Cyber Crime Investigation: Process and Police Powers
An Inspector investigates, the money trail leads, and the bank holds most of the evidence.
A cyber crime investigation has to answer the same questions as any other: what happened, who did it, and can it be proved in court. The difference is that the scene is a server log, a phone and a chain of bank accounts that the money ran through in minutes. Most of the evidence sits with banks, telecom companies and platforms, not with the victim.
Investigation is a police function. The bank's role is to preserve what it holds, hand it over in a form a court will accept, and cooperate through a named nodal officer. Knowing the legal powers helps branch staff respond correctly when an investigating officer arrives with a notice.
You save ₹300
- Full 120-question mocks
- Cyber law coverage
- Module-wise practice
One payment, no subscription · Valid for 2 months
Who Can Investigate, and With What Powers
| Provision | What it says |
|---|---|
| IT Act, section 78 | A police officer not below the rank of Inspector investigates offences under the IT Act. Before the 2008 amendment (in force from 27 October 2009) the rank was Deputy Superintendent of Police. |
| IT Act, section 80 | An Inspector, or an authorised Central or State government officer, may enter any public place and search and arrest without warrant a person reasonably suspected of an IT Act offence. |
| IT Act, section 77B | Offences punishable with three years or more are cognizable; offences punishable with exactly three years are bailable. |
| BNSS, section 173 | FIR for a cognizable offence, given orally or electronically, irrespective of where it was committed. For offences punishable with three to under seven years, a preliminary enquiry of up to 14 days is allowed with a DSP's permission. |
| BNSS, section 94 | A court or station officer can summon production of documents, electronic communications and devices likely to contain digital evidence. |
| BNSS, sections 105 and 185 | Searches and seizures, including the list of items seized, must be recorded by audio-video means, preferably a mobile phone. |
| BNSS, section 176(3) | For offences punishable with seven years or more, a forensic expert visits the crime scene, from the date each State notifies. |
| BNSS, section 202 | Cheating by electronic communication can be tried where the messages were sent or where they were received. |
How a Typical Bank Fraud Investigation Moves
Take a customer whose account was emptied through UPI after a remote-access app was installed on her phone.
- 1
Complaint and FIR
The complaint arrives through 1930, the portal or a police station and is registered as an FIR, usually for cheating and IT Act offences.
- 2
Follow the money
Police write to the beneficiary banks to identify and hold the receiving accounts. These are often mule accounts opened or rented to pass money on.
- 3
Collect records from banks and intermediaries
KYC of the receiving accounts, statements, IP addresses and device IDs from login logs, CCTV from the ATM where cash was withdrawn, and subscriber details from telecom companies.
- 4
Seize and examine devices
The victim's phone and any devices seized from suspects go for forensic examination, with the search recorded on video.
- 5
Report to the Magistrate
The final police report must state the sequence of custody of any electronic device, and the informant must be told of progress within ninety days.
What the Bank Should Have Ready
- checkA designated nodal officer for law enforcement requests, which RBI's fraud Directions require
- checkAudit trails and logs detailed enough to serve as forensic evidence, as RBI's cyber Directions require
- checkAccount opening documents and KYC of the accounts involved
- checkCCTV footage from branches and ATMs, preserved before routine overwriting
- checkA certificate under section 63 of the Bharatiya Sakshya Adhiniyam for every electronic record handed over
Quick practice on banking operations. No signup.
The National Agencies Behind State Police
Cyber crimes are investigated by State and UT police, usually through cyber police stations or cyber cells. The Indian Cybercrime Coordination Centre (I4C), an attached office of the Ministry of Home Affairs since 1 July 2024, coordinates across States. Its National Cyber Forensic Laboratory in New Delhi gives investigating officers forensic support, including mobile, memory, malware and cryptocurrency analysis.
How the IIBF Exam Tests This
The most tested fact is section 78: Inspector, not DSP. Notes based on the original 2000 text of the Act still say DSP, and examiners use that as a distractor. Expect questions on who can search without a warrant (section 80, public places only), which offences are cognizable, and the investigation stages in order.
Since July 2024 the criminal procedure questions should use BNSS section numbers. If an option quotes the CrPC, check whether the question is about the old law.
FAQs
Who can investigate offences under the IT Act?expand_more
A police officer not below the rank of Inspector, under section 78 of the IT Act, 2000. The 2008 amendment lowered the rank from Deputy Superintendent of Police.
Can police arrest without a warrant for cyber crime?expand_more
Under section 80 of the IT Act, an Inspector or authorised officer can search and arrest without warrant in a public place a person reasonably suspected of an IT Act offence. Other arrests follow the BNSS.
Are IT Act offences cognizable?expand_more
Under section 77B, offences punishable with three years or more are cognizable, and those punishable with three years are bailable.
What is the role of a bank in a cyber crime investigation?expand_more
To preserve and produce records (KYC, statements, logs, CCTV) with the required evidence certificate, to act on police requests through a nodal officer, and to report the fraud to RBI and the police as its own duties require.
Next steps
- Evidence & Custodyarrow_forward
- Cyber Forensicsarrow_forward
- IT Act 2000arrow_forward
- Reporting Cyber Crimearrow_forward
120 questions, 2 hours, scored instantly.