The first hours of an online fraud, and why they decide the outcome

In online financial fraud the money moves through several accounts within minutes, and the prospect of recovery falls with every hour that passes. Three things matter at the outset, and all three are time-sensitive.

The first is reporting. A complaint on the National Cyber Crime Reporting Portal and a simultaneous report to the bank start the process by which a transaction can be flagged and, in some cases, held before it is withdrawn further down the chain.

The second is preservation. Screenshots, messages, call records and transaction references should be kept exactly as they are, without cropping, editing or forwarding in a way that strips their metadata. Electronic records are admissible, but they must be produced in the form the law requires, and material handled carelessly at the start is difficult to rehabilitate later.

The third is the account of events. Write down the sequence while it is fresh — what was received, what was clicked, what was authorised and when. Investigating agencies work from this account, and gaps in it become gaps in the case.

Reserve Bank directions on unauthorised electronic transactions also place obligations on banks, and the customer's position under them depends partly on how promptly the transaction was reported.

This note is general information and is not legal advice.