Cybercrime and online fraud are growing fast, from UPI scams and fake investment apps to phishing and digital arrest threats. Both victims and accused need to understand the law. This guide explains the offences under the Information Technology Act, 2000 and the Bharatiya Nyaya Sanhita, 2023 (BNS), how to report, and how to defend.
Main offences in cybercrime and online fraud
Under the IT Act, 2000:
- Section 66: Computer-related offences, such as hacking and unauthorised access, if done dishonestly or fraudulently.
- Section 66C: Identity theft, which is fraudulent or dishonest use of another person’s password, electronic signature or unique identification feature.
- Section 66D: Cheating by personation using a computer resource or communication device.
- Section 66E: Violation of privacy by capturing or sharing private images.
- Sections 67 and 67A: Publishing obscene or sexually explicit material electronically.
Under the BNS:
- Section 318: Cheating.
- Section 319: Cheating by personation.
- Section 336: Forgery, including electronic records.
- Section 351: Criminal intimidation.
- Other provisions for extortion, stalking and defamation may also apply.
For the ingredients of cheating, read our guide on cheating and criminal breach of trust under BNS.
Common types of online fraud
- Phishing links and fake bank calls to steal OTPs.
- UPI and QR code frauds.
- Fake investment, trading and job schemes.
- SIM swap and identity theft.
- Fake customer care numbers and remote access apps.
- Sextortion and morphed images.
- Calls threatening arrest by impersonating officials, often called digital arrest.
How to report: act in the first hours
- Call the national cybercrime helpline 1930 quickly in a financial fraud, because early reporting helps in freezing the money.
- File a complaint on the National Cyber Crime Reporting Portal (cybercrime.gov.in).
- Inform your bank immediately and ask them to block the card or account and note the complaint number.
- Lodge a complaint at the local police or cyber crime police station. For how an FIR is registered, see FIR registration under BNSS Section 173.
Banks are expected to follow the RBI framework on customer liability for unauthorised electronic transactions, where timely reporting by the customer limits the customer’s liability. Check the current circular with your bank.
Preserve digital evidence
- Take screenshots of chats, links, call logs and transaction messages.
- Save emails with full headers, and keep the original device.
- Note UPI reference numbers, account numbers, and dates and times.
- Do not delete messages or reset the phone.
Electronic evidence in court
The Bharatiya Sakshya Adhiniyam, 2023 (BSA) treats electronic records as documents. Section 63 BSA, which corresponds to the old Section 65B of the Evidence Act, requires a certificate for producing electronic records as evidence, in the form prescribed by the Act. The certificate is generally given by the person in charge of the device and an expert, and incorrect or missing certificates can weaken a case.
If you are accused: key defence points
- Mistaken identity or mule accounts: Many people are drawn in when their bank account is used to receive money from fraud. Show the lack of knowledge and intention.
- No dishonest intention: Show that you were an innocent intermediary.
- Weak electronic evidence: Challenge the certificate, chain of custody and integrity of the data.
- Account freeze: If your account is frozen on a complaint, you can apply to the Magistrate or the High Court for release or de-freezing, with proof of the source of funds.
- Protection from arrest: Consider anticipatory bail under BNSS Section 482, and know your arrest rights under BNSS.
Civil remedies for victims
Along with the criminal case, the victim can pursue the bank or intermediary for liability where the law permits, ask for blocking of fraudulent accounts and websites, and in some cases seek compensation through adjudication under the IT Act.
Frequently Asked Questions
What number should I call to report online financial fraud?
The national cybercrime helpline is 1930. Report it as early as possible and also file a complaint on cybercrime.gov.in and with your bank.
Which IT Act sections apply to identity theft and impersonation fraud?
Section 66C deals with identity theft and Section 66D deals with cheating by personation using a computer resource, along with BNS provisions on cheating and personation.
Is hacking a crime in India?
Yes. Unauthorised access done dishonestly or fraudulently is punishable under Section 66 of the IT Act, read with Section 43, along with other applicable laws.
Can I get my money back after a UPI fraud?
Sometimes. Quick reporting helps in freezing the amount, and the bank’s liability depends on the facts and the RBI rules on unauthorised transactions. Delay reduces the chances.
Is a screenshot enough as evidence in court?
Screenshots help in the investigation, but for court, electronic records need proper certification under Section 63 of the Bharatiya Sakshya Adhiniyam, and the original device or data should be preserved.
My bank account was frozen because of a fraud complaint. What can I do?
Apply to the Magistrate or the High Court for de-freezing, with bank statements and proof showing the source of the funds and your lack of involvement.
What is a digital arrest scam?
It is a fraud where criminals pose as officials on a call and threaten arrest to extort money. No genuine agency arrests anyone by video call, so disconnect and report on 1930.
This article is general legal information and not a substitute for advice on your specific case. Consult an advocate before acting.