You were added to a WhatsApp group called something like "NSE VIP Premium Tips — Mr Mehta" or got a personal message from a woman whose display picture said she worked at a brand-name brokerage. The first few stock tips actually worked. Then she — or he — invited you to download a "private trading app" because the regular ones supposedly did not allow access to "institutional pre-IPO allocations." The dashboard showed your money growing every day. When you asked to withdraw, the screen said you had to pay a "tax" or "membership upgrade fee." Then the contact stopped replying. The app stopped opening. And you sat staring at a phone full of messages and a bank balance that was much smaller than it had been a week ago.
The next instinct is to delete the app, block the contact, and go to the police. Stop. Do not delete a single thing yet. The next 30 minutes are not about complaining — they are about preserving evidence so that, six months from now, the case actually holds up at trial.
How the WhatsApp Trading Pitch Arrives
The pattern repeats across thousands of cases. A friendly stranger messages you on Instagram, Facebook or LinkedIn, often a young woman with curated photos. She moves the chat to WhatsApp. She is "running a SEBI-registered group" or "her uncle is a fund manager." She sends a few real intra-day calls that work, building credibility. Then a "broker" or "celebrity tipster" account joins, supposedly the source of these tips. You are added to a WhatsApp group with hundreds of members posting screenshots of profits.
The next step is the install — a private trading app via APK, or a browser-based "trading platform" with a slick UI. Your money does not actually go into any market. It goes to a beneficiary UPI handle or bank account that the "broker" gives you. The dashboard is a database controlled by the fraudster. Your "profits" are numbers on the screen. The withdrawal block is just code. And when you finally figure it out, the broker disappears, the group is wound up, and the app's URL stops resolving.
Every step of this fraud lives on your phone — in WhatsApp, in your screenshots, in the bank app, in your gallery. That phone is now the most important piece of evidence in your case.
Why Evidence Comes Before the Complaint
Police officers and even some lawyers will tell you to "go and file an FIR first." Hear them out, but do this in a smart sequence. Once you formally complain, the scammer often gets a tip-off (sometimes from their own bank's notification system) and immediately wipes the WhatsApp account, deletes the group, takes down the app and runs the money through layered transfers. Anything you did not preserve before that moment is usually lost forever.
The Indian Evidence Act commentary, citing Anvar PV v PK Basheer (AIR 2015 SC 180), states the principle plainly: "electronic records being more susceptible to tampering, alteration, transposition, excision, etc." need to be carefully preserved and certified. A chat that has been deleted from WhatsApp's servers and from your phone cannot be re-created by any court order. So a clean, dated copy preserved by you is the only thing that works at trial.
Spending one extra hour to preserve before complaining does not delay justice. It is what makes justice possible.
The Full WhatsApp Chat Export — Step By Step
The most important single asset is the WhatsApp chat export. Do this before taking any other step.
- Open WhatsApp and open the chat with the scammer (or the WhatsApp group).
- Tap the contact or group name at the top to open the info screen.
- Scroll down to "Export Chat" and choose "Include Media."
- Save the resulting ZIP file to your phone storage and email it to yourself.
- Repeat for every relevant chat — the original "friendly stranger," the WhatsApp group, the "support" number that asked for a tax fee.
Each export contains a text transcript with timestamps and a separate folder of all media. This bundle preserves voice notes, photos, payment receipts the scammer sent you, and the exact text that constituted dishonest inducement. Section 415 of the Indian Penal Code defines cheating as deceiving a person and dishonestly inducing them to deliver property — your chat export is the inducement, in writing.
Do not delete the chat from your phone after export. Do not block the contact yet either. Blocking can sometimes hide future messages that may itself be useful evidence. Just keep one phone aside, do not factory-reset it, and store it safely.
Screenshots and Screen Recordings of the Fake App
The chat export covers messages. The fake trading app needs separate handling, because most apps are not visible inside the chat.
Open the trading app. Use your phone's built-in screen recorder and walk through the entire flow on camera — login screen, portfolio page showing the inflated balance, deposit history, withdrawal screen, and the moment a withdrawal is blocked or asks for a fee. Save this recording. Note the date and time. If the app is actually a website, save the URL and take a full-page screenshot, plus open it on a desktop browser and use "Print to PDF" to capture the entire page.
Screenshots to take, in addition to the recording:
- The contact's WhatsApp profile screen showing display picture, "About" line and phone number.
- The WhatsApp group info — name, description, admin handles, member count.
- Each payment confirmation page in your bank app or UPI app, showing the beneficiary handle, account number, IFSC, transaction reference and date-time stamp.
- The fake dashboard showing your balance, supposed profits, and the day-by-day growth.
- The error message or fee demand that appeared when you tried to withdraw.
- Any verification badges, certificates or "SEBI registration" PDFs the scammer sent — these are usually forged and may attract Sections 467, 468 and 471 IPC for forgery in addition to cheating.
The IT Act commentary on Section 66D explains why this matters: cheating "by personating using computer resource" is exactly the offence — and the screenshots are the proof of the personation, the device used, and the monetary harm.
The Money Trail — Transactions and Beneficiary IDs
Independent of the chats, build a clean money log. This is the document the bank's fraud team and the investigating officer will lean on the hardest.
From your bank statement, extract every debit relating to the scam. For each, record:
- Date and time of the debit.
- Amount.
- Mode (UPI / IMPS / NEFT / card).
- Beneficiary UPI handle or account number and IFSC.
- Transaction reference number / UTR.
- The chat message that prompted that transfer (cross-reference by date-time).
Save the official bank statement as a PDF (most banks let you download statements with digital signatures). Get the bank to email a written acknowledgement that you have flagged these transactions as fraudulent. This bank-side documentation will eventually pair up with the police's request under Section 91 BNSS / Section 91 CrPC for KYC details and CCTV of the receiving accounts.
Section 65B Evidence Act — The Certificate That Holds It All Together
Now to the part most victims have never heard of. Section 65B of the Indian Evidence Act, 1872 governs the admissibility of every electronic record produced in court. The Evidence Act commentary, drawing on Anvar PV v PK Basheer (AIR 2015 SC 180), lays out the position bluntly:
"An electronic record by way of secondary evidence shall not be admitted in evidence unless the requirements under Section 65B are satisfied... in the case of CD, VCD, chip, etc., the same shall be accompanied by the certificate in terms of Section 65B obtained at the time of taking the document, without which, the secondary evidence pertaining to that electronic record, is inadmissible."
In plain language: a screenshot, a chat export, a screen recording, a downloaded PDF — all of these are "secondary evidence" of the original electronic record sitting on a server somewhere. To use them in court, they must come with a Section 65B certificate.
The certificate is a short written statement, signed by the person responsible for the device, confirming:
- The computer or phone produced the output during regular use.
- The relevant information was regularly fed into it.
- The device was operating properly during the relevant period.
- The information in the print-out / file is a true reproduction of what is on the device.
Your lawyer drafts the certificate. Your job is to keep the original device — the phone you used, untouched, factory-reset-free — until trial. The case of Tomaso Bruno v State of UP (2015) 7 SCC 17 reinforced this point: courts treat electronic evidence seriously, but only when the chain of custody and the certificate are clean. Building a strong cheating and fraud file is largely about getting this part right.
Hash Values, Notarisation and the Affidavit Route
Beyond the Section 65B certificate, two extra layers help in practice — hash values and a sworn affidavit.
A hash value is a digital fingerprint of a file, calculated using algorithms like SHA-256. If even one byte of the file changes, the hash changes too. If you (or your lawyer or a forensic expert) generate a SHA-256 hash of each preserved file on Day 1 and record those hashes in a written log, you can later prove that the files produced in court are identical to the ones preserved at the time of the offence. This makes it almost impossible for the accused to argue you tampered with the chats.
An affidavit sworn before a notary or oath commissioner, listing each file you preserved with its description, date of capture and hash value, is an additional layer of credibility. Some lawyers also notarise paper printouts of the most important screenshots and chat extracts. None of this replaces the Section 65B certificate, but together they make your evidence harder to attack at trial. For larger losses, the time and money spent on this layered approach is worth it.
Which Laws Will the Police Use?
Once your evidence is preserved, the FIR usually combines:
- Section 66D, IT Act 2000 — cheating by personation by using a computer resource or communication device. Up to three years' imprisonment, fine up to one lakh rupees. Directly fits a fake broker on WhatsApp.
- Section 420, IPC (Section 318 BNS, 2023) — cheating and dishonestly inducing delivery of property. The heavier provision covering the actual money you transferred.
- Section 66C, IT Act — fraudulent or dishonest use of any identity feature of another person, when the scammer used a real broker's photo, name or registration number.
- Sections 467 / 468 / 471, IPC — forgery and use of forged documents, when fake SEBI certificates or fake bank statements were sent to you.
- Section 43 read with Section 66 of the IT Act — when the fake trading app accessed or manipulated computer resources without permission.
The base concept of cheating is in Section 415 IPC. The case of Hridya Rajan Pd. Verma v State of Bihar (AIR 2000) clarifies that the dishonest intent must exist from the start of the transaction — and in a WhatsApp trading scam, the entire design is dishonest from message one. There is no honest broker who later went bad.
What Should I Actually Do Now?
- Stop. Do not delete or block yet. The block can come later. First, preserve.
- Export the WhatsApp chat with media for every relevant contact and group. Save to phone and email.
- Screen-record the fake trading app and take screenshots of every key screen.
- Build the money log — date, amount, beneficiary, UTR, mode, and the chat message that triggered each transfer.
- Email all preserved files to yourself from your phone. The email timestamp is independent corroboration.
- Call 1930 (the cyber-fraud helpline) and file a complaint at cybercrime.gov.in. Speed protects what little may still be in the receiving account.
- Call your bank, flag the transactions and ask for written acknowledgement of the dispute.
- File the FIR at any police station — zero-FIR works for cyber offences. Ask for a copy of the FIR with the FIR number.
- Get a Section 65B certificate drafted by a lawyer for each batch of preserved files. Keep the original phone untouched and stored safely.
- Consider an affidavit listing each file with its hash value, sworn before a notary, especially if the loss is significant. For Delhi-based victims, the cyber-fraud team at Pinaka Legal can structure your evidence file from this stage onward and brief the investigating officer on which sections to apply.
A Calmer Thought to End With
WhatsApp trading scams are designed to defeat exactly the careful, intelligent person you are. The friendly stranger, the slow build of trust, the small early wins, the slick app — none of that is your imagination. It is the playbook. Falling for a playbook does not make you stupid. Failing to preserve evidence afterwards is what makes recovery and prosecution harder.
Do the slow, boring work in the right order — preserve, then complain, then pursue. The criminal process moves at its own pace. The bank fraud framework moves at its own pace. Recovery, when it comes, is partial more often than full. But a properly preserved file with a Section 65B certificate is the difference between an FIR that goes somewhere and an FIR that quietly dies in a thana drawer. Build the file first. Everything else flows from there.
Frequently Asked Questions
What is the very first thing to save in a whatsapp trading scam?
The full WhatsApp chat. Open WhatsApp, go into the chat with the fake broker or the WhatsApp 'tip group', tap the contact name, scroll down and use 'Export Chat — include media'. Save the resulting ZIP to your phone storage and email a copy to yourself. Do this before you do anything that could push the scammer to delete the conversation. The export is the single most important piece of evidence in a whatsapp trading scam, because it preserves text, voice notes and timestamps in one bundle.
Should I save screenshots even if I have the chat export?
Yes. Screenshots and the export do different jobs. The export preserves the chat record. Screenshots preserve what the screen actually looked like — the green tick of a UPI payment, the fake trading dashboard, the contact's verified-looking display picture. Screenshots are easier for a non-technical police officer or judge to read at first glance. Take screenshots of the chat, the contact info screen, the fake app dashboard and every payment confirmation. Together, the export and the screenshots cover both legal and human readability.
What is a Section 65B certificate and do I really need one?
Section 65B of the Indian Evidence Act says that any electronic record produced in court as secondary evidence — like a screenshot, a chat export or a CCTV clip — must come with a written certificate. The certificate confirms the device that produced it, the working condition of that device, and the manner of capture. The Supreme Court in Anvar PV v PK Basheer made it clear that without this certificate, electronic evidence is generally not admissible. Yes, you need it. Your lawyer drafts the certificate; your job is to keep the originals untouched.
Why is preserving evidence before filing a complaint so important?
Because the moment you complain, the scammer often deletes everything. WhatsApp groups are wound up, fake brokers vanish, and the dummy trading app disappears from the URL. Once that happens, even the police cannot pull it back from thin air. The only authentic copy left is what you preserved. Preserve first, complain second. This sequence does not delay the police process by more than an hour or two, but it can decide whether the case can actually be proved at trial six months later.
Which sections of law apply to a whatsapp trading scam?
The FIR usually combines Section 66D of the Information Technology Act for cheating by personation using a computer resource (the fake broker on WhatsApp), Section 420 of the Indian Penal Code for cheating, and where identity features such as photos or names of real brokers were misused, Section 66C of the IT Act. The base concept comes from Section 415 IPC — dishonest inducement that makes you part with money. Section 43 read with Section 66 IT Act may also be invoked for the unauthorised computer activity behind the fake trading app.
How do I record the fake trading app before it gets shut down?
Use your phone's built-in screen recorder. Go through the app's main flow on camera — the login screen, the portfolio page showing your fake gains, the buy/sell buttons, the withdrawal page, and the moment a withdrawal request is rejected or stalled. Save the video, email a copy to yourself, and note the date and time. If the app is a website, also save the URL and a full-page screenshot. Once the scammer takes the site down, this recording may be the only proof that it ever existed.
What is a hash value and why are people on the internet talking about it?
A hash value is a long unique fingerprint that a computer calculates for a file. If even one pixel of the file changes, the hash changes too. Hashes (commonly SHA-256) are useful in evidence handling because they prove that the screenshot or chat export you produced in court is exactly the same as the one you preserved on day one — nobody has edited it in between. Your lawyer or a forensic expert can generate hash values; you just need to preserve the original files cleanly.
Do I need to get my evidence notarised or affidavit-attested?
It is not strictly required, but it can help in two ways. A self-attested affidavit listing each piece of evidence, sworn before a notary or oath commissioner, makes it harder for the accused to claim later that you tampered with the material. Some lawyers also use notarised printouts of chats and screenshots as a back-up to the Section 65B certificate. None of this replaces the certificate, but together they make your evidence harder to attack at trial. Discuss the route with your lawyer.
Will WhatsApp give the police the chat data on its own?
WhatsApp provides limited data to law enforcement — typically subscriber information, IP logs and basic metadata, on receipt of a proper legal request from Indian authorities. It does not, by default, hand over end-to-end encrypted message content. So you cannot rely on WhatsApp to magically reproduce your chats later. Your phone is the only reliable storage. The investigating officer can ask WhatsApp for limited data through Section 91 BNSS or a court order, but your preserved export is what the trial actually runs on.
What if I deleted the chat before I realised it was a scam?
Do not panic. Check your WhatsApp cloud backup — iCloud on iPhone or Google Drive on Android. If the backup ran before you deleted the chat, restoring it on a new install often brings the conversation back. Also check your phone's general gallery for forwarded screenshots, your email for any forwarded messages, and the bank app for transaction references. Even partial evidence is better than none. Tell the police what you have, explain the deletion honestly, and let them work with what is recoverable.
Is it useful to engage a lawyer just for the evidence stage?
Often yes, especially for medium-to-large losses. A cyber lawyer can guide you on what to preserve, draft the Section 65B certificate properly, prepare an affidavit listing each piece of evidence, and brief the investigating officer on which sections to invoke. Pinaka Legal in Delhi handles whatsapp trading scam matters from the evidence stage onward and can structure your file before it reaches the police, so the FIR is registered correctly the first time.
For more articles on Indian law, visit the Pinaka Legal Blog. For queries, call +91 8595704798 or email info@pinakalegal.com.