What evidence should you collect if you receive a suspicious deepfake numismatic video?
Digital evidence must be collected before it disappears — deleted messages, deactivated accounts, and expired links mean evidence that exists today may be gone tomorrow. When you receive a suspicious deepfake or AI-generated numismatic endorsement video, the evidence collection steps are: screenshot the message with its metadata (sender, timestamp, platform); preserve the video file if downloadable; record the source URL or WhatsApp forward chain; document the platform account details (handle, profile photo, account creation date if visible); and preserve all associated text messages. This evidence package makes any subsequent complaint actionable.
Step 1 — Screenshot with metadata
Screenshot the message containing the video on the platform where you received it. The screenshot must capture: the sender's name/handle; the timestamp of receipt; and any accompanying text. On WhatsApp, screenshot the chat message showing the sender's number and the time the video was forwarded. On Instagram, screenshot the DM or post showing the account handle and post date. On YouTube, screenshot the video page showing the channel name, URL, and post date. Metadata-rich screenshots are stronger evidence than cropped images.
Step 2 — Preserve the video file
If the video is downloadable (YouTube, Facebook), download a copy to your device before reporting it — reported content is sometimes removed before investigators can access it, eliminating the primary evidence. For WhatsApp videos, forward the video to your own number or save it to your device's gallery before reporting. Preserve the original file — do not compress it, re-encode it, or share it through platforms that modify the file's metadata. Original files contain technical metadata (codec, encoding date, creation software) that forensic experts can analyse.
Step 3 — Document the account and forward chain
Record the originating platform account: WhatsApp number; Instagram handle; YouTube channel URL; Facebook profile URL. Note any visible account details — profile description, account age, follower count. On WhatsApp, 'frequently forwarded' labels indicate wide circulation — document this. The forward chain (where the message came from) may be visible in WhatsApp's message info — screenshot it. This documentation maps the fraud's spread and helps cybercrime investigators identify the origin.
Step 4 — Preserve associated messages
Preserve all text messages associated with the video — the messages that accompanied the video, any follow-up messages from the sender requesting payment, and any communications that took place after the video was shared. These messages establish the connection between the deepfake and the financial fraud — showing that the video was used as part of a scheme to extract payment. Take screenshots of the full conversation thread, not just selected messages.
Digital evidence checklist — suspicious deepfake video Screenshot: sender handle/number + timestamp + platform + accompanying text Video file: download and save original file before reporting (reporting may trigger removal) Source account details: handle, profile description, account creation date if visible Forward chain: WhatsApp message info showing forwarding path and 'frequently forwarded' status Full conversation thread: all messages associated with the video, especially payment requests UPI/payment details: if you paid, preserve the UPI confirmation (UTR + recipient ID) Timeline: note the exact time you received the video and any subsequent communications Do NOT: delete the message; compress or re-encode the video; share it further before documenting |
Laws & authorities referenced in this chapter
Bharatiya Sakshya Adhiniyam 2023 — §§61-65 (electronic records: authenticity requirements; original unmodified files carry strongest evidentiary weight)
BNSS 2023 — §173 (FIR: digital evidence attachment; screenshots and video files as primary evidence)
IT Act 2000 — §65B certificate: for electronic evidence submitted in court, a certificate of authenticity may be required
National Cybercrime Reporting Portal — cybercrime.gov.in: accepts video evidence and screenshots in complaint filing
Evidence collection for suspicious deepfake: screenshot with metadata (sender + timestamp + platform) + download original video file before reporting + source account details + forward chain + full conversation thread + UPI details if payment made. Collect BEFORE reporting — reported content may be removed before investigators access it. Original video file: preserve unmodified for forensic analysis. Do not delete, compress, or re-encode. This evidence package makes cybercrime complaint actionable and supports FIR.
This is educational content, not legal advice. For a specific situation, please consult a qualified legal professional. Excerpted from Currency, Coins & The Law by Mayank Agarwal, Part 38: Deepfakes, Voice Clones & AI Fraud — Deepfake Video, AI Text Endorsements, Voice Cloning, Platform Liability, Digital Evidence, Injunctions, Trademark Protection, Community Anti-Fraud Protocol.