the matter 36 hours later. The police station has one computer, no forensic toolkit, and two officers trained in cyber matters. The bank's local branch says it needs a written request from the police to share transaction logs. The complainant's phone is his only device and he uses it for business; he is reluctant to surrender it. The suspect's identity is unknown but the money appears to have been routed to three different mobile wallets.
1. Identify the evidence sources and the order in which they should be secured, with reasons for the priority.
Read the worked answer
Evidence degrades with time, so priority follows volatility.
Priority 1 - Bank and wallet records (fastest to lose, easiest to obtain). Send a written request to the bank branch and to the mobile-wallet operators for transaction logs, account-opening details (KYC), IP logs, and device identifiers for the six transactions and the three destination wallets. These records are held by third parties, are not under the complainant's control, and are the backbone of the case. Delay here lets the wallets be emptied.
Priority 2 - The phishing message and the link. Preserve the SMS, the sender ID, the URL, and the time received. Do not click the link again. Screenshot with visible timestamps and record the phone's model and number.
Priority 3 - The complainant's phone data. Call logs, SMS, browser history, and any app notifications. This can be extracted without permanently taking the phone: a forensic image made in the complainant's presence, or a documented manual examination with screenshots, is preferable to seizing a device he needs for business.
Priority 4 - The bank's internal fraud records and CCTV of any branch transaction, if relevant.
Priority 5 - Witness statements from the complainant and any person who saw him receive the message.
Each item must be entered in a seizure or production list with date, time, and the officer who obtained it.
2. The complainant refuses to surrender his phone. How should the officer balance investigative need against his rights and business hardship?
Read the worked answer
The phone is both evidence and a tool of his livelihood. The officer should not treat surrender as the only option.
Options in ascending order of intrusiveness:
- Documented on-device examination. Examine the phone in the complainant's presence, photograph each relevant screen with a timestamp, and record the examination in a seizure list signed by the complainant and an independent witness. Least intrusive, often sufficient for SMS and browser history.
- Forensic extraction with consent. Take a logical image of relevant data with his written consent, record the hash value, and return the phone the same day. The hash proves the image was not altered.
- Temporary seizure with a receipt. If extraction is impossible on site, seize the phone, give a detailed receipt listing the device, IMEI, and condition, and return it as soon as the extraction is done. Record why seizure was necessary.
- Retain only the SIM or a clone. Sometimes sufficient and far less disruptive.
Rights considerations: the examination must be limited to data relevant to the offence; unrelated business data should not be copied or disclosed. The complainant should be told what will be examined and why, and should sign the consent or the seizure record. If he refuses entirely, the officer should record the refusal and proceed with bank and wallet records, which may prove the fraud without the phone. Coercion is counterproductive: it turns a victim into a hostile witness.
3. The bank demands a written police request. Draft the essential contents of that request and explain the legal basis for seeking the records.
Read the worked answer
Legal basis: during investigation of a cognizable offence, the investigating officer may require the production of documents and electronic records relevant to the case, and may seek information from any person or institution believed to hold it. Banks and wallet operators are obliged to cooperate with a lawful written requisition. Non-compliance can be addressed through the court.
Essential contents of the request:
- Heading: station name, case number, date, and the section under which the case is registered.
- Officer identification: name, rank, badge, and contact details of the investigating officer.
- Subject: the complainant's name, account number, and the period covered.
- Specific records sought: transaction logs for the six disputed transactions; the IP address, device ID, and mobile number associated with each; the KYC and registration details of the three destination wallets; and any fraud-monitoring alerts.
- Time frame: the 36 hours before and after the transactions.
- Format: certified copies or electronic records with a statement of authenticity, and the name of the bank official who certifies them.
- Preservation request: a request that the records be preserved pending production, so that routine deletion does not destroy them.
- Confidentiality: a request that the complainant not be informed of the request where that could prejudice the investigation.
- Deadline and mode of production: a date and the manner of delivery, with a receipt to be obtained.
Keep a copy in the case diary and obtain an acknowledgement. The request should be precise enough that the bank cannot respond with a vague or partial disclosure.