Online fraud, UPI scams, fake investment apps, sextortion, account takeovers and so-called digital arrest calls have made cyber crime one of the fastest growing legal problems for individuals and businesses. Speed matters more than anything else in the first hours after a fraud.
Key laws
- Information Technology Act, 2000: Section 43 (unauthorised access and damage, with compensation), Section 66 (computer-related offences), Section 66C (identity theft), Section 66D (cheating by personation using a computer resource), Section 66E (privacy violation), Section 66F (cyber terrorism) and Sections 67 and 67A (obscene material).
- Bharatiya Nyaya Sanhita, 2023: cheating (Section 318), cheating by personation (Section 319), extortion, criminal intimidation, stalking, forgery and criminal conspiracy, often applied together with the IT Act.
- Digital Personal Data Protection Act, 2023, which is being phased in and creates obligations and penalties for data fiduciaries after data breaches.
What to do immediately
- Call the national cyber crime helpline 1930 at once and file a complaint on the cybercrime.gov.in portal. Early reporting can help freeze the fraudulent transfer.
- Inform your bank in writing and request blocking of the account or card. Under RBI's 2017 customer protection framework, a customer's liability is zero for unauthorised electronic transactions reported within three working days, where the fault lies with the bank or a third party.
- Preserve evidence: screenshots, call logs, URLs, transaction IDs, emails with headers.
- File a police complaint; under the BNSS, an e-FIR and Zero FIR can be registered irrespective of where the offence occurred.
Civil remedies
Under Section 46 of the IT Act, an Adjudicating Officer can award compensation for contraventions where the claim is up to five crore rupees, with appeals going to the TDSAT. Higher claims go to civil courts. Courts can also order takedown of defamatory or intimate content.
For businesses
CERT-In directions require reporting of specified cyber incidents within six hours. Companies should maintain logs, incident response plans, insurance and contractual protections with vendors. Directors can face exposure if negligence leads to loss of customer data.
Do not pay a second time to "release" blocked money, and never share OTPs or remote-access codes.
Need Guidance? Contact KC LEGAL
For more information or to discuss your matter with our advocates, call or WhatsApp +91 98311 90819, write to info@kclegal.us, or use our contact form. Our office is at Olisa House, 10th Floor, 4 Government Place, Kolkata 700001.
This article is for general information only and is not legal advice. Law and procedure change; please verify the current position for your specific case. Last reviewed: November 2026.