Recovery question
Data Recovery After Digital Harm
Digital harm recovery is not only the recovery of money. It can include account control, identity-data exposure, correction of records and the documented trail of official response.
Recovery dimensions
- Financial: payment trail, bank response and reversal status.
- Identity: what KYC or personal data was exposed or reused.
- Record: complaint IDs, closure reasons, escalation records and unanswered questions.
- System: whether the same leak or workflow could harm more citizens.
Archive standard
The archive should avoid promising recovery outcomes. It can document source-backed requests, responses, gaps and policy questions that require public authority attention.
Financial recovery: the payment trail
Financial recovery after digital arrest begins with the payment trail. Every transfer made under fraud coercion carries a Unique Transaction Reference (UTR) number, a timestamp and a destination account identifier. These details are the starting point for any recovery request. The victim should immediately notify their bank's fraud team, quoting the UTR and requesting a freeze or recall on the fraudulent transfer. India's payment infrastructure includes a mechanism under which banks can freeze recipient accounts when notified of fraud through the cyber crime portal, but this mechanism operates on a very short window: transfers that have already been withdrawn from the recipient account, converted to cryptocurrency or moved through multiple layered accounts are typically unrecoverable through the banking system alone. The cyber crime portal complaint number becomes essential evidence in any subsequent escalation to law enforcement or the Reserve Bank of India's ombudsman.
Identity recovery: restoring the corrupted digital profile
Identity recovery is more complex and more enduring than financial recovery. Once KYC data has been exposed, the victim faces an ongoing risk that their credentials will be reused in new fraud contexts. Identity recovery steps include: reporting the KYC exposure to UIDAI for Aadhaar-linked records; requesting the telecom operator to audit SIM cards registered against the victim's identity; checking income-tax records for unauthorised filings; and requesting banks to audit accounts opened in the victim's name. Each of these steps generates an official response — confirmation, audit report or rejection — that the victim should preserve as a source record. The DISHA archive treats these institutional responses as verified records when they are obtained directly from the authority and as documented allegations when they are reported by the victim without a corroborating official document.
Record recovery: complaint logs and official responses
In many digital arrest cases, the victim's primary long-term resource is not the recovered money — which may be unrecoverable — but the documented complaint trail. A complete complaint record, showing every submission, every acknowledgement number, every response and every unresolved follow-up, is both a legal asset and a research asset. It demonstrates what the citizen did, when they did it, and how public authorities responded. Where the archive identifies gaps in official responses — complaints lodged but not acknowledged, escalations submitted but not acted upon, closure orders issued without substantive reasoning — these are recorded as unresolved questions under the DISHA claim-to-source system and may form part of the public-interest record in cases that reach the Supreme Court or other accountability forums.
System recovery: preventing the same harm at scale
Beyond individual recovery, the DISHA research framework treats digital arrest as a systemic governance failure. The same fraud method has been applied at scale across India, using weaknesses in telecommunications identity verification, banking KYC processes, government portal data security and public awareness infrastructure. Recovery at the system level requires public authorities to answer accountability questions: which authority permitted the conditions under which these frauds became possible? What correction has been made to prevent recurrence? What disclosure has been provided to citizens whose data was exposed in the breach or leak that enabled the fraud? These questions connect individual digital arrest cases to the broader constitutional accountability framework of Article 12 and the data-sovereignty dimensions of W.P.(Crl.) 163/2026.