The increasing use of smartphones, digital payments, social media, online banking and internet-based services has created new opportunities as well as new legal risks. Cybercrime can affect individuals, businesses, educational institutions and government organisations.
Common incidents include UPI fraud, phishing, identity theft, online investment scams, account hacking, cyberstalking, impersonation and the unauthorised publication of private information.
Indian law provides several mechanisms to address cyber offences, protect digital information and report online crimes. The legal framework includes the Information Technology Act, 2000, applicable provisions of the Bharatiya Nyaya Sanhita, 2023, the Bharatiya Nagarik Suraksha Sanhita, 2023 and the Bharatiya Sakshya Adhiniyam, 2023, along with other relevant legislation.
This guide explains the major forms of cybercrime in India, the applicable legal framework, how to report a cyber incident and how digital evidence may be preserved for legal proceedings.
1. What Is Cyber Law?
Cyber law concerns legal issues arising from the use of computers, communication networks, digital platforms, electronic records and online services.
It addresses both unlawful conduct committed through digital systems and the legal validity of electronic transactions and records.
Cyber law in India covers matters such as:
- Unauthorised access to computer systems.
- Online financial fraud and phishing.
- Identity theft and impersonation.
- Unauthorised disclosure of confidential information.
- Cyberstalking and online harassment.
- Certain forms of obscene or sexually explicit online content.
- Data protection and information security.
- Electronic contracts and digital signatures.
- Admissibility of electronic and digital evidence.
- Intermediary responsibilities and online content regulation.
Not every online dispute constitutes a criminal offence. For example, a disagreement over an online purchase may primarily involve consumer or contractual law, whereas deliberate deception, unauthorised access or other conduct satisfying the ingredients of a criminal offence may attract criminal liability.
The facts and applicable statutory provisions must be examined before classifying an incident.
2. Important Cyber Laws in India
A. Information Technology Act, 2000
The Information Technology Act, 2000 is a principal statute governing electronic transactions and specified cyber-related offences and contraventions.
It provides legal recognition to electronic records and electronic signatures in circumstances covered by the Act. It also contains provisions dealing with unauthorised access, damage to computer resources, identity theft, cheating by personation using computer resources, specified forms of privacy violation and unlawful electronic content.
Some important provisions include:
Section 43: Addresses specified unauthorised acts involving computer systems or resources and provides for compensation under the circumstances covered by the provision.
Section 66: Covers certain acts described in Section 43 when committed dishonestly or fraudulently, subject to the statutory requirements.
Section 66C: Deals with identity theft involving fraudulent or dishonest use of specified electronic signatures, passwords or other unique identification features.
Section 66D: Addresses cheating by personation using a communication device or computer resource.
Section 66E: Addresses violation of privacy in the circumstances specified by the section.
Section 67: Deals with publishing or transmitting obscene material in electronic form, subject to its terms.
Sections 67A and 67B address specified categories of sexually explicit material and material involving children, respectively, subject to the statutory requirements.
The applicability of each provision depends on the precise conduct and the evidence available.
Section 66A of the Information Technology Act was struck down by the Supreme Court in Shreya Singhal v. Union of India (2015). It should not be treated as a valid offence provision.
B. Bharatiya Nyaya Sanhita, 2023
The Bharatiya Nyaya Sanhita, 2023 (BNS) may apply where online conduct satisfies the ingredients of an offence under general criminal law.
Depending on the facts, conduct involving cheating, forgery, criminal intimidation, extortion or other offences may attract the relevant BNS provisions.
For example, an online scam may involve both a digital method of communication and conduct that satisfies the legal ingredients of cheating. The appropriate charges must be identified from the actual facts rather than assumed from the use of the internet alone.
C. Bharatiya Nagarik Suraksha Sanhita, 2023
The Bharatiya Nagarik Suraksha Sanhita, 2023 (BNSS) governs criminal procedure within its scope.
It provides the procedural framework for matters such as reporting information relating to cognizable offences, investigation, arrest, bail and criminal proceedings.
The procedure followed in a cybercrime case depends on the nature of the alleged offence, the applicable provisions and the circumstances of the investigation.
D. Bharatiya Sakshya Adhiniyam, 2023
The Bharatiya Sakshya Adhiniyam, 2023 (BSA) governs the general rules and principles of evidence within its scope, including provisions concerning electronic and digital records.
Electronic evidence may include emails, messages, server logs, transaction records, CCTV footage, digital photographs and other computer-generated information.
The legal admissibility and proof of such records depend on the relevant statutory requirements. Merely producing a screenshot does not automatically establish the authenticity, completeness or truth of everything it depicts.
E. Digital Personal Data Protection Act, 2023
The Digital Personal Data Protection Act, 2023 establishes a statutory framework concerning the processing of digital personal data, subject to its provisions, applicable rules and commencement notifications.
Its application to a particular organisation or incident must be assessed in light of the provisions in force and any applicable exemptions or transitional arrangements.
A personal data breach, by itself, does not automatically establish every element of a criminal offence. Depending on the facts, separate obligations or remedies may arise under data protection, information technology, contractual or other applicable law.
3. What Are the Common Types of Cybercrime in India?
A. UPI and Online Payment Fraud
UPI and digital payment fraud may involve deceptive payment requests, impersonation, fake customer-care numbers, fraudulent QR-code instructions or manipulation of victims into authorising transactions.
A fraudster may pretend to be a buyer, seller, bank representative or government official.
Important safety point: Receiving money through UPI generally does not require entering a UPI PIN. A request to enter a PIN to receive a payment should be treated with caution.
If a suspicious transaction occurs, contact the bank or payment service provider immediately and report the incident through the appropriate official channel.
B. Phishing and Fake Websites
Phishing involves deceptive communications designed to obtain sensitive information or induce a person to take an unsafe action.
A fraudulent message may ask the recipient to click a link, update account details, download an attachment or disclose an OTP.
Warning signs include unexpected urgency, unfamiliar web addresses, spelling inconsistencies, requests for passwords or PINs and threats of account suspension.
Do not enter banking credentials through links received in unsolicited messages. Instead, access the official website or application independently.
C. Identity Theft and Impersonation
Identity theft may involve the unauthorised use of another person’s identifying information, passwords, credentials or other electronic identifiers.
Examples include creating a fake profile, misusing account credentials or impersonating someone to deceive another person.
Section 66C of the Information Technology Act may be relevant to identity theft falling within its scope. Section 66D may be relevant where the statutory ingredients of cheating by personation using a communication device or computer resource are satisfied.
Other provisions may apply depending on the conduct.
D. Social Media Harassment and Cyberstalking
Online harassment can include repeated unwanted communications, threats, impersonation, publication of private information and other forms of targeted abuse.
The legal classification depends on the conduct, the victim’s circumstances and the relevant statutory provisions.
Certain conduct may attract provisions of the BNS, the Information Technology Act or special legislation. A civil remedy or platform-level reporting mechanism may also be relevant in appropriate cases.
Victims should preserve evidence and avoid responding in ways that may increase risk. Where there is an immediate threat to personal safety, contact the police or emergency services.
E. Online Investment and Trading Scams
Investment fraud may involve fake trading applications, fabricated profits, fraudulent cryptocurrency schemes, impersonation of financial advisers or demands for additional payments to release supposed earnings.
Before investing, verify the entity, registration and regulatory status through the relevant official regulator where applicable.
Do not rely solely on screenshots of profits, online testimonials or assurances that a return is guaranteed.
F. Account Hacking and Unauthorised Access
Unauthorised access to email, social media, business systems or other computer resources may attract legal consequences depending on the conduct and applicable law.
If an account is compromised, use a trusted device to change credentials, revoke unknown sessions, enable multi-factor authentication and contact the relevant service provider.
For business systems, preserve relevant logs and seek competent technical assistance before making changes that could destroy evidence.
4. How to Report Cybercrime in India
India’s National Cyber Crime Reporting Portal provides an official route for reporting cybercrime complaints online.
Official portal: https://www.cybercrime.gov.in/
The portal supports reporting of financial fraud and other categories of cybercrime. Complaints are handled by the relevant law-enforcement agencies under the applicable framework.
Step 1: Act Quickly in Financial Fraud Cases
If money has been transferred fraudulently, immediately call the national cyber financial fraud helpline 1930.
Prompt reporting may help initiate action through the relevant financial institutions and law-enforcement system. However, recovery or freezing of funds is not guaranteed.
Also contact the bank, card issuer or payment service provider through its official channel and report the unauthorised transaction.
Step 2: Submit an Online Complaint
Visit the official portal and choose the category appropriate to the incident.
Provide accurate details, including:
- Date and approximate time of the incident.
- Description of what happened.
- Amount lost, if applicable.
- Bank, wallet or payment details relevant to the transaction.
- Transaction reference or UTR number, where available.
- Phone numbers, email addresses, URLs or account identifiers involved.
- Relevant screenshots, messages and supporting documents.
The exact fields and documents requested may depend on the complaint category.
Step 3: Preserve the Acknowledgement
Save the complaint acknowledgement number and any confirmation received.
Use the portal’s tracking facility where available to monitor the complaint. If further information is requested, provide it through the appropriate official channel.
Step 4: Approach the Police Where Appropriate
A cybercrime complaint through the portal is not necessarily identical to registration of an FIR in every case.
Depending on the facts, the applicable law and the response of the authorities, further steps may include approaching the local police station or the competent cybercrime police unit.
Where information relating to a cognizable offence is not recorded, the statutory remedies under the applicable criminal procedure law may need to be considered.
For immediate danger, contact the police or emergency services rather than relying only on an online complaint.
5. What Should You Do Immediately After an Online Financial Fraud?
Speed and evidence preservation are important after a suspected fraudulent transaction.
Follow these practical steps:
- Call 1930 promptly. Report the financial cyber fraud as soon as possible.
- Contact your bank or payment provider. Use the official number or application and request that the incident be recorded and appropriate protective action be considered.
- Secure your accounts. Change compromised passwords from a trusted device and revoke unknown sessions.
- Preserve transaction details. Save the UTR or transaction reference, bank messages, statements and complaint acknowledgement.
- Preserve communications. Retain suspicious messages, phone numbers, email addresses and website links.
- File the online complaint. Use the official National Cyber Crime Reporting Portal.
- Keep records of follow-up. Note complaint numbers, dates, bank reference numbers and communications with authorities.
Do not delete the relevant messages or reset a compromised device before considering whether important evidence could be lost. Where necessary, seek competent technical assistance.
Never disclose an OTP, password, UPI PIN or remote-access code to someone claiming they can recover your money.
Be particularly cautious of people who promise guaranteed recovery of lost funds in exchange for advance fees.
6. How Can a Victim Preserve Digital Evidence?
Digital evidence can be important in cybercrime investigations and court proceedings.
Useful material may include:
- Screenshots of suspicious messages or profiles.
- Original emails and available email headers.
- URLs and website addresses.
- Transaction receipts and bank statements.
- SMS messages and call logs.
- Relevant application notifications.
- Original photographs, videos or audio files.
- Account activity and login alerts.
- Relevant device or system logs.
- Complaint acknowledgements and bank correspondence.
Practical Evidence-Preservation Tips
Retain the original material: Do not rely exclusively on cropped or edited screenshots if the original records are available.
Record the context: Note when the incident occurred, which account or device was involved and how the material was obtained.
Avoid altering files: Editing, renaming or repeatedly transferring files may complicate later verification. Preserve the original where possible.
Keep a secure backup: Store copies in a secure location while limiting access to sensitive information.
Document financial loss: Maintain transaction references, account statements and communications with the bank.
Seek technical assistance where necessary: In serious cases, a competent forensic examiner may help preserve and analyse relevant data.
Preservation does not by itself guarantee admissibility. The method of collection, authenticity, relevance, integrity and statutory requirements must still be considered.
7. Are Screenshots Admissible as Evidence in Court?
Screenshots and other electronic records may be relevant evidence, but their admissibility and evidentiary value depend on the applicable law and the circumstances in which they were created and preserved.
The Bharatiya Sakshya Adhiniyam, 2023 contains provisions dealing with electronic and digital records, including Section 63 concerning specified computer outputs and the requirements applicable to their admissibility.
Depending on the nature of the record and the manner in which it is produced, statutory requirements concerning a certificate or other proof may apply.
A court may need to consider questions such as:
- Whether the record is authentic.
- Whether it has been altered or manipulated.
- How it was created, stored or retrieved.
- Whether the person presenting it can establish its source.
- Whether the relevant statutory conditions have been satisfied.
- Whether the record is relevant to the issue in dispute.
The appropriate evidentiary procedure should be assessed for the particular record and proceeding. A screenshot should not be assumed to prove every statement or event shown on the screen.
8. Can a Victim Recover Money Lost in Cyber Fraud?
Recovery may be possible in some cases, but it is not guaranteed.
The outcome may depend on how quickly the incident was reported, whether the funds remain traceable, the action taken by banks and payment intermediaries, the investigation and the applicable legal framework.
The victim should promptly report the transaction to the bank and the official cybercrime reporting system.
If a bank or payment provider is alleged to have mishandled a complaint, the victim may consider the applicable grievance-redressal procedure and, where the relevant conditions are met, the appropriate escalation mechanism.
A complaint to the authorities does not itself establish a right to immediate reimbursement. The legal position may depend on the nature of the transaction, the customer’s conduct, the applicable banking rules and the facts of the case.
Avoid paying an unknown person who claims to be able to recover the funds through unofficial channels.
9. What Legal Remedies Are Available in Cybercrime Cases?
The appropriate remedy depends on the conduct and the rights affected.
A. Criminal Complaint
Where the facts disclose a criminal offence, the victim may report the incident to the competent law-enforcement agency. The authorities determine the appropriate investigative steps under the applicable law.
B. Banking or Payment-System Grievance
For unauthorised transactions or alleged service failures, the victim may raise a complaint through the bank or payment provider’s official grievance process.
Further escalation may be available under the applicable regulatory framework, subject to eligibility and procedural requirements.
C. Civil Proceedings
A civil remedy may be relevant where the facts establish a legally recognised claim for recovery, damages, injunction or other relief.
A cyber incident does not automatically create every possible civil cause of action. The legal basis, parties, evidence and limitation period must be examined.
D. Remedies Concerning Online Content
Where online content is unlawful or violates a person’s rights, a complaint may be made to the relevant platform or authority.
In appropriate cases, legal remedies may also be considered to seek removal, restriction or other relief, subject to the applicable law and procedural requirements.
E. Data Protection or Regulatory Complaints
Depending on the incident and the statutory provisions in force, a complaint or other remedy under an applicable data protection or sectoral regulatory framework may be relevant.
The correct route depends on the nature of the data, the entity involved, the law in force and any applicable exemptions.
10. What Responsibilities May Online Platforms Have?
Online platforms and intermediaries may be subject to obligations under the Information Technology Act, 2000 and applicable rules, depending on their role and the relevant circumstances.
The legal framework may address matters such as due diligence, grievance handling, specified information-retention obligations and procedures concerning unlawful content.
The precise obligations depend on the type of intermediary, applicable rules, court or government directions and other statutory requirements.
A platform’s failure to remove content immediately does not, by itself, establish every element of a criminal or civil claim. The facts and applicable legal provisions must be assessed.
11. How Can Individuals and Businesses Prevent Cybercrime?
Preventive measures can reduce the risk of financial loss, account compromise and data exposure.
For Individuals
- Use strong, unique passwords.
- Enable multi-factor authentication where available.
- Never disclose OTPs, UPI PINs or passwords.
- Verify the identity of callers claiming to represent banks or government departments.
- Avoid installing applications from unknown sources.
- Do not grant remote access to an unknown caller.
- Verify payment requests independently.
- Keep devices and applications updated.
- Review bank alerts and account activity regularly.
For Businesses
- Adopt written information-security policies.
- Restrict access to sensitive systems according to role.
- Maintain secure backups.
- Train employees to identify phishing and impersonation.
- Preserve relevant logs and records.
- Establish an incident-response process.
- Review vendor and service-provider security arrangements.
- Seek professional assistance for serious incidents.
Organisations should also assess any sector-specific reporting, security or data-protection obligations that may apply to them.
12. Frequently Asked Questions
Is every online fraud covered only by the Information Technology Act?
No. Depending on the facts, provisions of the BNS, the Information Technology Act and other applicable legislation may be relevant. The correct legal classification depends on the ingredients of the alleged offence.
Can I report cybercrime if I do not know the identity of the offender?
Yes. A person can report an incident even if the offender’s identity is unknown. Provide the available information, such as transaction references, phone numbers, email addresses, profile links or website details.
Is an online cybercrime complaint the same as an FIR?
Not necessarily. The online portal provides a mechanism for reporting incidents to law-enforcement agencies. Whether an FIR is registered depends on the applicable law and the circumstances of the complaint.
Should I wait for the bank to respond before reporting financial fraud?
No. In suspected financial cyber fraud, report it promptly through 1930, contact the bank or payment provider and submit the online complaint. Do not wait unnecessarily for one channel to respond before using the others.
Does a cybercrime complaint guarantee recovery of money?
No. Reporting enables the relevant authorities and financial institutions to consider action, but recovery depends on the circumstances and is not guaranteed.
Conclusion
Cyber law in India addresses a broad range of digital activities, from electronic transactions and information security to online fraud, identity theft and unlawful digital content.
The Information Technology Act, 2000 remains a central statute for specified cyber-related matters. The BNS, BNSS and BSA may also be relevant to offences, investigation, procedure and electronic evidence, depending on the facts and the applicable law.
If a cyber incident occurs, prompt reporting, preservation of original evidence and secure handling of accounts can be important. Victims should use official reporting channels, avoid unauthorised recovery services and obtain appropriate legal advice where necessary.
Disclaimer: This article is intended for general legal education and information. It does not constitute legal advice for a specific cyber incident. The applicable statutory provisions, rules, regulatory requirements and remedies should be verified against the current law and the facts of the individual case.
Official Legal Resources
- Information Technology Act, 2000 — India Code: https://www.indiacode.nic.in/indiacode/handle/123456789/1999?locale=en
- National Cyber Crime Reporting Portal: https://www.cybercrime.gov.in/
- National Cyber Financial Fraud Helpline: 1930
- Bharatiya Sakshya Adhiniyam, 2023 — India Code: https://www.indiacode.nic.in/indiacode/handle/123456789/20063
- Ministry of Home Affairs — Cybercrime and I4C resources: https://www.mha.gov.in/
