Everence

Blog

  • Email Forensics: How Deleted Emails Can Be Recovered and Used as Digital Evidence

    Email Forensics: How Deleted Emails Can Be Recovered and Used as Digital Evidence

    A finance manager approves a payment on a Thursday afternoon. The email asking for it looked routine: the right name, the usual signature, a vendor she had paid a dozen times before. Only the bank account was different. Two weeks later, the real vendor calls, asking where their money is, and the original email has vanished from her inbox. This is exactly the situation email forensics is built for. The message may be gone from view, but the trail around it (headers, server logs, mailbox rules, leftover data on the machine) usually tells the story to someone who knows how to read it.

    Email remains the paper trail of Indian business: contracts, approvals, negotiations, resignations, and, increasingly, the entry point for fraud. When something goes wrong, the question is rarely “was there an email?” It is “can we prove what it said, who sent it, and whether it was tampered with?”

    “Deleted” Rarely Means Gone

    Most people picture deletion as a shredder. In reality, it is more like removing a book’s entry from a library catalogue while the book stays on the shelf. Where the “book” still sits depends on how the email was stored.

    On the user’s computer

    Desktop clients keep mail in local files such as PST and OST (Outlook) or MBOX (Thunderbird and others). Deleting a message often just flags it, and the content can remain inside the file until it is compacted. Even after compaction, remnants can linger in unallocated disk space, which a forensic examiner can carve out.

    On the mail server

    Exchange, Microsoft 365 and Google Workspace usually retain deleted items for a limited window, and administrators can often extend it. Items pass through stages: the deleted folder, then a recoverable area, then permanent removal. What you can retrieve depends heavily on retention settings and on how quickly someone acts.

    In logs and backups

    Sign-in records, audit trails, message-tracking logs, and backups can confirm that a message existed even when its content is gone. In our experience, this layer is what often settles arguments. CERT-In’s 2022 directions also expect organisations to keep ICT logs for 180 days, which is one more reason not to let them roll over during a dispute.

    How to Recover Deleted Emails in Practice

    Deleted email recovery is a sequence, not a single click. Investigators first preserve the source (a mailbox export, a disk image, or a server snapshot) and record a hash so they can prove its integrity later. Then they work outward from the easiest sources to the hardest: server-side recoverable items first, then local data files, then carving from unallocated space.

    There’s a catch worth stating plainly. Email data recovery has a shelf life. Server retention windows close, local files get compacted, and normal use overwrites disk space. Recovering a week after deletion and recovering six months later are very different exercises. Anyone promising a full restoration regardless of timing is selling comfort, not forensics.

    The Header Tells the Truth

    Recovering an email is only half the work; the other half is deciding whether it is genuine. Every email carries a header, a technical passport that most people never see. It records the servers the message passed through, timestamps, the originating IP address, and the results of authentication checks such as SPF, DKIM and DMARC.

    Here’s where things get interesting. A spoofed email may look perfect in the inbox, yet its header shows it never came from the claimed domain. A lookalike domain, one letter off from the real one, will pass casually but fail under inspection. And a message that genuinely came from a real account may still be fraudulent if the account itself was hijacked. Telling these two apart, spoofing versus account takeover, changes the entire direction of a case.

    Following the Trail in an Email Fraud Investigation

    Business email compromise usually leaves a pattern. Attackers who take over a mailbox rarely announce themselves. They quietly create forwarding rules, or rules that send certain messages straight to the deleted folder so the real owner never sees the replies. They may grant a malicious app access to the account, or log in from unfamiliar locations at odd hours.

    A thorough email forensic investigation therefore looks beyond the visible messages. It checks mailbox rules, sign-in history, connected applications, and the exact timeline of when the vendor’s bank details changed. Piece by piece, it reconstructs how the intruder got in, what they saw, and where the money went. For organisations evaluating email fraud services in India, this is the standard question: does the provider trace the entire attack, or only retrieve the one message?

    Turning Recovered Emails into Admissible Evidence

    Finding the email does not end the job. It has to survive scrutiny. Under the Bharatiya Sakshya Adhiniyam, Section 63 (which replaced the old Section 65B of the Evidence Act), electronic records need a certificate describing how the record was produced, with hash values, signed by the person in charge and an expert. Fraud by impersonation may also engage provisions of the IT Act, such as Sections 66C and 66D.

    This is why documentation matters as much as recovery. A clear chain of custody, a reproducible method, and a report a non-technical judge can follow turn a recovered email into usable evidence. A perfectly retrieved message with a broken custody trail can be challenged and discounted.

    Before Anyone Touches the Mailbox

    Early decisions can make or break a case. Do not delete, archive or “tidy up” anything, even the suspicious messages. Do not forward the suspect email around the office, because forwarding strips the original header. Change credentials only after preserving the mailbox, since a password reset can wipe useful session data. And ask IT to pause automated clean-up and retention purges for the affected accounts.

    Choosing the Right Partner

    When shortlisting a Digital Forensic Services Company in India, look past the brochure. Ask how they preserve mailboxes, whether they handle both endpoint and cloud email, how they document custody, and whether their reports have stood up in legal proceedings. If you are facing a live incident, ask for an Email Fraud Investigation in India that covers the whole intrusion, from entry point to financial trail, not just message retrieval.

    The Short Version

    Email forensics works because digital communication is stubborn. Deleted messages leave shadows in files, servers and logs, and headers record where a message really came from. But those shadows fade quickly, and careless handling can erase them for good.

    If you suspect a fraudulent email, an insider leak, or a mailbox that has been quietly tampered with, speak to the forensic team at Everence before anything is deleted or reset. The sooner you preserve the evidence, the more of the story you can tell.

  • WhatsApp Forensics: How Investigators Recover and Analyse Digital Evidence

    WhatsApp Forensics: How Investigators Recover and Analyse Digital Evidence

    An employee resigns on a Friday. By Monday, a client list he handled has reached a competitor, and the only trace of how it travelled is a WhatsApp conversation he deleted before returning his phone. Everyone in the room assumes that chat is gone for good. Usually, it isn’t. That is the quiet reality of WhatsApp forensics: a conversation that looks erased to its owner often leaves footprints on the device, and a trained examiner knows where to look.

    WhatsApp is now where quotations get approved, payments get promised and, unfortunately, where fraud gets planned. When a dispute reaches a boardroom or a courtroom, those chats are often the most honest record of what actually happened. The catch is that evidence like this is fragile. Handle it badly, and you lose it or make it inadmissible.

    Why WhatsApp Evidence Carries So Much Weight

    Email trails are formal and edited. WhatsApp chats are spontaneous, timestamped and full of context: voice notes, forwarded documents, location pins, group conversations where someone said the quiet part out loud. In corporate fraud, insider theft, harassment complaints and matrimonial or property disputes, this informality is what makes them valuable.

    What most people don’t realise is that WhatsApp’s end-to-end encryption works against evidence retrieval from the company’s side. WhatsApp does not keep your message history on its servers, so there is no help desk to request it from. A proper WhatsApp forensic investigation therefore always goes back to the device, its backups, or a linked computer.

    Where WhatsApp Data Actually Lives

    Understanding the storage is half the job, because each location tells a different part of the story.

    On Android

    Chats sit in a SQLite database (commonly named msgstore.db) inside the app’s protected directory. Media files such as photos, voice notes and documents live in a separate folder and frequently survive even after the related chat is cleared. Accessing the protected database requires deeper extraction than simply plugging in the phone and copying files, and the depth depends on the device model, OS version, and lock status.

    On iPhone

    The equivalent database is typically ChatStorage.sqlite, stored in the app’s shared container. Access usually comes through a full file system extraction or a backup, and the method again depends on the iOS version and the device’s condition.

    In backups and linked devices

    Local backups, cloud backups, and WhatsApp Web sessions on a laptop can each hold data that the phone no longer does. Local backups are encrypted, so the key material matters; without it, a backup is little more than noise. In our experience, checking each of these sources often separates a partial answer from a complete one.

    How WhatsApp Deleted Messages Recovery Works

    Here’s where things get interesting. When a message is deleted, the database rarely scrubs the content immediately. SQLite often just marks that space as free, so fragments of the original text can sit in unallocated pages or write-ahead log files until the phone overwrites them. Examiners use specialised tools and manual carving to reconstruct those fragments and match them back to timestamps, senders and chat threads.

    Other leftovers help too. Media files may remain in storage after the chat is gone. Notification records can preserve a message preview. Thumbnails, cached files and linked-device data can fill gaps the main database can’t.

    Now the honest part. WhatsApp chat recovery is never guaranteed. The longer a phone stays in daily use after deletion, the more likely the old data is overwritten. A “Delete for everyone” action may leave only a placeholder behind. Any credible provider will tell you this upfront and explain what can and cannot be retrieved, instead of promising everything.

    The Investigation Workflow, Step by Step

    A sound WhatsApp data recovery process follows a disciplined order, because the sequence protects the evidence.

    Isolate the device. The phone is cut off from networks so that no new messages arrive, no remote wipe is triggered, and nothing overwrites deleted content.

    Acquire a forensic image. Investigators extract the data at the deepest level the device allows, and record a hash value (a digital fingerprint) of what was captured. If even one byte changes later, the hash no longer matches.

    Parse and recover. The databases are decoded into readable chats, and deleted fragments are carved out and cross-checked against other artefacts on the device.

    Build the timeline. Messages, calls, media and app activity are lined up chronologically, so the story emerges: who said what, when, and in what sequence.

    Document everything. Record every action, tool, and finding in a report another expert could reproduce.

    Making the Evidence Stand Up in Court

    Recovering a message is one thing. Proving it is genuine is another. In India, electronic records are admitted with a certificate. Under the Bharatiya Sakshya Adhiniyam, Section 63 carries this forward from the old Section 65B of the Evidence Act, and the certificate should identify the device, describe how the record was produced, and include hash values, signed by the person in charge and an expert. This is why chain of custody, from the moment of seizure to the final report, matters as much as the recovery itself. A brilliant extraction with a broken custody trail can be challenged and weakened.

    Mistakes That Quietly Destroy Evidence

    A few patterns show up again and again:

    • Scrolling through the chats “just to see” changes timestamps and can trigger sync or auto-clean actions.
    • Reinstalling WhatsApp or restoring a backup can overwrite the very data you need.
    • Taking screenshots and treating them as proof. Screenshots are easy to dispute and carry no metadata.
    • Leaving the phone connected, where a remote wipe or automatic update can change its state.

    If a device matters to a case, switch it to flight mode, power it down if instructed, and hand it to a specialist without altering it.

    Choosing the Right Partner

    Not every lab handles mobile evidence the same way. When evaluating Device Forensic Services in India, ask about their acquisition methods, how they document custody, whether their reports are court-ready, and whether their examiners have testified before. A reliable Digital Forensic Services Company in India will explain limitations plainly and will never pressure you into unrealistic expectations.

    Final Thoughts

    WhatsApp forensics rewards speed and restraint in equal measure. Act quickly, because overwriting is constant. Touch nothing, because every tap can alter the record. And bring in experts before the device is disturbed, not after. Deleted rarely means destroyed, but it does mean the clock is running.

    If you are dealing with a suspected data leak, employee misconduct or a case where a phone may hold the answer, a conversation with the forensic specialists at Everence is a sensible first step before anyone opens that phone again.

  • Why Pharma & Healthcare Are Among India’s Most Targeted Sectors for Cyberattacks in 2026

    Why Pharma & Healthcare Are Among India’s Most Targeted Sectors for Cyberattacks in 2026

    Somewhere in a hospital’s server room right now, an ICU monitor is quietly streaming patient vitals onto the same network that runs the billing system, the pharmacy inventory, and the admin’s inbox. None of that was designed with an attacker in mind. It was designed for uptime, for convenience, for getting a diagnostic report from the lab to the doctor’s screen in seconds. That same interconnectedness is exactly why healthcare and pharma have quietly become the sector attackers go after first, not last.

    This isn’t a hypothetical risk anymore. It’s a documented, measurable trend, and any conversation about pharma cybersecurity in 2026 has to start with why this sector specifically, and not banking or e-commerce, has become such fertile ground for attackers.

    The Numbers Tell Their Own Story

    According to Seqrite Labs’ India Cyber Threat Report 2026, built from telemetry across more than 8 million endpoints, healthcare and pharmaceuticals alone accounted for 3.79 million threat detections between October 2024 and September 2025, roughly 14% of all detections nationally. Combined with education and manufacturing, these three sectors made up nearly half of every cyber incident recorded in the country over that period.

    What’s notable isn’t just the volume. It’s the nature of the attacks. Trojans and file infectors made up close to 70% of the activity, but the report also flagged something more targeted: remote access trojans and loader-based malware specifically aimed at pharmaceutical R&D systems and clinical trial data. That’s not opportunistic scanning. That’s reconnaissance aimed at intellectual property, the kind of data that takes years and crores of rupees to generate and seconds to exfiltrate.

    Ransomware told a similar story from a different angle. It accounted for less than 1% of total detections but caused disproportionate damage, with incidents peaking in January 2025 alone. When one of the country’s larger pharmaceutical manufacturers disclosed a cybersecurity incident to stock exchanges, a ransomware group later claimed responsibility and published stolen data. It’s a reminder that this isn’t a theoretical risk sitting in an analyst’s report. It’s happening to companies whose names are on the shelf at every chemist in the country.

    Ethical Hacking Services in India

    What Makes Pharma and Healthcare Such Attractive Targets

    Data That Can Never Be Reset

    Here’s where things get interesting from a risk perspective. A stolen credit card digit can be cancelled and reissued within a day. A compromised medical record cannot. Diagnostic histories, prescription patterns, genetic data, and clinical trial results are permanent, which means the value of that data to an attacker, whether for blackmail, insurance fraud, or resale on dark web markets, doesn’t depreciate the way financial data does. This single fact changes the entire risk calculation for healthcare cybersecurity, because there’s no equivalent of a card reissue once patient data is out.

    Operational Technology That Was Never Meant to Face the Internet

    Infusion pumps, imaging machines, and hospital information systems were largely built for clinical function, not adversarial environments. Many run on legacy operating systems that can’t be patched without risking the device’s medical certification. Attackers know this. Exploiting a decade-old vulnerability in an internet-connected imaging system is often easier than breaching a modern, actively maintained IT environment.

    Intellectual Property Worth Stealing

    For pharmaceutical companies, R&D data on novel drug formulations, biosimilars, and vaccine research represents years of investment. In our experience with organisations in this space, IP theft is often the real objective behind what looks, on the surface, like a routine ransomware incident. The ransomware is often the visible symptom. The quiet exfiltration that happened before it is the real event.

    A Sprawling, Uneven Attack Surface

    A single hospital network typically connects diagnostic labs, insurance processors, pharmacy systems, and third-party vendors, each with different security maturity. Most people don’t realise the weakest link is rarely the hospital’s core system. It’s usually a smaller vendor or a legacy device sitting somewhere in that chain, exploited as an entry point into a much larger network.

    Where DPDP Compliance Raises the Stakes

    Under the DPDP Act, healthcare organisations, including hospitals, diagnostic chains, insurers, and health-tech platforms, are classified as Data Fiduciaries. That classification carries real obligations: lawful processing, purpose limitation, explicit consent, and safeguards across every touchpoint where patient data moves, from admission records to teleconsultation logs.

    For an industry already managing the operational chaos of a live breach, DPDP compliance adds a second, parallel pressure. A breach isn’t just a security failure anymore. It’s a potential regulatory event, with reporting obligations and penalty exposure attached. Organisations that treat pharma data security purely as an IT problem, separate from their compliance obligations, will find that separation increasingly costly.

    Cyber Security Company in India

    What Effective Pharma and Healthcare Cybersecurity Actually Looks Like

    Building real resilience in this sector isn’t about a single tool or a one-time audit. It typically involves:

    • Network segmentation that keeps clinical devices, administrative systems, and third-party vendor access on genuinely separate paths, so a compromise in one doesn’t cascade into the rest
    • Regular vulnerability assessments specifically covering internet-connected medical devices, not just standard IT infrastructure.
    • Phishing-resistant access controls, given how consistently phishing and impersonation of bodies like ICMR or CDSCO show up as an entry vector
    • Incident response plans built around clinical continuity, so a ransomware event doesn’t force a hospital back to paper records mid-treatment
    • Data mapping aligned to DPDP obligations, so the organisation actually knows where patient and research data lives before a regulator, or an attacker

    The Bottom Line

    Pharma and healthcare in India aren’t targeted because they’re careless. They’re targeted because they sit at the intersection of high-value data, legacy infrastructure, and an attack surface that keeps expanding faster than most security budgets do. Organisations that manage this well treat cybersecurity and data compliance as a single, connected discipline rather than two separate line items.

    As a cybersecurity company in India working closely with healthcare and pharmaceutical organisations, we’ve seen firsthand how much difference a properly mapped, DPDP-aligned security posture makes when an incident does happen. If your organisation hasn’t stress-tested where its clinical, research, and vendor networks actually stand, that’s a conversation worth having with Everence before an attacker forces it.

  • DPDP Compliance & RBI Forensic Audits: What Banks Need to Know in 2026

    DPDP Compliance & RBI Forensic Audits: What Banks Need to Know in 2026

    A branch manager gets a call on a Friday evening. A large-value account has been flagged, the borrower’s financials don’t add up, and the audit committee wants answers by Monday. Somewhere in that same institution, a compliance officer is quietly trying to figure out whether the personal data sitting inside that borrower’s file is even being processed the way the DPDP Act now requires. Two conversations, happening in two different departments, used to run on entirely separate tracks. In 2026, they don’t anymore.

    For Indian banks, the RBI forensic audit process and DPDP compliance are converging into a single operating reality. One governs how you investigate financial wrongdoing. The other governs how you handle the personal data you touch in the process. Banks that treat these as two separate compliance checklists are going to find themselves exposed, not because either requirement is unreasonable on its own, but because the overlap between them is where the real risk sits.

    Why Have RBI Forensic Audits Changed Shape?

    The RBI’s Fraud Risk Management Directions, tightened through 2024 and reissued for different categories of regulated entities through 2026, have pushed forensic audits from a reactive, post-fraud exercise into something closer to a structured governance requirement. Boards are now expected to have a fraud risk management policy in place before an incident happens, not after. Early Warning Signals and Red Flagging of Accounts have to be operational, not aspirational.

    What’s genuinely shifted the ground, though, is the Supreme Court’s 2023 ruling, which made it clear that borrowers must get a fair hearing, backed by the principles of natural justice, before an account is classified as fraud. That single judgment has reshaped how an RBI forensic audit gets conducted on the ground. It’s no longer enough to produce a technically sound forensic report. The process leading up to it, the notice given, the opportunity to respond, the documentation trail, all of it now has to withstand judicial scrutiny. We’ve seen banks challenged in court not on the substance of a forensic finding, but on whether the procedure around it was fair.

    This is exactly where an independent, court-defensible forensic audit stops being a formality and becomes a genuine safeguard for the bank.

    Digital Forensic Company in India

    What a Proper Forensic Audit Actually Involves

    A forensic audit for a suspected fraud account isn’t a generic financial review. It typically covers:

    Digital Trail Reconstruction

    Emails, transaction logs, internal system access records, and communication threads have to be pulled, preserved, and analysed in a way that holds up if the matter ends up in a tribunal or court. Deleted or altered records are often the most telling part of an investigation, and recovering them correctly, without compromising their evidentiary value, requires forensic-grade tools, not a quick IT team look-through.

    Financial Flow Mapping

    Tracing where funds actually went, across accounts, shell entities, and related parties, is central to establishing intent. This is usually where the real story of a fraud account emerges, well beyond what the loan file shows on paper.

    Chain of Custody Documentation

    Every piece of digital evidence needs a documented history: who accessed it, when, and how it was preserved. In our experience, this is the single most common weak point we find when banks bring us in after an internal team has already made a first attempt. A forensic finding can be technically accurate and still get thrown out if the chain of custody doesn’t hold.

    Staff Accountability Review

    RBI’s directions explicitly require banks to examine whether internal lapses, negligence, or collusion contributed to the fraud. That means the audit has to look inward as much as it looks at the borrower.

    Forensic Malware Investigation Services in India

    Where DPDP Compliance Enters the Picture

    Here’s what most people don’t realise: every one of those forensic activities involves processing personal data, sometimes of the accused, sometimes of third parties, employees, or witnesses who were never part of the original transaction. Under DPDP Compliance obligations, that data doesn’t get a free pass just because it’s part of a fraud investigation.

    The DPDP Rules, notified in November 2025, bring in phased obligations around notice, consent, data minimisation, and breach reporting, with the full regime taking effect by May 2027. But banks shouldn’t read that timeline as room to wait. Enforcement powers and penalties come into effect well before the final deadline, and the Data Protection Board is already constituted. For an industry that handles some of the most sensitive personal and financial data in the country, building DPDP-aligned practices into forensic workflows now is simply good governance, not a box to tick later.

    Practically, this means:

    • Personal data pulled during an RBI forensic audit should be scoped tightly to what the investigation actually needs, not swept in wholesale
    • Access to forensic evidence containing personal data needs its own logging and audit trail, separate from the general investigation record.
    • Data retention timelines for evidence have to be reconciled against DPDP’s retention principles, especially once a case is closed.
    • Breach protocols need to account for scenarios where forensic evidence itself is compromised or exposed during the investigation

    This is where things get interesting for compliance teams. A forensic audit designed purely around RBI’s fraud directions can inadvertently create DPDP exposure, simply by how broadly it collects and retains data. The two frameworks need to be read together, not run in parallel silos.

    Malware Investigation Services in India

    Bank Fraud Investigation Services That Actually Hold Up

    What separates a defensible investigation from a vulnerable one usually comes down to process discipline. Banks that engage experienced bank fraud investigation services early, before evidence gets touched by internal teams unfamiliar with forensic protocols, tend to end up with findings that survive both regulatory review and legal challenge.

    This matters even more with RBI fraud accounts, because classification decisions carry real consequences: credit reporting impact, potential criminal referral, and reputational fallout for all parties involved. Getting the process wrong doesn’t just weaken a case; it can expose the bank to legal challenge from the very party it was investigating.

    Building a 2026-Ready Framework

    Banks that are ahead of this curve are doing a few things consistently:

    1. Bringing in independent forensic expertise before a fraud is formally classified, not after a dispute arises
    2. Building DPDP-aware data handling into forensic SOPs from the start, rather than retrofitting them later
    3. Training internal fraud risk teams on the natural justice requirements that now shape every RBI forensic audit
    4. Treating evidence chain of custody as a legal requirement, not an internal formality

    The Bottom Line

    RBI forensic audits and DPDP Compliance were built by different regulators for different purposes, but for banks, they now sit on the same desk. Getting a fraud investigation technically right while getting the data handling wrong, or vice versa, still leaves the institution exposed.

    As a Digital Forensic Services Company in India working closely with banks and financial institutions, we’ve found that the strongest investigations are the ones built with both frameworks in mind from day one. If your institution is reviewing how its forensic audit processes hold up against 2026’s regulatory expectations, it’s worth having that conversation before an account, not after one, forces the issue.

    Talk to our team at Everence to understand how your fraud risk management and data protection practices align with where RBI and DPDP compliance are both heading.

  • Ransomware Attack Response: A Step-by-Step Guide for Businesses

    Ransomware Attack Response: A Step-by-Step Guide for Businesses

    A ransomware attack rarely begins with a dramatic warning on your screen. It often starts with something that seems harmless: an worker clicking a malicious link, opening an infected attachment, or using compromised login credentials. Within minutes or hours, critical systems can become inaccessible, files can be encrypted, and business operations can be brought to a standstill.

    When this happens, every decision matters. Panic-driven actions can destroy valuable evidence, complicate recovery, or even increase financial losses. A structured response, backed by experienced cybersecurity and digital forensic professionals, can significantly improve the chances of containment and recovery.

    This guide outlines the essential steps businesses should take during a ransomware attack, helping minimise damage while preparing for a secure recovery.

    Understanding a Ransomware 

    A ransomware attack is a kind of cyberattack in which attackers encrypt an organisation’s files or systems and demand compensation in exchange for a decryption key. Modern ransomware groups often go beyond encryption by stealing sensitive data before locking systems, threatening to publish confidential information if the ransom is not paid.

    Organisations across industries, including healthcare, finance, manufacturing, retail, government, and education, have become frequent targets because downtime can quickly translate into financial and operational losses.

    Today’s ransomware attacks are carefully planned. Attackers often pay days or weeks inside a network, identifying valuable systems, disabling security controls, and stealing data before launching an encryption campaign.

    Step 1: Isolate the Affected Systems Immediately

    The first priority during a ransomware incident is containment.

    As soon as unusual encryption activity or ransom notes are detected:

    • Disconnect affected devices from the network.
    • Disable Wi-Fi and remote connections where necessary.
    • Isolate infected servers from the rest of the infrastructure.
    • Prevent access to shared drives if possible.

    Avoid shutting systems down immediately unless instructed by incident response experts. Active systems may contain valuable forensic evidence that can help investigators understand how the attackers gained access.

    Fast isolation helps prevent the ransomware from spreading across additional systems.

    Step 2: Activate Your Incident Response Plan

    Every organisation should have a documented cyber incident response plan before an attack occurs.

    This plan typically includes:

    • Internal escalation procedures
    • Incident response team contacts
    • Legal and compliance representatives
    • IT leadership
    • External cybersecurity partners
    • Communication protocols

    Clearly assigning responsibilities helps reduce confusion during an already stressful situation.

    If your organisation has cyber insurance, notify the insurer according to policy requirements, as many policies specify approved response procedures.

    Step 3: Identify the Scope of the Attack

    One of the biggest mistakes organisations make is assuming they know how much of the network has been affected.

    A professional assessment should determine:

    • Which endpoints are encrypted
    • Which servers have been compromised
    • Whether backups are affected
    • If cloud environments have been accessed
    • Whether sensitive data has been exfiltrated

    Modern ransomware groups frequently target backup systems before initiating encryption, making early assessment critical.

    Understanding the true scope of the attack guides every recovery decision that follows.

    Step 4: Preserve Digital Evidence

    Recovering systems is important, but preserving evidence is equally critical.

    Digital evidence helps answer key questions such as:

    • How did attackers enter the network?
    • Which vulnerabilities were exploited?
    • What accounts were compromised?
    • What information was accessed or stolen?
    • Are the attackers still present?

    This is where a Digital Forensic Services Company in India plays an essential role.

    Digital forensic experts collect logs, analyse system activity, preserve volatile data, review authentication records, examine malware behaviour, and document findings in a legally defensible manner. These insights are invaluable for regulatory reporting, insurance claims, legal proceedings, and strengthening future security.

    Step 5: Avoid Paying the Ransom Immediately

    Paying the ransom may appear like the fastest solution, but it carries significant risks.

    There is no guarantee that attackers will:

    • Provide a working decryption key
    • Delete stolen data
    • Refrain from targeting the organisation again

    In some cases, businesses receive incomplete or non-functional decryption tools even after payment.

    Instead, organisations should evaluate all available recovery options with guidance from cybersecurity professionals, legal advisors, and relevant authorities.

    Step 6: Begin Secure Recovery

    Once the threat has been contained and forensic evidence secured, recovery can begin.

    Recovery typically includes:

    Restoring Clean Backups

    If secure backups are available and verified to be malware-free, systems can be restored in a controlled manner.

    Each restored environment should be carefully monitored before being reconnected to the production network.

    Malware Removal

    Simply decrypting files is not enough.

    Hidden malware, backdoors, scheduled tasks, or compromised administrator accounts may still exist within the network.

    Comprehensive malware eradication ensures attackers cannot regain access after recovery.

    Validate System Integrity

    Before returning to normal operations:

    • Verify security patches
    • Review privileged accounts
    • Reset compromised credentials
    • Test business applications
    • Confirm endpoint protection is functioning correctly

    Recovery should prioritise security, not speed alone.

    Step 7: Use Professional Ransomware Data Recovery Services

    Not every organisation has complete or usable backups.

    In such situations, specialised ransomware data recovery services may help recover encrypted or partially damaged data depending on the ransomware variant, available backups, and system condition.

    Recovery specialists use advanced forensic techniques to:

    • Assess encryption methods
    • Identify available decryption tools where applicable
    • Recover accessible files
    • Restore deleted or damaged information
    • Validate recovered data integrity

    While recovery success depends on several technical factors, expert intervention often improves outcomes compared to attempting recovery without specialised support.

    Step 8: Notify Stakeholders and Meet Compliance Requirements

    Many ransomware attacks involve unauthorised access to sensitive or regulated data.

    Organisations may have legal obligations to notify:

    • Customers
    • Regulatory authorities
    • Business partners
    • Financial institutions
    • Law enforcement agencies

    Accurate forensic findings support transparent reporting and help organisations meet applicable compliance requirements.

    Clear communication also helps preserve customer confidence during recovery.

    Step 9: Conduct a Post-Incident Security Review

    Once business operations resume, the work isn’t over.

    A detailed post-incident review helps identify weaknesses that allowed the attack to succeed.

    Questions worth asking include:

    • Were security patches missing?
    • Was multi-factor authentication enabled?
    • Were privileged accounts adequately protected?
    • Were employees trained to identify phishing attempts?
    • Were backups properly isolated?
    • Was endpoint monitoring sufficient?

    Lessons learned from one incident can significantly strengthen long-term cyber resilience.

    Building Stronger Defences Against Future Ransomware Attacks

    Prevention remains the most useful strategy against ransomware.

    Organisations should implement layered security measures, including:

    • Multi-factor authentication (MFA)
    • Endpoint Detection and Response (EDR)
    • Regular vulnerability assessments
    • Security awareness training
    • Offline and immutable backups
    • Email security controls
    • Network segmentation
    • Continuous monitoring

    Partnering with an experienced Cybersecurity company in india enables businesses to proactively identify vulnerabilities, strengthen security controls, and prepare effective incident response plans before attackers have an opportunity to exploit weaknesses.

    Why Digital Forensics Matters in Ransomware Investigations

    A ransomware incident doesn’t end when systems are restored. Businesses also need to understand what happened, how it happened, and whether sensitive information was exposed.

    Digital forensics provides those answers.

    A trusted Digital Forensic Services Company in India investigates the full attack lifecycle, from initial compromise and lateral movement to data access and encryption activity. This deeper understanding helps organisations close security gaps, improve future response capabilities, and support regulatory or legal requirements with reliable evidence.

    Conclusion

    A ransomware attack is one of the most disruptive cyber incidents a business can face, but a well-planned response can significantly reduce its impact. Acting quickly to isolate systems, preserve evidence, assess the extent of the breach, and recover securely is far more effective than making rushed decisions under pressure.

    At Everence, we help organisations prepare for, respond to, and recover from sophisticated cyber threats through expert incident response, digital investigations, and proactive security services. Whether you require ransomware data recovery services, a trusted Cybersecurity company in india, or the expertise of a Digital Forensic Services Company in India, having the right partner can make all the difference when every minute counts.

  • Business Email Compromise (BEC): Warning Signs, Prevention & Best Security Practices

    Business Email Compromise (BEC): Warning Signs, Prevention & Best Security Practices

    Business email has become the backbone of modern organisations. From approving vendor payments to sharing confidential documents and discussing strategic decisions, countless business-critical activities happen through email every day. Unfortunately, cybercriminals know this too. Instead of trying to break through complex security systems, they often target the people behind them using business email compromise tactics.

    Unlike traditional cyberattacks that rely on malware, Business Email Compromise (BEC) is built on deception. A convincing email that appears to come from a trusted executive, supplier, or business partner can be enough to trigger a costly financial transfer or expose sensitive company information. The damage often extends beyond financial losses, affecting customer trust, legal compliance, and business reputation.

    Understanding how these attacks work and executing the right preventative measures is essential for every organisation.

    What Is Business Email Compromise?

    Business email compromise is a cyberattack in that the attackers manipulate employees into performing actions that benefit them. These actions may include transferring money, sharing confidential information, changing banking details, or granting access to business systems.

    Unlike mass spam campaigns, BEC attacks are carefully planned. Attackers spend time researching an organisation, its executives, vendors, internal processes, and communication style before launching an attack.

    In many cases, they don’t even need to hack into an email account. Simple email spoofing techniques can make an email appear legitimate enough to deceive recipients.

    Why BEC Attacks Are So Effective

    What makes BEC attacks particularly dangerous is that they exploit trust instead of technology.

    Cybercriminals study organisational structures through company websites, LinkedIn profiles, press releases, and publicly available information. They identify decision-makers, finance personnel, HR teams, and executives before crafting highly personalised messages.

    Some common scenarios include:

    • A CEO requesting an urgent wire transfer.
    • A vendor informing accounts payable about updated bank details.
    • HR is receiving a request to share employee tax information.
    • A legal department receiving confidential acquisition documents.

    Since these requests often resemble normal business communication, they are much harder to detect than generic phishing emails.

    Common Techniques Used in BEC Attacks

    Email Spoofing

    Email spoofing involves forging the sender’s address to make an email appear to have originated from a trusted source.

    For example, an attacker may replace a single character in a company’s domain name, hoping the recipient overlooks the difference.

    Instead of:

    company.com

    The attacker may use:

    cornpany.com

    At first glance, both appear nearly identical.

    Compromised Business Accounts

    Sometimes attackers successfully gain access to a legitimate employee’s mailbox using stolen credentials.

    Once inside, they monitor conversations for days or even weeks before sending fraudulent payment requests from the genuine email account.

    These attacks are especially difficult to identify because the emails come from legitimate accounts with existing conversation histories.

    Executive Impersonation

    Senior executives are common targets because employees often hesitate to question urgent requests coming from leadership.

    Attackers frequently impersonate CEOs, CFOs, or directors while requesting confidential information or immediate financial transactions.

    Vendor Fraud

    Organisations working with multiple suppliers are especially vulnerable.

    Attackers monitor vendor communications and eventually send updated payment instructions, diverting payments into fraudulent accounts.

    Warning Signs You Should Never Ignore

    Although BEC attacks are becoming increasingly sophisticated, many still leave subtle warning signs.

    Be cautious when receiving an email:

    • Creates a sense of urgency.
    • Requests immediate payment.
    • Asks to bypass standard approval procedures.
    • Contains slight variations in email addresses.
    • Requests confidential financial or employee information.
    • Includes unexpected banking detail changes.
    • Uses unusual language or formatting.

    Training employees to recognise these indicators significantly reduces organisational risk.

    How to Prevent Business Email Compromise Attacks

    Preventing business email compromise requires a combination of technology, employee awareness, and well-defined business processes.

    Strengthen Email Authentication

    Implement modern email authentication standards such as:

    • SPF (Sender Policy Framework)
    • DKIM (DomainKeys Identified Mail)
    • DMARC (Domain-based Message Authentication, Reporting and Conformance)

    These technologies help prevent unauthorised parties from using your organisation’s domain to spoof email.

    Enable Multi-Factor Authentication (MFA)

    Even if employee credentials are compromised, Multi-Factor Authentication provides an additional layer of security.

    MFA significantly reduces the chances of attackers accessing legitimate business email accounts.

    Every privileged account, executive mailbox, finance user, and administrator should have MFA enabled.

    Verify Financial Requests Independently

    Never approve payment requests solely based on email communication.

    Establish verification procedures such as:

    • Phone confirmation
    • Video verification
    • Secondary management approval
    • Internal workflow validation

    A simple verification step can prevent substantial financial losses.

    Conduct Regular Employee Awareness Training

    Technology alone cannot eliminate BEC attacks.

    Employees remain the first line of defence.

    Organisations should regularly educate teams about:

    • Recognising suspicious phishing emails
    • Identifying impersonation attempts
    • Reporting unusual requests
    • Safe handling of confidential information
    • Password hygiene and MFA practices

    Practical simulations help employees recognise real-world attack scenarios more effectively than theoretical training.

    Limit Publicly Available Information

    Attackers often gather intelligence from social media and company websites.

    Consider limiting unnecessary disclosures such as:

    • Internal organizational charts
    • Executive travel schedules
    • Employee contact directories
    • Financial team information

    Reducing publicly available information makes social engineering more difficult.

    Monitor Email Activity

    Advanced email security solutions can detect unusual login patterns, suspicious forwarding rules, abnormal sender behaviour, and unauthorised mailbox access.

    Continuous monitoring enables organisations to identify compromised accounts before attackers cause significant damage.

    Maintain Incident Response Procedures

    Despite preventive measures, incidents can still occur.

    Every organisation should have documented procedures covering:

    • Incident reporting
    • Account isolation
    • Password resets
    • Evidence preservation
    • Regulatory notification
    • Internal communication

    Preparedness minimises business disruption and supports faster recovery.

     

    The Role of Digital Forensics After a BEC Incident

    When a business email compromise attack succeeds, the priority extends beyond simply recovering access to the email account.

    Organisations must determine:

    • How attackers gained access.
    • Which accounts were affected?
    • Whether confidential information was stolen.
    • If additional systems were compromised.
    • What evidence is required for legal or regulatory purposes?

    This is where specialised digital forensic expertise becomes critical.

    A professional Digital Forensic Services Company in India conducts a structured investigation by preserving digital evidence, analysing email headers, reviewing authentication logs, tracing attacker activity, and documenting findings in a legally defensible manner.

    These investigations not only support recovery but also help organisations strengthen future security controls.

    Why Prevention Is More Cost-Effective Than Recovery

    Many organisations underestimate the true cost of BEC attacks.

    Beyond direct financial losses, businesses often face:

    • Regulatory investigations
    • Legal expenses
    • Operational downtime
    • Loss of customer confidence
    • Reputation damage
    • Recovery and remediation costs

    Investing in preventive cybersecurity measures is significantly more economical than managing the aftermath of a successful attack.

    Working with an experienced Cybersecurity company in india allows businesses to identify vulnerabilities, improve email security, implement proactive monitoring, and develop effective incident response strategies before attackers exploit weaknesses.

    Building a Long-Term Defence Against BEC

    Cybercriminals continue to refine their techniques, making business email compromise one of the fastest-evolving cyber threats facing organisations today. The good news is that most successful attacks exploit process gaps rather than highly advanced technical vulnerabilities.

    By combining secure email infrastructure, employee awareness, strong authentication, financial verification procedures, and continuous monitoring, organisations can dramatically reduce their exposure to BEC attacks.

    At Everence, we help organisations build resilient cybersecurity strategies that go beyond prevention. From proactive security assessments to incident response and digital investigations, our experts help businesses detect, investigate, and respond to sophisticated cyber threats with confidence. Whether you’re looking for a trusted Cybersecurity company in india or a reliable Digital Forensic Services Company in India, investing in the right expertise today can prevent costly incidents tomorrow.

  • Mobile Device Forensics in India: Extracting Evidence from Smartphones Legally

    Mobile Device Forensics in India: Extracting Evidence from Smartphones Legally

    Your phone knows more about you than most people do. In a criminal investigation or corporate dispute, that’s either your strongest asset or your most damning liability.

    Picture this: a senior executive at a logistics company is suspected of leaking bid information to a competitor. There are no witnesses. No paper trail. The company’s legal team is convinced something happened, but they have nothing concrete to take to court. Then a mobile forensic investigation team steps in. Within days, they’ve recovered deleted WhatsApp threads, mapped call logs to the competitor’s number, and extracted GPS metadata from photos shared over a messaging app. The case moves forward.

    This scenario is no longer rare. As smartphones have become the primary instrument of both professional communication and personal conduct, they’ve also become the most information-dense source of evidence available to investigators. In India, where over a billion people use mobile phones and a significant proportion of cybercrimes, fraud cases, and corporate disputes now run entirely over mobile networks, mobile forensics has quietly become the backbone of digital investigation.

    But extracting that evidence isn’t as simple as plugging in a phone and pressing download. Done incorrectly, the evidence is inadmissible. Done illegally, it creates new liability. What separates a successful mobile forensic investigation from a failed one is almost entirely a question of method, expertise, and legal compliance.

    What Mobile Forensics Actually Involves

    Mobile forensics is the scientific discipline of acquiring, preserving, analysing, and presenting digital evidence from smartphones and other handheld devices in a manner that is legally defensible and court-admissible.

    The scope of what can be extracted from a modern smartphone during a forensic investigation is extensive:

    • Call logs, incoming, outgoing, missed, and deleted call records with timestamps
    • SMS and MMS data, including messages deleted from the inbox
    • Application data, WhatsApp, Telegram, Signal, Instagram, and other platform conversations
    • Emails, stored locally on the device, often with metadata intact
    • Browser history, including cached data, cookies, and searched terms
    • Photos and videos, along with EXIF metadata revealing date, time, and GPS coordinates
    • Location data, GPS logs, Wi-Fi connection history, and cell tower association records
    • Contacts and calendar entries, often revealing relationship patterns relevant to investigations
    • Cloud-linked data, Google Drive, iCloud, and app-specific backups are accessible via the device

    What most people don’t realise is that deleting data from a smartphone doesn’t necessarily erase it. Until the physical storage sectors are overwritten, which happens gradually through normal device use, forensic tools can often recover fragments, complete files, or database entries that the user believed were gone permanently.

    This is precisely what makes smartphone forensic analysis so powerful and so consequential.

    The Legal Framework: What Makes Mobile Evidence Admissible in India

    Here’s where mobile forensic investigation in India gets nuanced, and where the choice of forensic partner becomes critical.

    India’s legal framework governing digital evidence has evolved significantly. The Bharatiya Sakshya Adhiniyam, 2023 (BSA), which replaced the Indian Evidence Act effective July 2024, modernises the evidentiary standards for electronic records. Section 63 of the BSA carries forward the substance of the earlier Section 65B framework, establishing four core conditions for admissibility of digital evidence:

    1. The electronic record was produced by a computer or device in regular use
    2. The device was operating properly at the time the data was created or stored
    3. The data accurately reproduces the information fed into the computer
    4. The information was supplied in the ordinary course of activities

    For mobile evidence specifically, this means two things in practice. First, a Section 63 certificate must accompany any electronic record submitted as evidence, signed by the person in lawful control of the device and, ideally, independently verified by a qualified forensic expert with a hash value confirmation. Second, the chain of custody must be documented without interruption from the moment the device is seized to the moment the evidence is presented.

    It’s worth being direct about what this means: screenshots of WhatsApp conversations are not sufficient evidence in Indian courts. A screenshot without forensic extraction, metadata verification, and a proper certificate can be, and frequently is, challenged and excluded. Deleted messages recovered through non-certified methods face the same fate.

    Engaging a qualified digital forensics company in India that understands both the technical and legal dimensions of mobile evidence is not a formality. It is a prerequisite.

    How Deleted Data Recovery Works, and Its Limits

    One of the most common questions legal teams and corporates ask is whether deleted data can be recovered. The answer is: sometimes, yes, but with important caveats.

    When data is deleted from an Android or iOS device, the operating system typically marks those storage sectors as available for reuse, but doesn’t immediately overwrite the data. Forensic tools can often read those sectors before they are overwritten, recovering partial or complete records. This applies to messages, call logs, photos, and even app-specific databases.

    Several factors determine what’s recoverable:

    Time elapsed since deletion is the most significant variable. A device that has been in continuous active use for weeks after a deletion event is far less likely to yield recoverable data than one seized within days. Forensic work initiated promptly has a materially higher success rate.

    Device type and operating system matter considerably. iOS and Android handle storage allocation differently, and each new OS version introduces changes that affect what is forensically accessible. The extraction approach- logical, file system, physical, or chip-off- is selected based on the device, its condition, and what data is being sought.

    Encryption is the biggest technical challenge in modern mobile forensics. Both iOS and Android encrypt device storage by default, and encrypted messaging apps add a second layer. Accessing encrypted data typically requires either the device passcode, a forensic exploit specific to the device model, or extraction from unencrypted cloud backups associated with the account.

    Cloud backups deserve particular attention. Google Drive and iCloud backups often contain older data that has since been deleted from the device, including message histories that go back months. In many corporate investigations, cloud backups are more forensically valuable than the devices themselves.

    The Mobile Forensic Investigation Process

    A rigorous mobile forensic investigation conducted by a professional digital forensics company in India follows a structured methodology, one designed as much for legal defensibility as for technical efficacy.

    Seizure and isolation: The device must be secured immediately and isolated from all networks. This means enabling flight mode or placing the device in a Faraday bag, which blocks all radio signals and prevents remote wipe commands from reaching the device. Remote wipe is a real concern; both iOS and Android allow account holders to remotely erase devices, and the window between a suspect realising they’re under investigation and a device being secured can be very narrow.

    Forensic imaging: A bit-for-bit forensic image of the device’s storage is created using write-blocking tools that ensure no data on the original device is altered during the process. This image becomes the working copy; all analysis is performed on it, preserving the original as evidence.

    Data extraction: Depending on the device and the investigation objectives, extraction is performed at one of several levels: logical extraction (accessible data and backups), file system extraction (broader access, including app databases), or physical extraction (full bit-level access to storage, enabling deeper recovery of deleted data). Physical extraction is the most comprehensive but also the most technically demanding.

    Analysis and reconstruction. Extracted data is processed using validated forensic tools; Cellebrite UFED, Magnet AXIOM, Oxygen Forensic Detective, and XRY are among the most widely used in professional smartphone forensic analysis. These platforms correlate data across apps, reconstruct timelines, and surface artefacts that wouldn’t be visible through manual review.

    Reporting and certification Findings are compiled into a forensic report that documents the methodology, tools used, hash values confirming data integrity, and a clear chain of custody. The report is structured to be usable by legal counsel, presented to law enforcement, or produced in court proceedings.

    Common Use Cases in India

    Mobile forensic investigation is deployed across a wider range of scenarios than most people expect:

    Corporate investigations, insider threats, data leakage, IP theft, and employee misconduct cases in which personal or company-issued devices may contain evidence of policy violations or criminal activity.

    Cyber fraud and financial crime, UPI scams, banking fraud, cryptocurrency fraud, and investment scheme operations that predominantly run over mobile messaging apps and payment platforms.

    Matrimonial and family law disputes are a growing area in Indian courts, where mobile evidence, including communications, location data, and financial transactions, is frequently relevant.

    Defamation and harassment cases, where the origin, timing, and distribution chain of messages or media need to be forensically established.

    Criminal investigations, supporting law enforcement in cases ranging from organised crime to white-collar offences, where mobile devices are typically the primary evidence source.

    Why “Do It Yourself” Mobile Evidence Collection Fails

    It bears addressing directly: organisations and individuals who attempt to collect mobile evidence without specialist support consistently encounter the same problems in court.

    Data collected without proper write-blocking is considered potentially compromised; accessing a device without forensic tools can alter metadata and timestamps. Evidence without a Section 63 certificate is inadmissible as secondary evidence. Deleted data recovery attempts with consumer tools frequently overwrite the very sectors that contain the data being sought. And none of it matters if the chain of custody can’t be demonstrated.

    The courts are increasingly sophisticated on these matters. Opposing counsel in any serious case will probe the collection methodology. A forensic investigation that doesn’t withstand that scrutiny doesn’t just fail; it can actively damage the case it was meant to support.

    Choosing a Mobile Forensics Partner: What to Look For

    When evaluating a digital forensics company in India for mobile forensic work, the criteria go beyond certifications, though those matter too.

    • Tool validation: Are they using industry-recognised forensic platforms with documented methodology? Cellebrite, Magnet AXIOM, and XRY are the benchmark.
    • Legal literacy: Do they understand the BSA 2023 framework and Section 63 certificate requirements? Can they work in coordination with your legal counsel from day one?
    • Device coverage: Can they support both iOS and Android across multiple OS versions, including newer versions, and on newer models? Extraction complexity varies significantly by device.
    • Response speed: Can they secure and begin processing devices quickly? The forensic window closes with every hour of continued device use.
    • Experience in your use case: Financial fraud, corporate investigation, and criminal defence work each have specific evidentiary priorities. Domain experience matters.

    Closing Thoughts

    The smartphone in a person’s pocket is, forensically speaking, one of the most comprehensive records of their behaviour, relationships, and communications ever to exist. In investigations where the truth is contested, that record is often the closest thing to an objective account of events.

    But accessing it, legally, completely, and in a form that holds up in court, requires a level of technical precision and legal awareness that goes well beyond basic data recovery. Mobile forensics is a discipline where shortcuts don’t just produce inferior results. They produce inadmissible ones.

    If you’re dealing with a situation where smartphone data may be relevant to a dispute, investigation, or compliance matter, the most important step is also the earliest one: engage a qualified forensic partner before any more of that evidence window closes.

  • Digital Forensics in Financial Fraud Investigations: A Complete Guide

    Digital Forensics in Financial Fraud Investigations: A Complete Guide

    When money disappears and digital trails go cold, forensic science is what separates a dead end from a decisive verdict.

    A mid-sized manufacturing company in Pune discovers that ₹4.2 crore has been siphoned out over 18 months. The transactions look legitimate on paper, but something is off. The CFO suspects an insider. Legal counsel wants evidence. The police need a chain of custody. The company needs answers by yesterday.

    This is not a hypothetical. Scenarios like this play out every week across Indian businesses, large and small. And in most of them, the difference between recovering losses and watching a case collapse in court comes down to one thing: the quality of the digital forensics investigation that runs underneath it.

    Financial fraud no longer lives in ledgers and filing cabinets. It lives in deleted emails, manipulated spreadsheets, encrypted messaging apps, and cryptocurrency wallets. Understanding how digital forensic services work and why they matter is no longer just a concern for legal teams. It’s a business-critical conversation.

    The Scale of Financial Fraud in India, and Why Digital Evidence Is Everything

    Let the numbers speak first.

    Metric Figure
    Reported financial fraud cases in India, 2024 36.4 lakh
    Total losses from financial fraud, 2024 ₹22,845 crore
    Year-on-year increase in reported cases 206%

    What’s striking about these figures isn’t just the volume, it’s the trajectory. Cyber fraud investigation in India has become one of the fastest-growing areas of legal and corporate services precisely because fraud has moved almost entirely into the digital domain. Invoice fraud, payroll manipulation, UPI-based scams, procurement kickbacks, trade-based money laundering- virtually all of it leaves a digital footprint. The challenge is knowing where to look and how to preserve what you find.

    “Most fraud cases don’t fail because the evidence doesn’t exist. They fail because the evidence was never properly collected, or it was collected too late.”

    What Digital Forensics Actually Does in a Fraud Investigation

    There’s a common misconception that digital forensics is just about recovering deleted files. It’s far more than that. A rigorous financial fraud investigation using forensic tools involves reconstructing a complete timeline of events, who accessed what, when, from where, and what they did with it.

    Here’s what that looks like in practice across the key areas a forensic investigation company in India would cover:

    Computer and Device Forensics

    Every laptop, desktop, or server involved in the suspected fraud is forensically imaged, creating an exact, tamper-proof replica of the device’s storage. From there, investigators can recover deleted files, browsing history, document metadata (who created it, when it was last modified, and by whom), and application logs. In financial fraud cases, this often reveals altered invoices, fabricated approval chains, or sensitive documents exfiltrated before an employee resigned.

    Email and Communication Analysis

    Email is still the primary channel for collusion and cover-up. Forensic email analysis doesn’t just look at what was sent; it examines headers, server logs, and metadata to detect spoofed addresses, forwarding rules that redirect sensitive correspondence, or emails that were deleted from servers but remain in backup systems. In vendor fraud cases in particular, this layer of investigation frequently uncovers the relationship between an internal actor and an external party.

    Network and Log Analysis

    System access logs and network traffic data are among the most reliable forms of evidence in a financial fraud investigation. They are difficult to falsify comprehensively, and they tell a precise story: which user credentials logged into which systems, what data was accessed, and when transfers were initiated. In cases of insider fraud, this analysis often reveals that access patterns changed significantly weeks or months before a fraud event, a detail that would be impossible to surface without a forensic investigation.

    Mobile Device and Messaging Forensics

    WhatsApp, Telegram, and Signal, encrypted messaging platforms, have become the communication layer of choice for fraudsters who know that email creates an audit trail. Mobile forensics can extract conversation data, deleted messages (under certain conditions), and metadata from these platforms in a legally defensible format. This is an area where the gap between consumer-grade tools and professional digital forensic services is most stark.

    Financial Data and Accounting Forensics

    When the fraud involves manipulation of accounting records, false entries, ghost employees, and inflated vendor payments, digital forensics works in tandem with forensic accounting. Investigators examine ERP and accounting software logs to identify who made specific entries, whether approval workflows were bypassed, and whether data was altered after the fact. Modern financial systems log far more than most organisations realise.

    The Forensic Investigation Process: From Incident to Courtroom

    One of the things that distinguishes a serious forensic investigation company in India from a general IT security vendor is process discipline. Evidence that isn’t collected and preserved correctly gets thrown out. Here is the standard methodology that rigorous digital forensic services follow:

    1. Scope and triage: Define what’s suspected, which systems are potentially implicated, and what the legal objectives are. A rushed scope at this stage leads to evidence gaps later.
    2. Evidence identification and preservation: All relevant devices, accounts, and data sources are identified. Forensic imaging is performed using write-blockers to ensure the original data is never altered. Chain of custody documentation begins immediately.
    3. Acquisition and analysis: Forensic copies are processed using validated tools. Analysis reconstructs the sequence of events, identifies anomalies, and extracts artefacts relevant to the alleged fraud.
    4. Documentation and reporting: Findings are compiled into reports that are technically precise, legally articulate, and structured for use by counsel, compliance teams, or law enforcement agencies.
    5. Expert testimony support In litigation or enforcement proceedings, forensic experts may be required to explain findings in court. This is where the quality of documentation made at every prior stage determines credibility.

    Why Timing Is the Most Underestimated Factor in Fraud Investigations

    Here’s where most organisations get it wrong. When fraud is suspected, the instinct is to investigate internally first, quietly, without escalating. The problem is that every day that passes without a proper forensic hold on relevant systems is a day during which evidence can be overwritten, deleted, or, in the worst cases, actively destroyed.

    Digital storage systems routinely overwrite log data. Backup retention policies have expiry windows. Devices get reassigned. Employees who suspect they’re under scrutiny may begin wiping data. What most people don’t realise is that a forensic investigation launched four weeks after a suspected fraud event is categorically different, and far less effective, than one launched within 72 hours of discovery.

    This is why working with an experienced forensic investigation company in India that can respond rapidly and deploy remote or on-site forensic tools at short notice isn’t a luxury; it’s often the difference between a prosecutable case and an inconclusive one.

    Compliance, Regulation, and Why This Matters Beyond Litigation

    Not every financial fraud investigation ends up in court. Many are resolved through insurance claims, internal disciplinary proceedings, regulatory disclosures, or negotiated settlements. In all of these contexts, forensic evidence plays a critical role, and so does the standard to which it was collected.

    India’s regulatory environment has become increasingly demanding on this front. SEBI, RBI, and CERT-In all have frameworks that require organisations to maintain specific standards for handling digital evidence when fraud or cybersecurity incidents are reported. Engaging digital forensics companies in India that understand these compliance requirements from the outset ensures that your investigation doesn’t create new liability while addressing an existing one.

    “In our experience, the organisations that handle fraud incidents best are not the ones with the most advanced security technology. They’re the ones with a clear escalation protocol that puts forensic-grade evidence preservation at the top of the response plan.”

    Choosing the Right Digital Forensics Partner

    Not all digital forensics companies in India operate to the same standard. When evaluating partners for financial fraud investigation support, the questions worth asking go beyond credentials:

    • Do they have specific experience with the type of fraud you’re investigating, whether that’s procurement fraud, payroll fraud, crypto-related financial crime, or capital market manipulation?
    • Are their tools and methodologies court-validated, and can they demonstrate a chain of custody from acquisition through to reporting?
    • Can they operate in a legally privileged context alongside your legal counsel, protecting the confidentiality of findings while building a usable evidentiary record?
    • Do they offer both reactive investigation services and proactive forensic readiness assessments, so you’re not starting from zero when an incident occurs?
    • What is their turnaround capacity? Can they mobilise quickly, and do they have the infrastructure to handle large volumes of data across multiple devices and platforms simultaneously?

    These questions matter because cyber fraud investigation in India has become a specialised discipline. The stakes in financial fraud cases are high for the organisation’s finances, its regulatory standing, and often its reputation. The forensic work that underpins the investigation needs to match those stakes.

    Closing Thoughts

    Financial fraud is not an event; it’s a process. It unfolds over weeks or months, leaving traces at every stage across systems, devices, and networks. The same is true of a well-run investigation: it is methodical, evidence-led, and built with the end goal in mind, whether that’s prosecution, regulatory compliance, or internal accountability.

    Digital forensic services have evolved significantly. The tools available to investigators today- forensic imaging platforms, AI-assisted log analysis, advanced mobile extraction frameworks, make it possible to reconstruct events with a level of precision that was unimaginable a decade ago. But tools alone don’t close cases. Expertise, process discipline, and the ability to translate technical findings into legally actionable intelligence do.

    If your organisation is dealing with a suspected fraud incident, or if you want to build the kind of forensic readiness that puts you in a stronger position before an incident occurs, the right time to engage a specialist is now, not after the logs have cycled, the device has been reassigned, or the employee has resigned and moved on.

  • UPI Fraud Investigation: How Digital Forensics Recovers Your Money

    UPI Fraud Investigation: How Digital Forensics Recovers Your Money

    You check your phone and notice a transaction alert. ₹40,000 — gone. You did not send it. You did not approve it. But the UPI record says otherwise.

    That sinking moment — somewhere between panic and disbelief — is where millions of Indians found themselves last year. Over 12.64 lakh UPI fraud cases were reported in FY 2024–25 alone, with total losses crossing ₹981 crore. And those are just the reported numbers. Experts consistently warn that the real scale is significantly higher, because many victims stay silent out of embarrassment, hopelessness, or simply not knowing where to go.

    Here is what most people don’t realise in that moment: the money is often not gone for good. What happens in the next 30 to 48 hours — and specifically, how methodically the incident is approached — can mean the difference between recovery and permanent loss.

    That is where digital forensics enters the picture.

    Why UPI Fraud Is a Forensic Problem, Not Just a Banking Problem

    Most fraud victims make the same mistake. They call their bank, get told to wait, file a complaint on the cybercrime portal, and then hear nothing for weeks. They treat it as a customer service issue. It is not — it is an evidentiary one.

    UPI fraud leaves behind a trail of digital artefacts: transaction IDs, device fingerprints, UPI virtual payment addresses (VPAs), IP logs, SIM-linked metadata, and app-level behaviour data. When this evidence is captured, preserved, and analysed correctly, it becomes the foundation for account freezing, fund recovery, and legal prosecution.

    When it is not — when critical logs are overwritten, time windows are missed, or complaints are filed with incomplete information — that trail goes cold fast. The fraudster moves money through multiple-layered accounts, often within minutes, and the recovery window closes.

    This is precisely why digital payment fraud in India demands a forensic response, not just a complaint number.

    The Most Common UPI Scams Targeting Indians Right Now

    Understanding how the fraud was executed is the first step in investigating it. India’s UPI fraud landscape in 2025–26 follows several recurring patterns:

    The Fake Collect Request

    Fraudsters send a UPI collect request (a debit authorisation) disguised as a refund or prize credit. The interface looks like a receive — but it is actually an authorised debit straight from your account. Victims approve it under the impression that money is coming in. The NPCI has since moved to discontinue P2P collect requests from October 2025, but legacy exploits of this mechanism remain active in ongoing cases.

    The Screen-Share Trap

    A caller poses as a bank representative or UPI app support executive. There is a problem with your account, they say. To fix it, you need to download a remote access tool — AnyDesk, TeamViewer, Quick Support. Once installed, the fraudster silently captures your UPI PIN, OTP, and banking credentials as you navigate your phone. Screen-sharing fraud is disproportionately hard to prove after the fact without forensic analysis of device-level access logs.

    QR Code Substitution

    This one hits small business owners hardest. Physical QR codes at point-of-sale locations — petrol stations, street vendors, small retailers — are quietly swapped or covered by fraudsters posing as customers or delivery agents. Customers pay, but the funds flow to a different VPA entirely. Businesses often go days or weeks before noticing the substitution.

    SIM Swap Fraud

    Among the most technically sophisticated attacks, SIM swap involves the fraudster obtaining a duplicate SIM card registered to your mobile number by exploiting telecom KYC loopholes. With your number, they intercept OTPs and take over UPI-linked accounts. Average losses in documented cases range from ₹2 lakh to ₹25 lakh. The Department of Telecom has introduced a 5-day cooling period for SIM swaps, but enforcement is uneven.

    The “Wrong Transfer” Reverse Scam

    A fraudster transfers a small amount — ₹500 or ₹1,000 — to your account, then calls claiming it was a mistake. They ask you to return it. But the “return” mechanism is actually a UPI collect request for a far larger amount. Victims authorise the request thinking they are sending back the original transfer, only to find they have approved a debit of ₹10,000 or more.

    How Digital Forensics Actually Investigates UPI Fraud

    A professional UPI scam investigation is not about calling the bank again or refreshing the cybercrime portal. It is a structured, evidence-driven process with specific technical objectives at each stage.

    Stage 1 — Evidence Preservation (The Critical Window)

    Every minute matters. The moment fraud is identified, the priority is to prevent evidence from being lost — not just to report the incident. This means capturing complete transaction logs with UTR numbers, preserving device state before any resets or app deletions, documenting the exact sequence of events, and securing all communication records: SMS, WhatsApp, call logs, emails.

    Forensic investigators create verified, hash-authenticated copies of relevant data so that the evidence remains court-admissible and untampered for the entire duration of the investigation.

    Stage 2 — Transaction Trail Analysis

    Every UPI transaction generates a unique identifier — the UTR (Unique Transaction Reference). Following this identifier through the banking network reveals which VPA received funds, which bank and branch is associated with the recipient account, and the timestamps of every subsequent movement.

    In many fraud cases, stolen funds are layered through multiple mule accounts before being withdrawn or converted. A forensic investigator maps this complete flow — a process that requires coordination with banks, the NPCI, and in some cases, law enforcement under CFCFRMS (Cyber Fraud Crime Financial Reporting Management System) protocols.

    Stage 3 — Device and Network Forensics

    If the device used in the fraud is available — either the victim’s compromised phone or in enforcement scenarios, the accused’s device — forensic extraction reveals critical intelligence. This includes residual data from remote access applications, app install and uninstall timestamps, browser history with cached phishing pages, call records corroborating vishing narratives, and network logs showing IP addresses used during the fraudulent session.

    This layer of analysis is what separates a standard complaint from a substantiated forensic report. It transforms a victim’s account into documented, technical evidence.

    Stage 4 — Legal Documentation and Coordination

    A forensic investigation is only as valuable as the documentation it produces. For UPI fraud investigation, this means assembling a detailed forensic report that maps the fraud mechanism, identifies all recoverable digital identifiers, and satisfies the evidentiary standards required under the Indian IT Act, Bharatiya Nyaya Sanhita, and the Indian Evidence Act.

    This documentation supports active engagement with the cybercrime cell, drives formal bank disputes under RBI guidelines, and — where prosecution is viable — arms legal counsel with technically defensible evidence.

    The Recovery Reality: What the Numbers Tell You

    Here is an uncomfortable truth about online payment fraud recovery in India: the official recovery rate sits at just 6% of lost funds, based on government data for April to September 2025. That is not a failure of intent — it is a failure of timeliness and methodology.

    The RBI’s framework is clear: victims who report within three working days and were not negligent are entitled to zero-liability refunds. Banks are mandated to initiate shadow reversal within 10 working days. But these provisions only activate when the complaint is filed with the right information, in the right format, through the right channels — and within the right window.

    A forensic-backed complaint dramatically changes the outcome. When investigators submit technically precise documentation — verified UTR chains, device forensics, transaction flow maps — banks and cybercrime units have the evidentiary basis to act. Account freeze requests are processed faster. FIRs convert into active investigations rather than dormant complaints. Recovery, while never guaranteed, becomes a realistic possibility rather than a long shot.

    If It Just Happened to You: The First Steps

    The 30 minutes immediately following a UPI fraud incident are the most consequential. In order of priority:

    Call your bank immediately and request a hold or freeze on the affected account. Provide the transaction UTR and beneficiary VPA.

    Dial 1930 — India’s National Cybercrime Helpline — to log the incident. This triggers CFCFRMS, the inter-bank coordination system that can flag receiving accounts for monitoring. Get your reference ID and keep it.

    File a complaint at cybercrime.gov.in, attaching all transaction details, screenshots, and communication records. This creates a formal trail under the Ministry of Home Affairs’ I4C initiative.

    Do not delete anything — no messages, no app notifications, no call logs. Do not factory reset your device. Digital forensics works precisely because data that seems gone often is not — but only if the device state is preserved.

    And if the amount is significant, or if official channels have already stalled without resolution — engage a professional digital forensic services company in India that specialises in financial cybercrime investigation.

    Why Professional Forensics Changes the Equation

    Police cybercrime units are overwhelmed. India’s digital payment fraud cases have grown at a pace that has outrun investigative capacity at the institutional level. Trained forensic professionals filing submissions with complete technical documentation, clear evidence chains, and precise legal framing move cases forward in a way that unassisted complaints rarely do.

    More practically: investigators know how to identify the mule account network, how to file for emergency account lien marking, how to leverage NPCI dispute mechanisms, and how to coordinate with banking fraud teams who have the internal authority to initiate reversals.

    This is not bureaucratic navigation. It is applied forensic expertise in an environment where the difference between a recovered ₹10 lakh and a closed complaint often comes down to the quality of the initial investigation.

    Closing Thoughts

    UPI has built one of the most remarkable payment ecosystems in the world — 839 million users, over 20 billion monthly transactions, and a digital infrastructure that has genuinely transformed how India moves money. But scale creates attack surface, and the fraud numbers are an honest reflection of that.

    What protects users and businesses is not just technology — it is an informed, rapid, forensically sound response when fraud occurs. For those who have experienced a UPI scam, the question is rarely whether anything can be done. It is whether you are working with people who know precisely what needs to be done, and when.

    At Everence, our digital forensics and cyber investigation capabilities are built for exactly this — from evidence preservation and transaction tracing to legal documentation and recovery coordination. If you or your organisation has been affected by digital payment fraud in India, early expert engagement is the single biggest factor in what happens next.

  • The Rise of Deepfake Fraud in India: How to Detect & Investigate It

    The Rise of Deepfake Fraud in India: How to Detect & Investigate It

    A company executive receives a video call from what appears to be his CFO — familiar face, familiar voice, even the same mannerisms. He authorises a wire transfer. Only later does he discover that the CFO never made that call. What he saw was a deepfake.

    This is not a hypothetical scenario pulled from a cyberpunk novel. It is the new reality of corporate fraud in India. And the numbers back it up: deepfake cases in India have surged by 550% since 2019, with projected losses of ₹70,000 crore in 2024 alone. Nearly half of all Indian adults — 47% — have personally experienced or know someone who has fallen victim to an AI voice-cloning or deepfake scam. That is nearly double the global average.

    The threat is no longer on the horizon. It is already inside organisations, courtrooms, and people’s personal lives. The question is no longer if you will encounter deepfake fraud — it is whether you will be prepared when you do.

    What Exactly Is Deepfake Fraud?

    Deepfake technology uses generative AI — specifically models like GANs (Generative Adversarial Networks) and increasingly sophisticated diffusion models — to fabricate hyper-realistic audio, video, and images of real people. The technology itself is not illegal. The misuse absolutely is.

    In the context of fraud, deepfakes are weaponised in several ways:

    Executive Impersonation Fraud: Criminals use AI to clone a CEO’s or CFO’s face and voice to authorise fraudulent transactions. The Hong Kong case — where a single employee was manipulated into transferring USD 25 million — remains the starkest global example, but similar incidents are now being reported in Indian boardrooms too.

    KYC Bypass Scams: Fraudsters use AI-generated faces to fool video-based Know Your Customer verification systems at banks and fintech platforms — a particularly dangerous vector given India’s aggressive push toward digital onboarding.

    Investment and Romance Deepfakes: AI-generated celebrities or fabricated financial advisors lure victims into fake investment schemes. In a documented case in India, a victim lost ₹1.43 crore to an AI-generated investment influencer.

    Reputation and Extortion Attacks: Non-consensual deepfake content targeting individuals — especially women — for blackmail and harassment is a growing and underreported category of cybercrime.

    What makes deepfake fraud uniquely dangerous is that it exploits trust — the same trust that drives every legitimate digital interaction. Banks, businesses, and individuals are all vulnerable.

    Why India Is Particularly Exposed

    India has over 650–700 million smartphone users — second only to China. Digital payments, video-based banking, and AI-driven onboarding have all scaled rapidly. But AI literacy and deepfake awareness have not kept pace.

    According to recent data, 65% of Indian organisations have already encountered deepfake-driven attacks. Yet most businesses still rely on human judgment alone to distinguish real from fabricated — a strategy that is rapidly becoming obsolete. Deepfake content is projected to grow 900% year-over-year, with an estimated 8 million deepfake files circulating in 2025 alone.

    Financial institutions are particularly exposed. Deepfakes embed themselves into legitimate communication channels — approval calls, video verifications, vendor interactions — making detection significantly harder than traditional fraud patterns.

    How to Detect Deepfake Video and Audio: What Actually Works

    This is where things get technically interesting, and where the gap between organisations that are prepared and those that are not becomes critical.

    Visual and Temporal Anomalies

    Trained investigators and automated detection systems look for what deepfakes consistently get wrong: physiological inconsistencies. This includes unnatural blinking rhythms, micro-expressions that don’t align with emotional tone, inconsistent skin texture around the hairline and neck, and subtle lighting mismatches between the face and the surrounding environment.

    In video deepfakes, temporal coherence failures are a key tell — frames in which the synthesised face loses alignment with the subject’s natural head movements. At standard playback speed, these artefacts are nearly invisible. Forensic tools, however, are designed to isolate them.

    Audio Forensics

    Voice cloning is often more convincing than video deepfakes, and in many fraud cases, audio alone is sufficient to deceive victims. Forensic audio analysis examines spectral anomalies — unnatural pitch transitions, synthetic breath patterns, and the absence of ambient environmental sounds that would naturally accompany a live recording.

    AI-Powered Detection Tools

    Modern deepfake video detection in India increasingly relies on deep learning-based forensic models. Tools like Microsoft Video Authenticator, DARPA’s MediFor programme, and specialised DFIR (Digital Forensics and Incident Response) platforms analyse content consistency, frequency domain artefacts, and identity-level facial verification in parallel.

    Hybrid architectures — combining Convolutional Neural Networks (CNNs) for spatial analysis with LSTM models for temporal detection — have demonstrated accuracy rates above 95% in controlled environments. The challenge is real-world generalisability, where deepfake quality varies enormously.

    Metadata and Chain-of-Custody Analysis

    Beyond the content itself, forensic investigation of deepfake scams involves a rigorous examination of metadata — file creation timestamps, encoding signatures, geolocation data, and platform upload trails. This layer of analysis is critical for building evidence admissible under India’s IT Act and the Indian Evidence Act.

    Investigating a Deepfake Incident: The Forensic Process

    When an organisation suspects it has been targeted by deepfake fraud, the response needs to be methodical. Evidence mishandling at any stage can compromise legal admissibility — a concern that is often underestimated in the rush to respond.

    Step 1 — Preservation: The moment a deepfake incident is suspected, all digital evidence must be preserved in its original form. This means creating verified forensic images of affected devices, securing communication logs, and establishing a documented chain of custody before any investigative analysis begins.

    Step 2 — Content Authentication: The suspect media undergoes multi-layered analysis — visual, audio, metadata, and AI-driven pattern recognition — to establish whether it is fabricated and, if so, what tools or techniques were likely used.

    Step 3 — Attribution Investigation: Here is where cyber investigation intersects with threat intelligence. Forensic investigators trace the origin of the deepfake — examining server trails, IP footprints, dark web toolkits, and communication channels used to deploy the fraud. This is significantly more complex than standard cybercrime attribution.

    Step 4 — Legal Documentation: All findings must be packaged in a format that satisfies the requirements of Indian courts. This means expert-certified forensic reports, properly documented evidence handling procedures, and testimony-ready analysis that can withstand cross-examination.

    What Businesses and Individuals Should Do Right Now

    The instinct after reading about deepfake fraud is to invest in detection tools. That is the right instinct — but it is not sufficient on its own. A few practical measures that actually reduce exposure:

    • Layer your verification processes. Never authorise high-value transactions based solely on a video or voice call, regardless of how convincing it appears. Establish out-of-band confirmation protocols — a callback to a verified number, a secondary approver, a pre-agreed code phrase.
    • Train your team, not just your systems. Human vigilance remains part of the first line of defence. Employees in finance, HR, and executive teams need to understand what deepfake fraud looks like and how to escalate suspicions.
    • Engage forensic expertise before you need it. Having a relationship with a digital forensics and cyber investigation firm before an incident occurs means faster, cleaner response when something does happen.
    • Understand your legal exposure. India’s regulatory landscape around deepfakes is evolving — proposed amendments to the IT Act aim to introduce deepfake-specific penalties. Organisations that have not mapped their compliance obligations in this area are taking on unnecessary risk.

    The Investigation Landscape in India

    What most people don’t realise is that deepfake fraud investigation is a multi-disciplinary challenge. It is not just a cybersecurity problem, nor is it just a legal problem. It sits at the intersection of AI forensics, digital evidence law, multimedia analysis, and cyber intelligence — a combination of capabilities that few organisations possess internally.

    The growing demand for specialised deepfake detection in India and post-incident investigation reflects a broader maturation of the cybersecurity landscape. Businesses, law firms, financial institutions, and law enforcement agencies are beginning to recognise that the gap between a successful and a failed investigation often comes down to the forensic methodology applied in the first 48 hours.

    Closing Thoughts

    Deepfake technology is not going to become less sophisticated, less accessible, or less misused. If anything, the trajectory suggests the opposite — broader availability, higher quality, and more targeted deployment against individuals and organisations.

    What changes is preparation. Businesses that invest in detection capabilities, incident response protocols, and forensic partnerships are materially better positioned than those that respond after the fact without a framework in place.

    If your organisation has experienced a deepfake-related incident — or wants to understand your exposure before one occurs — working with specialists in digital forensics and cyber investigation is the most direct path to clarity. At Everence, we bring deep technical expertise to exactly these challenges: from deepfake video authentication and cyber investigation to compliance-ready forensic reporting that holds up where it matters most.

    The question worth asking is simple: how would your organisation respond if it received a deepfake call tomorrow?