Law for common people · Phones & internet

Cyber and digital law

OTP fraud, account takeover, deepfakes, online harassment, and IT Act basics. Your phone is a crime scene and a vault.

This is civic education so you are not helpless in a police station, court corridor, company office, or consumer fight. It is not a lawyer brief, not a substitute for counsel, and not permission to break the law. Laws and section numbers change. Confirm current text before you argue a section. When money, freedom, children, or land are on the line, speak to a qualified lawyer or legal-aid clinic.

This category page is long on purpose. Use the jump chips. Every topic has plain words, a deep dive, how it works, worked examples (wrong move vs better move), first steps, papers, myths, and warnings.

Who this is for: Anyone hit by UPI fraud, fake job links, revenge threats, or social media complaints.

Start here: Read Cyber law for daily India, then OTP and UPI fraud if money moved. For threats and deepfakes, jump to those topics and use the reporting portal steps the same day.

Must know before you scroll

Minutes matter when money leaves your account. Call the bank or UPI helpline and freeze the trail before you write long essays.
National Cyber Crime Reporting Portal (cybercrime.gov.in) is a real door for many online offences. Use it early and save the acknowledgement.
Screenshots need context: full chat headers, timestamps, URLs, transaction IDs. Cropped memes are weak evidence.
Do not pay blackmailers. Payment rarely ends the threat. Preserve evidence and tell a trusted person.
Change passwords from a safe device and turn on two-factor authentication after any account takeover suspicion.
IT Act rules sit beside other criminal law for cheating, impersonation, and obscenity-related offences. Random section numbers on WhatsApp are often wrong.
This page teaches civic process. It is not a lawyer brief and not permission to hack back or dox anyone.

Cyber law for daily India

In plain words Crimes that use computers, phones, or networks still have police and court paths. Screenshots with time matter.

When it matters: Money leaves your account after an OTP call, someone clones your chat, or you are blackmailed with private images.

Cyber harm in India is usually ordinary crime wearing a digital jacket: cheating, intimidation, impersonation, sexual harassment, or theft of access. The screen does not make it 'not real.' Police cyber cells, the national reporting portal, banks, and platforms each play a part.

Your first job is not to become an amateur hacker. Your first job is to stop ongoing damage (freeze payments, lock accounts), preserve evidence without editing it, and report through official channels with a clear timeline.

Jurisdiction arguments ('the fraudster is in another state') should not stop you from reporting. Portals and zero-FIR style ideas exist so victims are not bounced forever. Still keep local police acknowledgements when you visit a station.

Revenge hacking, public dox, or posting the accused person's family photos can create fresh legal risk for you. Stay on the complaint path.

How it usually works

Write a timeline: first contact, what was said, what you clicked, what money or data moved, and when you noticed.
Preserve chats, emails, SMS, call logs, transaction SMS, and URLs. Do not factory-reset in panic if you can avoid it.
Block further loss: bank helpline, UPI app limits, password resets from a safe device.
File on cybercrime.gov.in and follow any instruction to visit local cyber cell or police.
Inform the platform (bank, WhatsApp, Instagram, employer IT) through official in-app report routes.
Keep acknowledgement numbers in one note on paper and cloud.

Remember

Digital crime is still crime. Report it like other serious harm.
Speed for money freezes. Calm for evidence packing.
Official portals beat random 'recovery agents' on Telegram.
Do not pay anyone who promises guaranteed recovery for an advance fee.
Section numbers online go stale. Describe facts clearly even if you are unsure of the section.
Tell one trusted person. Isolation helps fraudsters.

Examples

Fake courier KYC link

Situation: A Nagpur user gets an SMS about a pending parcel and OTP. Money leaves the bank account within minutes.

Wrong move: Only arguing with customer care chatbots for hours without calling the official bank fraud number or filing a cyber complaint.

Better move: Call bank fraud helpline immediately, dispute the transactions, save SMS and links, file on the cyber portal the same day.

Why: Early freeze and report improve recovery chances and create an official trail.

Job offer remote access

Situation: A fresher in Tier-2 city installs AnyDesk for a 'HR verification' and loses salary from the linked account.

Wrong move: Uninstalling everything and formatting the laptop before copying evidence.

Better move: Photograph the screen, note remote-tool session details, freeze bank access, then report with those details.

Why: Remote-access fraud needs session clues. Wiping early destroys them.

Neighbour Wi-Fi blame

Situation: Someone uses open Wi-Fi and commits offences. The connection owner panics.

Wrong move: Confessing on social media or refusing to speak to police without any router logs or timeline.

Better move: Secure the network, preserve router logs if available, and give a factual statement with counsel if summoned.

Why: Open networks create exposure. Panic posts create new problems.

First steps

Screenshot chats, transaction IDs, numbers, URLs. Do not wipe the phone if you can avoid it.
File on cybercrime.gov.in and also with local cyber cell or police as needed.
Change passwords from a safe device. Enable 2FA.
Ignore recovery agents who message you first after a leak.

Papers to keep

Timeline note with dates and amounts
Screenshots and exported chats
Bank / UPI transaction SMS and reference numbers
Portal acknowledgement / FIR or diary number
Platform report confirmation emails

Myths

Myth: 'If it happened on WhatsApp, police will not take it.' Reality: many offences are still reportable; use portal plus local process.
Myth: 'Paying a recovery agent is the only way.' Reality: advance-fee recovery is often a second scam.

Warnings

Do not share screen control with strangers.
Do not post accused minors' identities.
Not legal advice. Serious cases need counsel.

Words used here

Cyber cell: A police unit that handles many technology-related offences in a city or district.
2FA: Two-factor authentication: a second check beyond password, such as an authenticator app or hardware key.
Remote access tool: Software that lets someone control your device from elsewhere. Fraudsters misuse it in fake job and support scams.

OTP and UPI fraud

In plain words If someone tricks you into sharing an OTP, approving a UPI collect request, or scanning a malicious QR, money can move in seconds. Act in minutes, not tomorrow.

When it matters: Fake bank calls, KYC links, 'accident' UPI requests from relatives' cloned numbers, or QR stickers replaced on shop counters.

OTP and UPI fraud works because the system trusts the person holding the phone. Banks and apps often warn that they never ask for OTP. Fraudsters still succeed with fear scripts: KYC block, parcel pending, arrested relative, income tax refund.

Your defence has two clocks. Clock one is the financial freeze: helpline, app lock, dispute raise. Clock two is the complaint trail: cyber portal, local police if needed, and written follow-up with reference numbers.

Family members sometimes blame the victim for 'being stupid.' Shame delays reporting. Delay helps the money hop across mule accounts. Report first. Family counselling later.

Merchants should check QR stickers physically. Customers should confirm the name on the UPI pay screen before entering PIN.

How it usually works

Stop communicating with the fraud number or link.
Call your bank or UPI app official fraud number from the number on the reverse of your card or the official app help section, not from the caller's number.
Ask to block UPI, cards, and freeze disputed transactions where possible.
Note UTR / reference IDs from SMS.
File complaint on cybercrime.gov.in under financial fraud category as applicable and save acknowledgement.
Follow bank dispute process in writing or through official app channels. Keep ticket IDs.

Remember

No genuine bank needs your OTP on a phone call.
Read the UPI name before PIN. 'Collect request' is not 'I am receiving money.'
Replace suspicious QR stickers logic with visual checks.
Report within the hour if you can.
Mule account trails are complex. Your job is early complaint quality, not becoming a detective overnight.
Do not download 'support APK' files from links.

Examples

Mother shares OTP in fear

Situation: A caller says the son's phone is in police custody and OTP confirmation is needed to 'verify guardian.'

Wrong move: Sharing OTP and then waiting till evening to tell the son.

Better move: Hang up, call the son on a known number, then call bank fraud line if any OTP was shared.

Why: Fear scripts target elders. Speed after a mistake still matters.

Wrong collect approve

Situation: A college student approves a collect request thinking it adds money to the wallet.

Wrong move: Posting on Instagram for advice for two hours before calling the bank.

Better move: Helpline first, portal complaint next, screenshots of the collect request saved.

Why: Social advice is slow. Money hops fast.

Shop QR swapped

Situation: A tea stall's printed QR is over-stickered. Customers pay a stranger for a week.

Wrong move: Owner only shouts at customers instead of fixing QR and helping with complaint details.

Better move: Replace QR, put name board matching UPI ID, help customers with transaction IDs for complaints.

Why: Physical QR fraud is common and preventable with checks.

First steps

Call official bank / UPI fraud helpline immediately.
Disable UPI and cards until secure.
File cyber financial fraud complaint with UTRs.
Warn family groups with facts, not forwarded superstition.

Papers to keep

Transaction SMS and UTR list
Call log of fraud number
Screenshots of links, QR, collect requests
Bank ticket number
Cyber portal acknowledgement

Myths

Myth: 'If I entered the PIN, bank will never help.' Reality: still report. Outcomes vary, but silence helps the fraudster.
Myth: 'Police only act for large amounts.' Reality: still file. Pattern crimes need volume of reports.

Warnings

Never read OTP aloud to callers.
Never install remote apps for 'bank officers.'
Not legal advice. Recovery is not guaranteed.

Words used here

OTP: One-time password used to approve a transaction or login. Treat it like a temporary key to your money.
UPI: Unified Payments Interface: instant bank-linked payments through apps using VPA, QR, or number-based flows.
UTR: Unique transaction reference used to identify a payment in bank systems.
Collect request: A UPI request asking you to approve paying someone. Approving sends your money out.

Account takeover

In plain words Account takeover means someone else controls your email, social media, cloud, or banking login. Lock, recover, and report before you negotiate with the hijacker.

When it matters: Password reset emails you did not request, friends saying you are spamming crypto links, or SIM-related OTP theft.

Takeover often starts with reused passwords, leaked databases, SIM swap, malware, or phishing pages that look like Google or Instagram. Once inside email, attackers reset everything else because email is the master key.

Recovery order matters. Secure email first if you can, then banking, then social. Use another trusted device, not the possibly infected phone, when practical.

If a SIM swap happened, contact the telecom operator urgently and document the complaint. Banking OTPs that travel with the SIM are a known weak point when SIM control is stolen.

After recovery, review app passwords, sessions, forwarding rules in email, and connected third-party apps. Attackers leave quiet backdoors.

How it usually works

From a safe device, try official account recovery flows. Avoid links sent by the attacker.
Change passwords to new unique ones. Enable authenticator-app 2FA, not only SMS where possible.
Sign out all sessions and revoke unknown devices.
Check email filters and forwarding rules for attacker-added redirects.
Inform bank and critical platforms of compromise in writing through official channels.
File cyber complaint if extortion, fraud, or identity misuse occurred.

Remember

Email security is the root for many other accounts.
SIM swap is a telecom plus bank emergency.
Unique passwords beat one clever password reused everywhere.
Revoke sessions after recovery.
Do not bargain with hijackers who demand crypto to 'return' the account.
Warn contacts if your profile was used to scam them.

Examples

Instagram hijack + crypto spam

Situation: A creator's Instagram starts DMing fake giveaway links to followers.

Wrong move: Posting from a friend's account for days without starting Meta recovery and password resets on linked email.

Better move: Begin official recovery, secure email, enable 2FA, message followers from a verified channel about the hijack.

Why: Every hour of hijack burns follower trust and spreads secondary fraud.

SIM swap before salary day

Situation: A user's number goes dead. OTPs for bank reset go to the attacker.

Wrong move: Waiting 48 hours for 'network to return' without visiting the operator store.

Better move: Rush to operator with ID, complain in writing, alert bank to freeze channels, then cyber report.

Why: SIM control is payment control for SMS-OTP users.

Email forwarding backdoor

Situation: Password changed but attacker still sees mail via a hidden forward rule.

Wrong move: Assuming password change alone finished the job.

Better move: Audit forwarding, filters, app passwords, and active sessions after every takeover.

Why: Quiet backdoors enable repeat theft.

First steps

Secure email from a clean device.
Freeze bank UPI and cards if banking OTPs may be exposed.
Run official recovery on each hijacked platform.
File portal complaint when fraud or threats are involved.

Papers to keep

Account recovery emails and case IDs
Telecom complaint number for SIM issues
List of devices and sessions revoked
Evidence of malicious posts or DMs
Cyber portal acknowledgement

Myths

Myth: '2FA SMS is enough forever.' Reality: SIM swap can defeat SMS OTP. Prefer app-based 2FA where you can.
Myth: 'Paying the hijacker is cheaper.' Reality: payment often funds more crime and does not guarantee return.

Warnings

Do not use random 'hackers for hire' to recover accounts.
Do not reuse the compromised password anywhere.
Not legal advice.

Words used here

SIM swap: Fraud where your mobile number is moved to another SIM so OTPs and calls reach the attacker.
Session: A logged-in state on a device or browser. Revoking sessions kicks unknown devices out.
Phishing: Fake pages or messages designed to steal passwords or OTPs.

Online harassment

In plain words Harassment online includes repeated abuse, sexualised targeting, stalking, doxing threats, and coordinated pile-ons. Safety and evidence come before reply wars.

When it matters: Threat DMs, workplace Slack abuse, student group bullying, or targeted attacks after a woman speaks online.

Reply-all wars feed harassers. The stronger pattern is: preserve, restrict, report on-platform, tell someone offline, then use cyber portal or police when threats, sexual content misuse, or stalking cross lines.

Gendered abuse and morph threats are common. You do not have to 'ignore forever' to be strong. Document and escalate. Use stay-safe steps if offline risk appears.

Schools and workplaces may have internal complaint routes (including POSH processes in covered workplaces). Online harm connected to work or campus can use both platform and institutional paths.

Do not deploy your own pile-on against a minor or by publishing private home addresses. Counter-harassment can create liability.

How it usually works

Screenshot with usernames and timestamps visible. Export chats where platforms allow.
Use block / restrict / mute tools without deleting the evidence copy you already saved.
Report through in-app safety forms.
If threats of violence, sexual misuse, or stalking continue, file on cybercrime.gov.in and approach local police with your bundle.
Inform employer or college ICC / committee when the harasser is inside that system.
Consider changing public location habits if doxing risk is real.

Remember

Evidence first, clapbacks later.
Platform report plus official complaint when severity is high.
Workplace and campus routes can run in parallel.
Tell a trusted person. Do not carry death threats alone.
Children and teens need adult help with complaints.
Do not pay for 'reputation deletion' cold calls.

Examples

Threats after a reel

Situation: A woman creator gets rape threats in comments after a political video.

Wrong move: Deleting all comments without saving evidence, then quitting without a complaint number.

Better move: Archive threats, report accounts, file cyber complaint, tighten privacy, use stay-safe plan.

Why: Deleted-only evidence helps nobody. Archives support action.

Office chat bullying

Situation: A manager mocks an employee daily on a work group and shares private photos.

Wrong move: Only answering with sarcasm while the thread continues.

Better move: Save the thread, use internal complaint routes, and consider legal advice for serious misconduct.

Why: Workplace systems exist partly for this. Paper beats witty comebacks.

School WhatsApp pile-on

Situation: Classmates create a group to abuse one student.

Wrong move: Parents storm the school with no screenshots and threaten teachers personally.

Better move: Save evidence, meet school in writing, involve cyber or police if threats or sexual content appear.

Why: Institutions respond better to dated proof than to chaos.

First steps

Preserve evidence in a dedicated folder.
Report on-platform.
File portal complaint for threats, stalking, or sexual misuse.
Use Trishola stay-safe habits if offline fear rises.

Papers to keep

Screenshots with handles and times
Exported chats
List of URLs and account names
Platform report acknowledgements
Cyber / police acknowledgement

Myths

Myth: 'Mute means you have no case.' Reality: you can mute after preserving evidence.
Myth: 'Public figures must tolerate everything.' Reality: threats and certain sexualised targeting are still actionable.

Warnings

If someone threatens immediate violence, prioritise physical safety and emergency help.
Do not meet an online harasser alone to 'settle.'
Not legal advice.

Words used here

Doxing: Publishing private personal details (address, phone, family data) to intimidate or endanger.
Morph / non-consensual image abuse: Editing or sharing sexualised images without consent, including deepfake-style morphs.
Pile-on: Many accounts attacking one person in a short time, often coordinated.

National cyber reporting portal

In plain words cybercrime.gov.in is the national online door for many cyber complaints, including financial fraud and some women/child related offences. Use it early and keep the acknowledgement.

When it matters: UPI fraud, online harassment, sextortion, impersonation, and when local station desks look confused about cyber process.

The portal does not replace every police visit, but it creates a timestamped national record and routing path. For financial fraud, quick reporting supports bank and LEA coordination better than waiting for a perfect essay.

Fill forms with plain facts. Inflating amounts or inventing details hurts credibility. Attach clear screenshots. Note if a local FIR or diary entry already exists.

After submission, watch SMS or email updates. You may be asked to visit a cyber cell. Take printed annexures. Do not assume the portal alone finishes investigation without follow-up.

Citizen tip: bookmark the official URL yourself. Fraudsters send fake 'cyber complaint' links to steal more OTPs.

How it usually works

Open the official National Cyber Crime Reporting Portal from a trusted bookmark.
Choose the category that matches your harm (financial fraud, other cyber, women/child related as applicable).
Enter timeline, amounts, suspect identifiers, and upload evidence.
Submit and save acknowledgement number offline and online.
Follow instructions for local coordination or additional documents.
Track status and keep bank ticket numbers linked in your notes.

Remember

Official URL only. Never via random ads.
Acknowledgement number is gold. Save it.
Plain timeline beats legal jargon.
Portal plus bank dispute for money cases.
Follow up when asked to visit a cell.
Do not hand your phone unlock PIN to strangers claiming they are portal officers.

Examples

Same-day UPI complaint

Situation: A user loses ₹18,000 at 11 a.m. and files on the portal by noon with UTRs.

Wrong move: Waiting three days for a cousin who 'knows cyber.'

Better move: Self-file immediately with transaction list, then take family help for follow-up visits if needed.

Why: Delay is the enemy in mule-account chains.

Fake portal link

Situation: After a small fraud, a WhatsApp message offers 'priority cyber filing' via a shortened link asking for OTP.

Wrong move: Entering banking OTP on that link.

Better move: Ignore, open the real portal manually, and report the phishing attempt too.

Why: Second-wave scams hunt shaken victims.

Station says only portal

Situation: Local police tell a victim they will not write anything and to 'only do website.'

Wrong move: Leaving with zero paper from the station and also forgetting portal filing.

Better move: File on portal, still request diary/acknowledgement locally where process allows, escalate politely with both numbers if refused unlawfully.

Why: You want redundant trails, not a jurisdictional ping-pong void.

First steps

Bookmark cybercrime.gov.in from a trusted source.
Prepare UTR list and screenshots before you start the form.
Submit, save acknowledgement, then call bank with that number if useful.
Put a calendar reminder to check status after a few days.

Papers to keep

Portal acknowledgement ID
Uploaded evidence set (keep originals)
Identity details used in the form
Any local police acknowledgement
Bank dispute ticket

Myths

Myth: 'Portal filing means money auto-returns in 48 hours.' Reality: filing starts process; recovery is case-wise.
Myth: 'I need a lawyer to click submit.' Reality: victims can file; lawyers help for complex follow-up.

Warnings

Beware of paid agents who offer to file for a cut of recovery.
Do not share remote access during 'portal help.'
Not legal advice.

Words used here

Acknowledgement number: The complaint ID generated after portal submission. Quote it everywhere.
LEA: Law enforcement agency. Police units that may receive routed complaints.
Financial fraud category: Portal path used for many UPI, card, and online payment cheats.

Deepfake and image blackmail

In plain words Sextortion and deepfake morph threats try to scare you into paying. Do not pay. Preserve evidence, tell someone, and report through cyber channels.

When it matters: Someone sends a morph of your face on a sexual image and demands UPI, or threatens to send it to your relatives and office.

Blackmailers count on shame. They often use a stolen face from social media plus a stock body image, or real private images obtained through hacking or relationship betrayal. Payment rarely ends it. It often increases demands.

India has reporting paths for women and children related cybercrime on the national portal, and police processes for intimidation and sexual content misuse. Use them. You are not alone in this pattern.

If the image is real and private, still do not pay. Focus on evidence, platform takedown reports, and official complaints. If it is an obvious morph, say so in the complaint and keep the original social posts that show your face source if relevant.

Teenagers are frequent targets of 'video call' traps. Parents should respond with support, not only punishment, so evidence is preserved and reporting happens.

How it usually works

Stop negotiating with the blackmailer. Do not send more images 'to prove trust.'
Copy chat, usernames, payment demands, and file names. Keep the phone charged and un-wiped.
Tell a trusted adult or friend. Isolation helps the crime.
Report on cybercrime.gov.in (women/child related category when applicable) and to local cyber police as needed.
Report the content on the platform for intimate image abuse / impersonation.
Tighten account privacy and warn close contacts if mass send is threatened, using a calm factual note.

Remember

Do not pay. Payment extends the leash.
Shame is the weapon. Support breaks it.
Portal filing is appropriate for many of these cases.
Platform takedown reports matter in parallel.
Teens need adult help without humiliation theatre.
Never send additional nudes to 'settle.'

Examples

Morph sent to family threat

Situation: A college student gets a Telegram demand: pay ₹20,000 or morph goes to relatives.

Wrong move: Paying ₹5,000 'advance' to buy time.

Better move: Stop payment, save chat, tell a trusted person, file portal complaint, report accounts.

Why: Partial payment confirms the victim is monetisable.

Ex threatens private images

Situation: After a breakup in Mumbai, an ex circulates or threatens intimate photos.

Wrong move: Only trading insults publicly while images spread.

Better move: Preserve messages, file complaints, use platform intimate-image tools, seek counsel for serious cases.

Why: Relationship context does not erase consent and misuse issues.

Fake video call police

Situation: A fraudster pretends to be police and says a deepfake case is filed unless fine is paid via UPI gift vouchers.

Wrong move: Buying vouchers and sharing codes.

Better move: Hang up, verify via known police channels, file cyber complaint against the impersonator.

Why: Authority cosplay is a standard extortion script.

First steps

Do not pay. Do not create new sexual content for the blackmailer.
Preserve the full chat thread.
File on the national portal and seek local cyber help.
Use stay-safe steps if offline harassment begins.

Papers to keep

Full chat exports
Images or videos received (stored safely, not re-shared)
Payment demand details
Platform report IDs
Portal / police acknowledgement

Myths

Myth: 'If I pay once they will delete forever.' Reality: demands usually rise.
Myth: 'Police will only shame me.' Reality: you can ask for sensitive handling; legal-aid and support persons help.

Warnings

Suicidal despair after sextortion is a known risk. Reach people and helplines. You matter more than the image.
Do not confront the person alone if they are local.
Not legal advice.

Words used here

Sextortion: Blackmail using sexual images, videos, or the threat of publishing them.
Deepfake: AI-assisted fake media that makes it look like a person said or did something they did not.
Takedown: Asking a platform to remove offending content through official reporting tools.

Evidence and screenshots that work

In plain words Weak screenshots waste cases. Strong evidence shows who, when, where on the screen, and what exactly was said or paid.

When it matters: Any cyber complaint, bank dispute, workplace inquiry, or platform appeal.

Cropped images of abuse text without username or date invite 'fabricated' allegations. Capture the full header, handle, URL bar when relevant, and surrounding messages for context.

For payments, keep UTR, amount, time, and beneficiary name. For websites, keep the full URL and a recording of the flow if safe. For calls, note number, time, and what was promised. Call recording laws and practices vary. Focus on logs and follow-up writing when unsure.

Make two copies: working copy and untouched original export. Do not annotate the only copy with emojis and arrows. Annotate a duplicate.

If you fear device seizure, speak to counsel about how to provide evidence without unnecessarily exposing unrelated private life. Do not destroy evidence.

How it usually works

Screenshot full screen including status time when possible.
Export chat from the app if the feature exists. Save ZIP or email to yourself.
Photograph physical cards or printed SMS if needed, without sharing CVV publicly.
Write a one-page index: File 1 what it shows, File 2 what it shows.
Upload clear copies to the portal. Keep originals.
When visiting cyber cell, take a pendrive and printed index.

Remember

Username + timestamp + content in one frame beats artistic crops.
UTR list is mandatory for money cases.
Duplicate before you mark arrows.
URL bar matters for phishing pages.
Index your files like a simple exhibit list.
Do not edit metadata away if you can avoid it.

Examples

Cropped threat fails

Situation: A complainant shows only the abusive sentence with no handle.

Wrong move: Arguing 'everyone knows who it is' without capturing the profile.

Better move: Recapture with handle, date, and profile URL. Add prior messages for context.

Why: Identifiable source makes investigation possible.

UTR missing

Situation: Victim remembers losing 'about twenty thousand' but has deleted SMS.

Wrong move: Filing with guessed amounts and no references.

Better move: Download bank statement PDF, highlight UTRs, then file with exact rows.

Why: Banks and police trace numbers, not vibes.

Only copy annotated

Situation: Victim draws red circles on the sole screenshot and compresses it through three WhatsApp forwards.

Wrong move: Using that mashed image as the master evidence.

Better move: Keep clean export, annotate a copy, avoid endless recompression.

Why: Quality loss and edits invite authenticity fights.

First steps

Create a folder named with the date of incident.
Export chats and download statements before they auto-expire.
Write the index page.
Back up to a trusted cloud or encrypted drive.

Papers to keep

Full-screen screenshots
Chat exports
Bank statements with UTR highlights
URL list and phishing page captures
Exhibit index page

Myths

Myth: 'Police only want FIR language, not screenshots.' Reality: they need facts and digital traces.
Myth: 'Forwarded WhatsApp image is as good as original export.' Reality: originals and exports are stronger.

Warnings

Do not publicly repost sexual images that were used to blackmail you; store for complaint use carefully.
Do not fabricate evidence. False cases destroy credibility and can be offences.
Not legal advice.

Words used here

Export: App feature that packages chat history into a file you can save outside the phone screen.
Exhibit index: A simple list explaining what each evidence file is.
Metadata: Hidden file info such as created time. Heavy editing can strip or confuse it.

All law categories →Your rights →Toolkit →