What is Cyber Crime in India? Law and Punishments

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 4 Nov 2026 · Cyber crime

Indian law does not use a single definition of "cyber crime". Instead, conduct is punished through two overlapping statutes: the Information Technology Act 2000, which deals specifically with computers, data and digital identity, and the Bharatiya Nyaya Sanhita 2023, which covers the underlying offences — cheating, forgery, criminal breach of trust, intimidation, stalking and obscenity — whether they happen offline or online.

The two statutes that apply

The IT Act creates offences that only exist in a digital setting. Section 43 makes unauthorised access, downloading, damage or disruption of a computer resource actionable, with compensation to the affected person. Section 66 turns that into a criminal offence punishable with up to three years. Section 66C covers identity theft — the fraudulent use of another person's electronic signature, password or unique identification feature — and section 66D covers cheating by personation using a computer resource. Both carry up to three years and a fine of up to one lakh rupees. Section 66E punishes capturing or publishing private images, and sections 67, 67A and 67B deal with obscene and sexually explicit material.

The BNS supplies the general criminal law. Cheating is section 318 (the old section 420 IPC), criminal breach of trust is section 316, forgery and using a forged document are sections 336 and 340, extortion is section 308, criminal intimidation is section 351, stalking is section 78, and sexual harassment by electronic means falls under section 75. When a fraud happens through UPI, a fake job offer or a cloned WhatsApp account, the charge sheet usually names both statutes.

Common categories of cyber crime

• Financial fraud — UPI and card fraud, OTP theft, fake customer-care calls, investment and trading scams, loan-app extortion.
• Identity and account offences — WhatsApp or Instagram cloning, SIM swap, Aadhaar or PAN misuse, fraudulent loan applications in your name.
• Data offences — unauthorised access to email or business systems, data theft by a departing employee, ransomware.
• Offences against a person — sextortion, morphed images, non-consensual intimate imagery, cyber stalking, online defamation, threats.
• Offences by the accused — being named in an FIR for cheating, forgery or abetment when the transaction was genuine or you were a victim yourself.

Punishments at a glance

Punishments depend on the value involved, the section invoked and whether there is a repeat conviction. A charge sheet can name several sections at once.

How a cyber crime complaint is filed

There are three routes, and they are not alternatives — the first two usually run together.

1. Dial 1930. The national cyber crime helpline raises a request to freeze the destination account. This only works while the money is still traceable, so it is the first call, not the last.
2. File at cybercrime.gov.in. The portal accepts complaints from anywhere in India, generates an acknowledgement number, and routes the matter to the state police cyber cell. Keep the acknowledgement — every later step quotes it.
3. Register an FIR. A physical FIR is registered at the police station with jurisdiction over the victim's address. If the police decline, an application can be made to a judicial magistrate under section 175(3) BNSS asking for a direction to register it.

For a business or a high-value fraud, the complaint should be drafted with a chronological table, the transaction trail and the specific sections invoked. A file that arrives with that structure moves through the cyber cell far faster than a plain narrative.

What evidence decides the case

Digital evidence is fragile. Chat screenshots without the phone number visible, edited screenshots, or a bank statement with the relevant rows missing are the most common reasons a complaint stalls. Preserve the original device, export the transaction history as a PDF from net banking, note the UTR or UPI reference for every transfer, keep the fraudster's account number, UPI handle and the numbers used to call, and save call recordings. Under the Bharatiya Sakshya Adhiniyam 2023, electronic records need a certificate in the prescribed form when produced in court, and a lawyer should prepare that certificate at the time of filing rather than at the trial.

If you are named as an accused

Cyber crime FIRs often name account holders whose accounts received the defrauded money, even when they were only intermediaries or had their own accounts misused. In that situation the priority is different: get the FIR copy, identify the sections, apply for anticipatory bail where arrest is likely, and gather proof that the account was compromised or that the transaction was genuine. Section 175(3) BNSS, bail under sections 480 and 482 BNSS, and quashing under section 528 BNSS are the usual tools.

Why early legal involvement changes the outcome

In financial cyber crime the recoverable window is measured in hours, not weeks — after that the money moves through mule accounts. In offences against a person, the risk is that a badly drafted complaint gets closed as "no cognisable offence". In both cases, a lawyer's job at the start is narrow and practical: fix the forum, fix the sections, and make the first filing complete. That is the difference between a case and a complaint number.

The Procedural Road From Complaint to Charge Sheet

Cyber offences raise two questions that ordinary FIRs do not: where the case is registered, and how the electronic evidence is made admissible. Getting the procedure wrong at the start is the most common reason a technically sound case stalls.

Registration and jurisdiction

An offence under the Information Technology Act, 2000 is investigated by the police, and information can be given at any station irrespective of where the offence was committed. Where the offence is cognizable, the officer is bound to register it. The complainant may also file on the national cybercrime reporting portal, which routes the matter to the relevant cyber cell. Courts generally hold that a cyber offence with effects felt in several States can be tried where the complainant resides or where any part of the offence occurred.

The offences most often invoked

Steps a complainant should follow

1. Preserve the device and the account before anything is deleted; do not factory reset a phone that carries the evidence.
2. Take dated screenshots, export the chats with media, and record the URL of every profile involved.
3. Report the transaction or incident to the bank and the platform at once if money or an account is involved.
4. Give the written complaint with a clear chronology and the transaction reference numbers.
5. Obtain the FIR or complaint number and follow the investigation through the cyber cell.

Evidence under the Bharatiya Sakshya Adhiniyam, 2023

Electronic records are proved through the certificate prescribed under the new evidence law, which replaces the certificate practice under the earlier provision. The certificate should identify the device, the person in lawful control of it, the manner of extraction and the hash value where available. It is best prepared at the stage of filing rather than at the trial.

For assistance with a cyber matter see cyber law services and the contact page.

If you have lost money or data to a cyber offence, the first conversation is free. Call +91-9007000603 with the transaction details.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• Subramanian Swamy v Union of India: cyber defamation
• State of Haryana v Bhajan Lal: quashing a cyber crime FIR
• Shreya Singhal v Union of India: Impact on Cyber Law
• Ravinder Singh v State of Punjab: when is it cheating?
• K.S. Puttaswamy v Union of India: privacy and cyber crime
• Justice K.S. Puttaswamy (Aadhaar): privacy in cyber crime

Cyber crime lawyer in your city · Bank account freeze help · Contact