Electronic Evidence in Banking Fraud Cases: Collection and Admissibility

When a customer disputes a fraudulent debit, the bank's defence rests on evidence, not opinion. Electronic evidence in banking fraud cases decides whether a disputed transaction stands up before a court, the Banking Ombudsman, or a police cyber cell. Staff who handle CCTV footage, ATM logs, or SMS alerts without the right procedure can turn strong proof into worthless paper. This article explains how to collect, certify, and preserve electronic evidence in banking fraud cases so it survives legal scrutiny.

📜 The Certificate Requirement for Electronic Records

India's evidence law was recast in 2024. The Bharatiya Sakshya Adhiniyam, 2023 (BSA) replaced the Indian Evidence Act, 1872. The new law carries forward a rule every banker must know: a computer-generated record needs a signed certificate before a court will admit it. This requirement was earlier found under section 65B of the 1872 Act, and the BSA preserves the same underlying principle for electronic and digital records.

The certificate must describe the device that produced the record, confirm the record was generated during ordinary business activity, and confirm no unauthorised change occurred. A responsible bank officer, usually someone who manages the system in question, signs it. Without this certificate, a printout of a core banking log or a CCTV still is just paper. Courts routinely reject unsigned or vague certificates, even when the underlying data is accurate.

This is why banks train branch and IT staff together. A fraud investigation that starts well but skips the certificate step collapses at trial. The Computer Fraud Protection chapter covers this certification workflow in more depth, including who within the bank is authorised to sign.

💡 Exam Tip: Remember that the certificate requirement is about the process of generating the record, not the content of the record itself.

🔗 Chain of Custody: From Server to Court

Chain of custody means an unbroken, documented trail from the moment evidence is collected to the moment it is produced in court. Every person who touches the evidence, and every action taken on it, must be logged. A gap in this trail lets the opposing side argue the record was altered.

Good practice starts with identifying the exact source: a specific ATM, switch, or server. The investigator then makes a forensic copy, never working on the original. A cryptographic hash value is calculated and recorded at the point of collection, so any later change to the file is instantly detectable. Every handover between officers, forensic teams, or the police is logged with date, time, and signature.

Storage matters as much as collection. Copies sit in tamper-evident storage with restricted access, and the original device or drive is sealed wherever possible. Banks that skip this discipline often find their own IT team unable to explain, months later, who accessed a disputed log and when.

⚠️ Common Mistake: Investigators open the original file to "just check" the content, and that single action can break the chain of custody.

📹 Preserving CCTV, ATM and Switch Logs

CCTV footage, ATM transaction logs, and switch logs are the backbone of most banking fraud investigations. Switch logs record every card transaction as it passes through the payment network, and they often show details the customer-facing statement does not.

Most banks retain ATM CCTV footage and switch logs for a fixed minimum period under RBI guidance, commonly cited as around ninety days. That default period is not enough once a dispute is raised. The moment a complaint is logged, the bank must issue an internal preservation instruction so the specific footage and logs tied to that transaction are held indefinitely, separate from the routine overwrite cycle.

Audit trails and system-generated records inside the core banking system matter just as much. These logs show login timestamps, IP addresses, and every field an operator changed. Fraud investigators cross-reference switch logs, CCTV timestamps, and audit trails to build a single timeline. Any mismatch between these sources, such as a transaction logged on the switch but missing from the audit trail, becomes a lead worth chasing. The Electronic Card Frauds chapter walks through how switch and card logs are read during an investigation.

📌 Remember: Once a dispute is logged, standard retention periods no longer apply to that specific record.

🚨 Preservation Notices and Coordination with Police, CERT-In

Once a bank confirms a transaction is fraudulent, it must move fast on two fronts: preserving evidence and reporting the incident. A preservation notice, often called a litigation hold, goes out to every internal team holding relevant data, so nothing is deleted on a routine schedule. The same notice may go to a payment gateway, telecom operator, or another bank if the fraud touched their systems.

Significant cyber security incidents also require reporting to CERT-In, the national nodal agency for responding to computer security incidents. Banks report qualifying incidents within the prescribed timeline and follow up with any additional detail CERT-In requests. This reporting duty runs alongside, not instead of, the bank's internal investigation.

Coordination with the police cyber cell usually follows once the bank has assembled its certified electronic records. A clear, well-indexed evidence package, complete with certificates and chain-of-custody logs, speeds up the FIR process and improves the odds of tracing the money before it moves further. The Incident Management chapter sets out the full escalation sequence banks follow after detection.

Handled well, this stage also protects genuine customers. A bank that can show it preserved and reported evidence correctly is in a far stronger position when a customer liability dispute reaches the Banking Ombudsman.

The table below summarises how common evidence sources differ in retention, certification, and the trigger for special preservation.

🧠 Practice MCQs: Electronic Evidence in Banking Fraud Cases

Want chapter-wise mock tests with 100+ MCQs? Start practising free →

❓ Frequently Asked Questions

🎯 Building an Evidence-Ready Fraud Response

Electronic evidence in banking fraud cases only holds up when three things happen together: a valid certificate, an unbroken chain of custody, and timely preservation before logs are overwritten. Bank staff who understand all three protect the institution and genuine customers alike.

Study the certificate rule, the retention windows, and the CERT-In reporting duty together, since exam questions often test how these pieces connect. Revisit the Computer Fraud Protection and Incident Management chapters together, and pair this topic with related reading on channels of cyber crime in banking, the RBI cybersecurity framework for banks, and the digital arrest scam mechanics, since all three feed into how a bank builds its evidence file. For a broader view of how staff readiness supports this work, see our note on information security awareness training in banks. Browse more chapters in the Prevention of Cyber Crime tag hub to revise the full topic list.

Ready to test yourself? Take a free chapter-wise mock test and see how well you can apply these rules under exam conditions.