What Is Identity Theft Under Indian Law?
Identity theft occurs when someone fraudulently obtains and uses another person's personal information without permission. This includes details such as name, Aadhaar number, PAN card, bank account information, mobile number, email ID, photographs, or biometric data. Criminals use this stolen information to commit fraud, impersonation, or financial crimes.
Under identity theft laws India, these acts constitute serious criminal offences punishable with imprisonment and fines. The legal framework addressing identity theft operates through multiple statutes:
- Bharatiya Nyaya Sanhita, 2023 (BNS) - governs criminal liability for cheating and forgery
- Information Technology Act, 2000 - covers cyber-related identity theft and impersonation
- Aadhaar Act, 2016 - addresses Aadhaar-specific misuse
- Prevention of Money Laundering Act, 2002 - applies when identity theft facilitates financial fraud
Cyber impersonation and misuse of personal information form the core elements of identity theft crimes. Common scenarios include using stolen identity to open bank accounts, apply for loans or credit cards, commit financial fraud, file fake FIRs, create fraudulent social media profiles, access email accounts, submit false tax returns, or claim government benefits illegally.
Key Legal Provisions Under Identity Theft Laws India
Bharatiya Nyaya Sanhita, 2023 (BNS)
The BNS replaced the Indian Penal Code, 1860 in July 2024. Several provisions now directly address identity theft laws India:
Section 318(2) BNS: Cheating by Personation
This provision punishes anyone who cheats by pretending to be another person or knowingly substituting one person for another. The offence carries imprisonment up to 5 years and a fine.
Section 336 BNS: Forgery
Creating or using false identity documents, forging signatures, or fabricating KYC details to impersonate someone attracts imprisonment up to 2 years, a fine, or both.
Section 340 BNS: Forgery of Valuable Security
Forging bank documents, cheque books, PAN cards, or Aadhaar cards to misuse another person's identity results in imprisonment up to 7 years.
Information Technology Act, 2000
Section 66C: Identity Theft
This is the primary cyber provision under identity theft laws India. Anyone who fraudulently or dishonestly uses another person's electronic signature, password, or unique identification feature faces imprisonment up to 3 years and a fine up to ₹1 lakh.
Section 66D: Cheating by Personation Using Computer Resource
If someone cheats by impersonating another person through a computer, website, mobile device, or social media platform, they face imprisonment up to 3 years and a fine up to ₹1 lakh. This provision covers cyber impersonation through email spoofing, fake social media profiles, WhatsApp account takeovers, or fraudulent OTP-based access.
Section 43: Unauthorised Access and Data Theft
Accessing someone's computer system, email, cloud storage, or mobile data without permission attracts compensation claims and damages.
Aadhaar Act, 2016
Section 35: Prohibition on Misuse of Aadhaar Information
Unauthorised collection, use, or disclosure of Aadhaar data carries imprisonment up to 3 years and a fine up to ₹10,000.
Section 37: Impersonation
Pretending to be someone else using their Aadhaar number or biometric data results in imprisonment up to 3 years and a fine up to ₹10,000. These provisions are particularly important as misuse of personal information through Aadhaar-based fraud has become widespread in loan and SIM card scams.
Intermediary Guidelines and Digital Media Ethics Code Rules, 2021
Online platforms must provide mechanisms for users to report identity theft incidents. These rules require intermediaries to respond promptly and assist victims in removing fraudulent content or accounts.
Common Identity Theft Scenarios in India
Bank Account and Credit Card Fraud
Someone uses stolen Aadhaar, PAN, and mobile OTP to open a bank account or apply for a credit card in your name. They drain funds, default on payments, or run financial frauds using your identity. Victims often discover the fraud only when recovery agents call or credit bureaus flag unpaid loans.
SIM Card Cloning or KYC Misuse
Your mobile number is cloned, or someone uses your Aadhaar photocopy to activate a SIM card in your name. That SIM is then used in cyber scams, OTP frauds, or UPI thefts. When police trace the SIM registration, you may be implicated as the accused.
Social Media and Email Impersonation
Fraudsters create fake Facebook, Instagram, LinkedIn, or email accounts using your name, photograph, and personal details. They use these accounts to scam your friends and family, extort money, spread false information, or damage your reputation. This represents classic cyber impersonation under identity theft laws India.
Loan and Tax Fraud
Criminals use stolen identity documents to take out loans, credit cards, or apply for government benefits. They may also file fraudulent income tax returns in your name, creating tax liabilities you never incurred. You discover the problem when you receive demand notices or when applying for legitimate credit.
Legal Action Steps Under Identity Theft Laws India
If you discover that your identity has been stolen or misused, act immediately. The longer you wait, the more digital and financial damage accumulates.
File a Police Complaint or Cyber FIR
Visit your nearest State Cyber Crime Cell or local police cyber station and file a detailed FIR under relevant provisions:
- Section 66C IT Act (identity theft)
- Section 66D IT Act (cheating by personation)
- Section 318(2) BNS (cheating by personation)
- Section 336 or 340 BNS (forgery of identity documents)
You can also file an online complaint through the National Cyber Crime Reporting Portal at cybercrime.gov.in.
Timeline: Police should register the FIR within 24-48 hours of your complaint. Obtain a copy of the FIR and Case Diary Number (CDN) for your records.
Notify Financial Institutions and Service Providers
Immediately inform:
- All banks where fraudulent accounts may have been opened
- Credit bureaus (CIBIL, Experian, Equifax) to flag identity theft
- Mobile operators (Airtel, Jio, Vodafone) if SIM fraud is suspected
- UIDAI if Aadhaar misuse is involved
- Income Tax Department if tax fraud occurred
Send written emails and register complaints on official portals. Request account freezes, SIM deactivation, and flagging of fraudulent entries. Keep copies of all correspondence.
Preserve Digital Evidence
Collect and preserve all relevant evidence:
- Screenshots of fake social media profiles
- Fraudulent transaction alerts
- Emails or messages from scammers
- KYC documents used by impersonators
- Call recordings or OTP messages
- Bank statements showing unauthorized transactions
This evidence must be certified under Section 63 of the Bharatiya Sakshya Adhiniyam, 2023 (BSA) to be admissible in court. Use screen recording tools with timestamps when possible.
Request Forensic Analysis
In serious cases, ask the investigating cyber cell to conduct forensic analysis of:
- Fraudulent bank accounts
- SIM card registration trail
- IP address logs
- Device metadata
- Digital signatures and authentication records
This analysis establishes whether fraudulent activity originated from your devices or someone else misused your identity.
File for FIR Quashing If Wrongly Implicated
If police have incorrectly named you in a cyber FIR due to identity theft by someone else, file a petition under Section 531 of Bharatiya Nagarik Suraksha Sanhita, 2023 (BNSS) in the High Court to quash the FIR.
Provide evidence showing:
- You did not open the fraudulent account
- Your identity documents were stolen or misused
- No digital trace links you to the alleged fraud
- Timeline proving you could not have committed the act
Apply for Anticipatory Bail If Arrest Is Imminent
If there is a threat of arrest due to mistaken identity, apply for anticipatory bail under Section 483 BNSS in the Sessions Court or High Court.
Demonstrate:
- Prima facie evidence that your identity was stolen
- No intentional involvement in the fraud
- Full cooperation with the investigation
- Readiness to appear when required
Legal Remedies Available Under Identity Theft Laws India
Criminal Prosecution of Fraudsters
Under identity theft laws India, actual fraudsters face:
- Imprisonment: 3 to 7 years depending on severity
- Fine: ₹1 lakh to ₹10 lakh
- Compensation to victims
Courts impose these penalties after conviction following proper investigation and trial.
Civil Compensation for Damages
You can file a civil suit claiming:
- Financial loss due to identity theft
- Defamation and reputational damage
- Mental harassment and stress
- Loss of business opportunities
Courts award compensation based on proven damages with supporting documentation.
Removal of Fraudulent Records
You can demand:
- Deletion of fake social media accounts
- Removal of fraudulent credit records from CIBIL
- Reversal of fraudulent tax filings
- Cancellation of fake SIM cards
- Closure of unauthorized bank accounts
Provide the FIR copy and supporting evidence when making these requests.
Injunction Orders
If a fraudster actively uses your identity online, apply for an urgent injunction order in civil court to stop them from continuing the impersonation. This remedy is particularly useful when ongoing harm is occurring while criminal investigation proceeds.
Common Mistakes to Avoid in Identity Theft Cases
Delaying FIR Registration
Many victims wait weeks before reporting, allowing fraudsters to cause more damage. File the FIR immediately upon discovery. Delays may raise suspicion about your involvement.
Not Preserving Digital Evidence Properly
Screenshots without timestamps, deleted messages, or unverified emails make weak evidence. Use screen recording tools, obtain certified email printouts, and seek forensic preservation when possible.
Ignoring Credit Bureau Reports
Even after reporting identity theft, fraudulent loan entries may remain on your CIBIL report unless you formally dispute them. File a dispute with supporting FIR copy and monitor the resolution.
Trusting Recovery Agents Who Demand Advance Payment
Scammers often pose as cyber recovery experts and charge upfront fees. Only work with legal professionals or official cyber crime cells. Verify credentials before engaging anyone.
Not Consulting a Lawyer Early
If you are falsely implicated in a cyber FIR due to identity theft, consult a lawyer immediately. Self-representation often results in weak defense and prolonged harassment. Early legal intervention prevents complications.
Sharing Personal Information During Investigation
Be cautious about sharing additional personal information with unknown parties claiming to investigate your case. Verify the identity of anyone requesting such information.
Preventive Measures Against Identity Theft
While identity theft laws India provide remedies, prevention is always better:
- Never share Aadhaar, PAN, passport, or bank details over email, WhatsApp, or phone
- Enable two-factor authentication on all online accounts
- Regularly check your credit report for unauthorized accounts
- Use virtual credit cards for online shopping
- Shred old identity documents before disposal
- Monitor bank statements and UPI transactions weekly
- Report lost mobile phones immediately to block SIM
- Avoid posting personal details publicly on social media
- Use strong, unique passwords for different accounts
- Be cautious with unsolicited messages requesting personal information
- Limit sharing of information on public Wi-Fi networks
- Review privacy settings on social media platforms regularly
Frequently Asked Questions About Identity Theft Laws India
Can I go to jail if someone uses my identity to commit fraud?
No, if you can prove your identity was stolen and you had no involvement in the fraud, you cannot be held criminally liable. However, you must file an FIR immediately and cooperate with the investigation to establish that you are a victim, not the perpetrator. Delays in reporting may create suspicion.
What should I do if someone opened a bank account using my Aadhaar and PAN?
File a cyber FIR immediately under Section 66C of the IT Act and Section 318(2) BNS. Notify the bank in writing, request an account freeze, and inform UIDAI and the Income Tax Department about the misuse of personal information. Request forensic verification of KYC documents submitted. Collect all evidence showing you did not authorize the account opening.
How long does it take to resolve an identity theft case in India?
Resolution depends on case complexity. Simple cyber impersonation cases may conclude in 6 to 12 months. Cases involving financial fraud, fake accounts, or multiple fraudsters may take 2 to 3 years. Evidence quality and cooperation with investigation significantly affect timelines. Preliminary investigations typically begin within days of filing the FIR.
Can I sue the bank for allowing someone to open an account using my stolen identity?
Yes, you can file a civil suit for negligence if the bank failed to verify KYC documents properly. Banks have a legal duty to authenticate identity documents under RBI guidelines. You can claim compensation for financial loss and mental harassment. Gather evidence showing the bank's failure to follow proper verification procedures.
Is it possible to remove my name from CIBIL if fraudulent loans were taken in my name?
Yes. After filing an FIR, submit a CIBIL dispute request along with FIR copy and proof that you did not apply for the loan. CIBIL will investigate and remove fraudulent entries if your claim is verified. This process usually takes 30 to 45 days. Follow up regularly to ensure completion.
What is the punishment for someone who steals and misuses my identity in India?
Under identity theft laws India, the fraudster faces imprisonment up to 3 to 7 years and a fine up to ₹1 lakh under IT Act provisions. If forgery or financial fraud is involved, BNS provisions impose additional punishment. Courts may also order compensation to be paid to the victim. The actual sentence depends on the severity and impact of the crime.
Can I report identity theft online or do I need to visit the police station?
You can file an online complaint through the National Cyber Crime Reporting Portal at cybercrime.gov.in. However, for serious cases involving financial fraud or false implication, visit the State Cyber Crime Cell directly to ensure your FIR is registered under correct provisions and evidence is preserved properly. Physical filing often results in faster action.
How does identity theft affect my credit score?
If someone takes out loans or credit cards in your name and defaults, these negative marks appear on your credit report, significantly lowering your credit score. This impacts your ability to get legitimate loans, credit cards, or housing. Dispute these entries immediately with credit bureaus using your FIR as proof.
What documents do I need to file an identity theft complaint?
Bring your valid photo ID (Aadhaar, PAN, passport, or driving license), proof of the fraud (bank statements, credit reports, screenshots of fake accounts), copies of any communication from fraudsters, and any other relevant documents showing unauthorized use of your identity. The more comprehensive your documentation, the stronger your case.
Can identity theft cases be resolved through mediation?
Generally no. Identity theft constitutes a criminal offense that requires police investigation and prosecution. However, you may settle civil compensation claims through mediation after criminal proceedings conclude. The criminal aspect must proceed through the legal system.
Conclusion
Identity theft laws India provide strong legal protection against misuse of personal information and cyber impersonation, but enforcement depends on timely action, proper evidence preservation, and correct legal strategy. Whether you face stolen Aadhaar-based fraud, fake social media profiles, or false implication in a cyber FIR due to identity misuse, understanding your rights under the Bharatiya Nyaya Sanhita, 2023, Information Technology Act, and Aadhaar Act is critical.
Do not wait. File your FIR immediately upon discovering the theft, preserve digital evidence properly, notify banks and credit bureaus, and consult a qualified legal professional to protect your identity and reputation. The sooner you act, the better your chances of minimizing damage and achieving a favorable outcome.
Legal awareness is essential in today's digital landscape. Stay vigilant, take preventive measures, and know your rights under identity theft laws India to protect yourself from this growing threat.
Disclaimer: This article is for informational purposes only and does not constitute legal advice. Please consult a qualified legal professional for specific guidance.
About LawCrust
LawCrust Legal Consulting, a subsidiary of LawCrust Global Consulting Ltd., is a top full-service legal firm in Mumbai, Delhi, Bangalore and across India, delivering strategic legal solutions for NRIs, HNIs, and businesses with a global perspective. Since 2016, we have successfully handled over 10,000 cases through a strong network of 70+ in-house lawyers and senior partnered advocates.
We represent clients across all levels of the judiciary, from Magistrate Courts and High Courts to the Supreme Court of India, handling complex matters including NRI divorce, cross-border property disputes, immigration, corporate governance, mergers and acquisitions (M&A), and structured finance.
LawCrust also pioneers innovative legal solutions such as Litigation Finance, the Legal Protect Plan, and specialized services for law firm startups and enterprise fundraising. With a commitment to confidentiality, senior expertise, and result-driven strategy, LawCrust stands as a trusted legal partner for high-impact and complex legal challenges.
For expert legal assistance, contact us:
Call Now: +91 8097842911
Email: inquiry@lawcrust.in