Cyber Law

Here is what you should know about cyber crime: online fraud, hacking, identity theft and cyber harassment before you act or reply to anyone. Legals365 is the legal platform of Advocate B.K. Singh and associates, based in Delhi NCR.

In short. Cyber crimes are offences committed through computers, phones or the internet, such as online fraud, hacking, identity theft and harassment. They are punished under the IT Act 2000 and the Bharatiya Nyaya Sanhita. Victims of financial fraud should call 1930 or report on cybercrime.gov.in at once, tell the bank, and then file a complaint or FIR with the cyber police station.

Cyber crime covers a wide range of wrongs: money taken through a fake investment app or a UPI trick, a social media account hacked and used to cheat friends, a loan app threatening to send morphed photos to every contact, a former employee walking off with a client database, a fake profile in your name, or a video call from someone pretending to be a CBI officer who announces a digital arrest. What connects them is that the evidence is electronic, the money moves fast and the offender is often in another state or country.

This page is for three kinds of readers: victims who want their money back or the harassment stopped, people who have been named or whose accounts have been frozen in a cyber case, and businesses that want to prevent and respond to incidents. It explains the law under the Information Technology Act 2000 and the Bharatiya Nyaya Sanhita 2023, where and how to report, what can realistically be recovered, how evidence must be preserved, and how cases move through the police and courts in Delhi NCR and elsewhere.

Law

Information Technology Act 2000 (sections 43, 66, 66C, 66D, 66E, 67, 67A, 69A, 79); Bharatiya Nyaya Sanhita 2023 (cheating, extortion, stalking, intimidation, defamation, forgery, organised crime); IT Rules 2021; BSA section 63 for electronic evidence

Where to report

National helpline 1930 and cybercrime.gov.in for financial fraud; the district cyber police station or local police station for an FIR; platform grievance officers for content removal

Time limit

Report financial fraud within hours if possible, as money moves quickly; tell the bank within three working days to protect your position under RBI rules; no limitation for FIR in serious offences

Courts

Magistrate of the area for most IT Act and BNS offences; Sessions Court for serious offences; adjudicating officer under section 46 IT Act for compensation claims; civil court for injunction and damages

Documents

Screenshots with dates and URLs, transaction IDs and UTR numbers, bank statements, emails with headers, phone numbers and profile links, acknowledgement number from 1930 or the portal

Platform duties

Intermediaries must act on complaints; non-consensual intimate images must be removed within 2 hours of a complaint under the February 2026 amendment to the IT Rules

What counts as cyber crime

A cyber crime is any offence in which a computer, phone, network or online account is the target or the tool. When the device or account is the target, as in hacking, data theft or ransomware, the IT Act is usually the main law. When the device is the tool, as in online cheating, extortion, stalking or defamation, the ordinary offences in the Bharatiya Nyaya Sanhita (BNS) apply, often alongside the IT Act. A single case may involve both.

For most people the cases fall into four groups. Financial fraud: UPI and card fraud, fake investment or trading apps, job and task scams, OTP and KYC tricks, and digital arrest calls. Account and identity offences: hacking, SIM swap, fake profiles, misuse of Aadhaar or PAN. Harassment: stalking, threats, sextortion, morphed images, abusive loan app recovery. Business offences: data theft by employees, email compromise that diverts payments, ransomware and leaks.

Each group has a different first step. Money needs speed and the bank. Harassment needs takedown and protection. Business incidents need containment, evidence and regulatory reporting. The sections below take them one at a time.

The laws that apply to cyber crime

The first hour after online fraud

If money has been taken, call the national cyber crime helpline 1930 or report on cybercrime.gov.in immediately. These feed into the Citizen Financial Cyber Fraud Reporting and Management System run under the Ministry of Home Affairs, which alerts the banks and payment apps through which the money moved and asks them to put a hold on it. The faster the report, the more likely the money is still sitting in the first or second account it reached.

At the same time, call your bank's fraud number and block the card, UPI or net banking. Ask for a complaint reference number. Under RBI's circular on limiting customer liability in unauthorised electronic transactions, a customer who reports a fraud caused by a third-party breach within three working days generally bears no loss, and limited liability applies for reporting within four to seven working days. Where you shared the OTP yourself, the position is less favourable, but report anyway.

Keep the acknowledgement number from 1930 or the portal. It is the reference the cyber police, the bank and later the court will ask for. Do not delete chats or uninstall the app that was used, even if you want to; they are evidence.

How to report a cyber crime and get an FIR

The sequence below applies to most cyber offences in Delhi NCR. Harassment cases add a takedown step, covered later.

1. Report on 1930 or cybercrime.gov.in

   File the complaint with every transaction ID, UTR number, date, time, amount and the account or UPI ID the money went to. For non-financial offences, use the portal's section for women and children or other cyber crimes. Note the acknowledgement number.

2. Tell the bank and the platform

   Give the bank a written complaint with the acknowledgement number. Report the fake profile, account or content to the platform through its grievance mechanism and keep the ticket number.

3. Go to the cyber police station

   In Delhi, each police district has a cyber police station, and the Special Cell's IFSO unit handles larger cases. In Noida, Ghaziabad and Gurugram, district cyber crime police stations deal with them. Give a written complaint with copies of your evidence and ask for an FIR.

4. Insist on registration where the offence is cognizable

   Most cyber frauds are cognizable, and section 173 BNSS requires an FIR. You can also file a zero FIR at any police station, which is then transferred. If the police refuse, write to the DCP or SP under section 173(4), and then approach the magistrate under section 175(3).

5. Follow up with the IO

   Give the IO any new information, such as further transactions or contact from the fraudster. Ask for the status of freezing requests sent to banks. Keep a written record of each visit and call.

6. Apply for release of held money

   Once accounts are frozen and the money traced, an application is made to the magistrate for release of the amount to the victim. The court usually needs the IO's report, proof of the transaction and an undertaking to return the money if later ordered.

Our page on filing an FIR and police complaints explains what to do when the police delay or refuse registration.

Getting money back after cyber fraud

Recovery depends on three things: how fast the fraud was reported, how many accounts the money passed through, and whether it was withdrawn as cash or moved abroad or into crypto. When reported within hours, a part of the money is often frozen in the first layer of mule accounts. Reported after days, it may have been withdrawn, and recovery then depends on tracing assets or the accused.

Money frozen by the bank at the police's request is not returned automatically. The victim, usually through the IO, applies to the magistrate for its release, and the court decides after hearing the account holder if he appears. Where money is spread across several victims, the court may release it proportionately. The new provision in section 107 BNSS on attachment of proceeds of crime also lets the police seek attachment of property linked to the offence.

Alongside the criminal case, a bank customer can pursue the bank under RBI's customer liability rules and, if unhappy with the bank's response after thirty days, complain under the RBI Integrated Ombudsman Scheme 2026. A consumer complaint is another option where the bank's own lapse caused the loss; our page on banking disputes and RBI matters covers those routes.

Common cyber crimes, the law and where to report

Hacking, account takeover and identity theft

When an email, social media or banking account is taken over, the first job is to regain control: use the platform's recovery process, change passwords from a clean device, turn on two-factor authentication and log out all sessions. If the attacker used a SIM swap, contact the telecom provider at once to block the SIM and ask for the details of the replacement request. Then report, because hackers usually use the account to cheat friends or contacts within hours.

Identity theft covers misuse of your Aadhaar, PAN, photographs or credentials to open accounts, take loans or create fake profiles. Section 66C of the IT Act and the BNS cheating and forgery provisions apply. If a loan has been taken in your name, write to the lender and the credit bureau disputing it, file a police complaint, and keep the acknowledgement; lenders usually need the police complaint before they will close the account.

Deepfake videos or voice clones used to cheat or defame are treated as impersonation and, depending on content, as obscenity or defamation. Platforms are obliged to act on complaints, and the IT Rules now require faster removal of impersonation content. Preserve the content first, then report it.

Cyber harassment, stalking and sextortion

Online harassment is a crime, not just bad behaviour. Repeatedly contacting a woman despite clear disinterest, or monitoring her online activity, is stalking under section 78 BNS. Threats to harm or to publish private material are criminal intimidation or extortion. Publishing intimate images without consent attracts sections 66E, 67 and 67A of the IT Act. Where a child is involved, the POCSO Act applies and reporting is mandatory; see our page on sexual offence and POCSO cases.

In sextortion, the advice is the same every time: do not pay, stop responding, preserve the chats and profile links, and report. Payment rarely ends the demands. Report the content to the platform, which must remove non-consensual intimate images within 2 hours of a complaint under the amended IT Rules, and file a complaint on the portal or with the police. Many platforms also have tools that block the same image from being reuploaded.

Abusive recovery by digital loan apps, with threats and messages to contacts, is both a cyber offence and a breach of RBI's digital lending rules. Our page on recovery agent harassment deals with the lending side. Victims of harassment can also ask the court for protection through a civil injunction, which can be quicker than the criminal process for stopping repeat posts.

Digital arrest and impersonation calls

There is no such thing as a digital arrest in Indian law. No police force, CBI, ED, customs or court arrests anyone over a video call or asks for money to be transferred to a safe account for verification. Calls of this kind, often with fake uniforms, fake court documents and threats of immediate arrest, are a fraud. Disconnect, do not transfer money, and report on 1930.

Genuine agencies issue written summons or notices, such as a notice under section 35 BNSS to appear, a PMLA summons or a court summons, served properly and verifiable with the agency or court. If you receive something that looks official, check it independently by calling the police station or court through a number you find yourself, not the one given in the message.

People who have already paid should report immediately and give the full call history and transaction details. These frauds are usually run by organised groups using many mule accounts, so the police often link complaints from different victims, which helps tracing.

Defamation and false posts on social media

A false post that harms your reputation can be dealt with in three ways, often together. A legal notice to the author demanding removal, an apology and sometimes damages. A complaint to the platform asking for removal under its policies and the IT Rules. And court action: a civil suit for injunction and damages, or a criminal complaint for defamation under section 356 BNS, which is filed before the magistrate as a private complaint rather than through an FIR.

Truth for the public good and fair comment on matters of public interest are defences, so a negative but honest review of a business is not automatically defamation. Courts look at the words, the context and the harm. For businesses, a civil suit with an interim injunction is often more useful than a criminal case, because it can order removal quickly. Our page on legal notices covers drafting and replying.

Section 66A of the IT Act, which punished offensive online messages, was struck down by the Supreme Court in Shreya Singhal v Union of India (2015) and cannot be used. If a police notice or FIR still cites it, that is a strong ground for relief.

Preserving electronic evidence

Cyber cases are won or lost on evidence that is easy to destroy. Take screenshots that show the date, time, profile name and URL. Save the full chat export where the app allows it. For emails, keep the original with full headers, not just a forward. Download bank statements showing the transaction and keep the SMS alerts. Write down phone numbers and UPI IDs exactly.

Do not confront the offender, post about the incident or reset the device before evidence is preserved. Where a phone or laptop holds key evidence, it may have to be given to the police for forensic examination; keep a copy of the data if you can and ask for a seizure memo. The court will later need a certificate under section 63 of the Bharatiya Sakshya Adhiniyam for electronic records, so record who took each screenshot and from which device.

In cyber cases that come to Advocate B.K. Singh's office, the weak point is usually not the law but the record: screenshots without dates, forwarded emails without headers, or a phone that was factory reset. Ten minutes spent saving evidence properly on the first day saves months of argument later.

Documents and evidence to keep

If you are accused or named in a cyber case

People are drawn into cyber cases in ways they do not expect. A student lets a friend use his bank account for a commission and finds it was a mule account. A shopkeeper receives a payment that turns out to be fraud money. An employee is accused of data theft by a former employer. A person who posted criticism online receives a defamation notice or police call. Each needs a careful response, because cyber cases often involve many victims and agencies across states.

If you receive a police notice under section 35 BNSS, reply and appear with an advocate. Many IT Act offences carrying three years are bailable under section 77B of the Act, but the BNS sections often added, such as cheating or organised crime, may not be. Where arrest is a real risk, our page on anticipatory bail explains how to seek protection.

Be careful with statements and devices. Do not delete data, which can be treated as destroying evidence. Do not contact complainants. Where the case is a commercial dispute dressed up as cyber fraud, quashing in the High Court may be possible after the facts are clear.

When your bank account is frozen by cyber police

A very common problem is an account frozen because some money linked to a fraud passed through it, often a small amount received for a genuine sale. The bank will usually say only that the freeze is at the request of the cyber police of a particular state, and give the complaint number from the national portal. The whole account may be blocked, not just the disputed amount.

Start by getting the details: which police station, which complaint, what amount. Write to the IO with proof of the genuine transaction and ask that the freeze be limited to the disputed amount. If that fails, an application can be made to the magistrate having jurisdiction for de-freezing or release, and in many cases High Courts have entertained writ petitions where whole accounts were frozen for small amounts without any notice or follow-up.

Courts have been critical of indefinite freezes without information to the account holder. But the account holder must also explain the transaction honestly. If you knowingly lent your account to someone, take advice before writing anything to the police.

For businesses: prevention, incident response and reporting

For startups and SMEs, the legal side of cybersecurity has three parts. Before an incident: contracts with employees and vendors that cover confidentiality and data return, access controls, a written incident response plan and a review of what personal data you hold. During an incident: contain it, preserve logs, and report. After: notify those who must be told and deal with liability.

CERT-In's directions of April 2022 require specified cyber incidents to be reported to CERT-In within six hours of noticing them, and require logs to be kept for a rolling period. The Digital Personal Data Protection Act 2023 and the DPDP Rules notified in November 2025, which come into force in phases, require breach intimation to the Data Protection Board and affected persons once the relevant provisions apply. Check the current schedule. Our page on data protection and cybersecurity compliance covers this in more detail.

Business email compromise, where a supplier's email is spoofed and payment is diverted, is the most common loss for SMEs. Call the bank immediately to recall the payment, report on 1930 and preserve the emails with headers. Train finance staff to verify any change of bank details by phone on a known number.

Compensation and civil remedies

Apart from the criminal case, the IT Act gives a civil remedy. Under section 43, a person who damages a computer system or data without permission is liable to pay compensation. Claims up to ₹5 crore go to the adjudicating officer appointed under section 46, usually the IT Secretary of the state; larger claims go to the civil court. Appeals lie to the Telecom Disputes Settlement and Appellate Tribunal. Section 43A makes a body corporate liable for negligence in protecting sensitive personal data, though the DPDP Act will gradually take over this area.

A civil suit is often the better tool when the goal is to stop something: an injunction against a former employee using stolen data, a takedown order against defamatory content, or an order restraining a fake website using your brand. Courts in Delhi regularly grant such orders, including against unknown persons, with directions to platforms and domain registrars.

Where the loss came from a bank's or service provider's failure, a consumer complaint may be filed. Consumer commissions have awarded compensation where banks did not act on timely fraud reports.

Mistakes victims and businesses make

• Waiting before reporting. A day's delay often means the money has left the first mule account. Report on 1930 first, then gather papers.
• Paying a sextortionist. Payment almost always leads to more demands. Preserve, block, report.
• Paying a recovery agent who promises to get the money back. Recovery scams target fraud victims. Only the police and court process can release frozen money.
• Deleting chats or resetting the phone. The evidence disappears and the case weakens.
• Treating every negative post as defamation. Honest opinion and true statements are defences. A notice that overreaches can draw attention to the post.
• For businesses, delaying CERT-In reporting. The six-hour window starts from noticing the incident, not from completing the investigation.

What to do this week after a cyber crime

• Call 1930 or report on cybercrime.gov.in and note the acknowledgement number
• Block cards, UPI and net banking and give the bank a written complaint
• Save screenshots, chat exports, emails with headers and bank statements
• Report the account, profile or content to the platform and keep the ticket
• File a written complaint at the cyber police station and ask for an FIR
• Change passwords and enable two-factor authentication from a clean device
• Do not pay anyone who promises recovery for a fee
• For a business, report to CERT-In within six hours and preserve logs

Time, cost and realistic expectations

Reporting takes minutes; an FIR, if the police cooperate, a few days. Freezing happens within hours of a prompt report. Release of frozen money through the magistrate commonly takes weeks to a few months, depending on the IO's report and how many victims claim the same pool. Trials in cyber cases take longer, often years, because of forensic reports and accused in other states.

Costs depend on what is needed: a complaint and follow-up with the police and bank, an application for release, a civil injunction, a defence in a criminal case or business compliance work. Court fees are modest; the main cost is the advocate's work and, where needed, a forensic examiner. Ask for an estimate per stage before starting.

Cyber cases overlap with other work: economic offences investigated by the EOW, which our page on economic offences covers, and bail where someone is arrested. If you want the facts and papers checked before you act, the team of Advocate B.K. Singh at Legals365 can review them and tell you the next step through talk to a lawyer.

Frequently asked questions

What should I do immediately after online fraud?

Call 1930 or report on cybercrime.gov.in at once, and block your card, UPI or net banking with the bank. Keep the acknowledgement number. Then file a written complaint at the cyber police station with your bank statement and screenshots.

Can I get my money back after cyber fraud?

Often a part of it, if you report quickly and the money is frozen in the receiving accounts. Frozen money is released by the magistrate on an application, usually after the IO's report. Money already withdrawn in cash is harder to recover.

Will the bank refund money lost in a fraud?

Under RBI's customer liability rules, if the fraud resulted from a third-party breach and you reported it within three working days, you should generally bear no loss. Where you shared the OTP or PIN, the bank may refuse. You can escalate to the RBI Ombudsman under the 2026 scheme after thirty days.

Where do I file a cyber crime complaint in Delhi?

Report on 1930 or cybercrime.gov.in, then go to the cyber police station of your police district. Every Delhi police district has one, and larger cases go to the Special Cell's IFSO unit. You can also file at your local police station, which can register a zero FIR.

Is a digital arrest real?

No. No police, CBI, ED or court arrests anyone over a video call or asks for money to be transferred for verification. Such calls are fraud. Disconnect and report on 1930.

What if someone is blackmailing me with private photos?

Do not pay and stop responding. Preserve the chats and profile links, report the content to the platform, which must remove intimate images within 2 hours of a complaint, and file a complaint on the portal or with the police. Payment usually leads to more demands.

My bank account has been frozen by cyber police. What can I do?

Get the police station and complaint details from the bank, and write to the IO with proof that your transaction was genuine, asking that only the disputed amount be held. If that fails, apply to the magistrate for de-freezing, and in suitable cases the High Court can be approached.

Is posting a negative review defamation?

Not if it is true or an honest opinion on a matter of public interest. Defamation requires a false statement that harms reputation. Businesses facing false posts usually do better with a legal notice and civil injunction than with a criminal case.

Can I file a case against a fake profile in my name?

Yes. Report it to the platform first, then file a complaint under section 66D of the IT Act and the BNS cheating by personation provision. Keep screenshots of the profile, its URL and any messages it sent to others.

Are IT Act offences bailable?

Under section 77B of the IT Act, offences punishable with three years are bailable. But cyber cases often include BNS offences such as cheating or extortion, which may be non-bailable. The answer depends on the sections in the FIR.

Does a company have to report a data breach?

CERT-In directions require specified cyber incidents to be reported within six hours. The DPDP Act and Rules require breach intimation to the Data Protection Board and affected persons as those provisions come into force in phases. Check the current schedule.

Can I claim compensation for hacking?

Yes. Under section 43 of the IT Act, claims up to ₹5 crore go to the state's adjudicating officer and larger claims to the civil court. You can also seek damages and an injunction in a civil suit.