Fake website scam: what it is and how it works

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 4 Nov 2026 · Online fraud

A fake website scam is a cloned or invented online store, booking portal, job page, loan page or "official" service site that takes your money and gives you nothing in return. It works because it imitates something you already trust: a known brand, a payment page you recognise, a government scheme, or a seller who looks legitimate for the length of one transaction. Indian law does not treat this as a mere commercial dispute. Sections 66C and 66D of the Information Technology Act, 2000 cover identity theft and cheating by personation using a computer resource, and sections 318 and 319 of the Bharatiya Nyaya Sanhita, 2023 cover cheating and cheating by personation.

What makes these scams dangerous is that the website itself is the evidence, and websites are built to vanish. A page can go offline within hours of a complaint, and its domain can be re-pointed to a new design overnight. Your case therefore depends on freezing two things at once: a copy of the site as it stood when you were defrauded, and a clean record of the money leaving your account. Everything else follows from those two.

What a fake website scam actually is

It helps to separate the common shapes, because the legal response and the investigation route are slightly different for each.

Clones of real brands

A page reproduces the look, logo and layout of a genuine e-commerce site, airline, hotel chain or bank, often on a domain that differs from the real one by a letter or a word. The checkout is a payment gateway skin over the fraudster's own account. The product is never shipped, and a "customer care" number on the page is answered by people who keep the victim talking while the payment settles.

Phantom shops

A shop exists briefly, lists an attractive catalogue and prices, collects prepaid orders, and then disappears with the money. These operations are cheap to run and are often reopened within days under a new name. Because there was never any intention to deliver, the transaction is a deception from the first click rather than a late delivery.

Fake job and loan portals

A portal advertises work or credit, charges a "registration", "processing", "insurance" or "verification" fee, and then asks for documents and more payments. The victim is left with neither the job nor the loan and has disclosed identity documents to an unknown operator, which creates a second risk of identity misuse.

Red flags, and what each one really means

What the law says

The Information Technology Act, 2000 is the first layer. Section 66D punishes cheating by personation using a computer resource or a communication device, and it fits a fake website that impersonates a brand or the victim's counterparty. Section 66C covers identity theft, which applies where login credentials, signatures or unique identifiers are misused. Section 66 generalises computer-related offences, and section 67 concerns obscene material in electronic form where a scam also involves threats.

The Bharatiya Nyaya Sanhita, 2023 is the second layer. Section 318 covers cheating, section 319 covers cheating by personation, and section 316 covers criminal breach of trust where money was entrusted for a specific purpose and kept back. Section 336 covers forgery, which is engaged where a fake invoice, receipt or identity document is created to keep the victim paying.

Procedure is the third layer. Under section 173 of the Bharatiya Nagarik Suraksha Sanhita, 2023 an FIR may be filed electronically, and it must be reduced to writing and signed where the informant appears in person. For the digital material itself, section 63 of the Bharatiya Sakshya Adhiniyam, 2023 sets out when an electronic record is treated as a document and what its certificate must contain, which is the basis on which page captures and payment records are proved. Where the loss moves through a bank, card or wallet, the Reserve Bank of India's directions on unauthorised electronic transactions govern how the customer's liability is assessed, and prompt written reporting is decisive.

How the money is moved once you pay

The payment is rarely the end of the trail; it is the start of a laundering step. Funds are pushed quickly from the collection account into a network of mule accounts, then withdrawn as cash, converted into prepaid instruments, or used to buy easily resold goods. Because this happens within hours, the freeze window is short. That is why the first report, to the helpline 1930 and to cybercrime.gov.in, and the first written notice to your bank's cyber-fraud nodal officer, are the actions that matter most. A complaint filed after a week is still a valid complaint, but the money is usually gone.

What to do, in order

Preserve the website before you do anything else. Download a full-page capture, note the exact URL, the domain name and the time you accessed it, and photograph the checkout page showing where the payment was directed. Preserve the payment record next: the bank statement, the UPI reference or UTR, and the merchant descriptor. Then report to 1930 and cybercrime.gov.in and keep the acknowledgement number. Send a written complaint to your bank the same day, by email and at the branch, asking that the transaction be flagged and the beneficiary account placed on hold. Finally, file a police complaint at the cyber cell or the police station with jurisdiction, or electronically under section 173 of the BNSS, and attach the page captures with the payment record.

What decides the outcome

Whether a fake website case succeeds turns on three things. The first is the authenticity of the page evidence: a capture with the URL, the timestamp and the rendered design is worth more than a description in the complaint, and a section 63 certificate strengthens it further. The second is the speed of the freeze; traced and held funds can be restored, while funds already layered away rarely are. The third is whether the victim's conduct left the fraudster with an excuse, such as sharing an OTP, forwarding a password, or allowing remote access to the device, all of which push the analysis toward contributory negligence.

Common mistakes

• Waiting for the site to "process the order" until the domain is already dead.
• Reporting only to the website's own support email, which is controlled by the fraudster.
• Deleting the confirmation email and the SMS showing the payment.
• Sharing identity documents such as Aadhaar or PAN images on a fake portal.
• Responding to a "refund" agent who asks for a fresh payment or an OTP to release money.
• Re-litigating the loss with the fraudster's chat desk instead of filing the freeze request the same day.

Where to escalate in West Bengal

In Kolkata and the districts, a fake website complaint can be filed with the cyber cell and escalated where required before the Bankshall Court or the City Sessions Court, with the Calcutta High Court as the supervisory court for the state. Where a police station declines to register the FIR, a complaint can be moved before a magistrate under the BNSS. A lawyer experienced in these cases can prepare the electronic-records certificate and align the bank, police and court tracks so they do not contradict each other. You can see the practice area at cyber crime lawyer in Kolkata services and the state-specific route at cyber law services in West Bengal.

How these pages are built and spread

Fake websites are assembled from bought or cloned templates and promoted through paid ads, search results, social media pages and forwarded links. Because the whole operation lives online, it can be rebuilt under a different name within a day of being reported. This is why the identity behind the domain, and not only the domain itself, matters. Investigators look for the registrar records, the hosting location, the payment-gateway account and the merchant details behind the checkout. Each of those is a point your complaint can ask to be preserved, and each is easier to trace while the page is still live.

Preserving the page: what a good capture contains

A page capture is useful only if it can be tied to you and to a moment in time. A good capture shows the full address bar with the domain, the page as rendered, the checkout or payment screen, and any contact number or address the site displays. Save the underlying HTML file as well as a screenshot, because the code can reveal the real payment endpoint even when the visible page is a copy. Keep the original file, not a forwarded or edited version, and record the device and browser you used. This is the material that a certificate under section 63 of the Bharatiya Sakshya Adhiniyam later describes.

Talking to your bank: what to say

When you write to your bank, be specific and be early. Identify the transaction by reference number or UTR, state the date, the amount, the merchant name shown and the reason you believe the payment was fraudulent, and ask, in writing, that the transaction be treated as disputed and the beneficiary account placed on hold. Ask for the complaint to be acknowledged with a reference number, because the liability tiers for unauthorised electronic transactions under the Reserve Bank of India's directions are measured from the date you notify the bank. Follow up by email so that a written record of every step exists.

Why the first day decides the freeze

Money collected by a fake website is usually swept out of the collection account the same day. Investigators can only hold what is still sitting somewhere, so the gap between your payment and your freeze request is the single largest factor in whether anything is recovered. This is the practical reason the sequence in this article is fixed: capture the page, capture the payment, report to 1930, notify the bank in writing, then file the police complaint. Reversing that order, for example arguing with the seller's support desk first, usually costs the very time that mattered.

When to involve a lawyer

Bring in a lawyer when the loss is substantial, when the bank has rejected a liability claim, when the police have not registered an FIR despite a written complaint, or when the fraud has also exposed your identity documents. A lawyer can pursue the magistrate route, seek preservation orders, and build the section 63 certificate that makes the page evidence usable. Good fake-website cases are won on what was saved in the first day, not on what was argued in the last month.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• Trading app scam: what it is and how the fraud runs
• Stock market scam: how the fraud actually runs in India
• Mutual fund scam: what it is and how the fraud runs
• KYC Update Scam: What It Is and How It Works in India
• AI voice cloning scam what it is and how it works
• Work From Home Scam: What It Is and How It Runs

Cyber crime lawyer in your city · Bank account freeze help · Contact