Identity Theft, Phishing and Cheating by Personation Online

In India, misusing someone else's password, OTP, electronic signature or other unique identification feature is identity theft under Section 66C of the Information Technology Act, 2000, and cheating someone by pretending to be another person through a phone or computer is punished under Section 66D of the same Act. Both carry up to three years' imprisonment and a fine of up to one lakh rupees. The same facts usually also attract cheating (Section 318) and cheating by personation (Section 319) of the Bharatiya Nyaya Sanhita, 2023 (BNS), which replaced the old IPC Sections 415 to 420 from 1 July 2024.

This explainer is for B.A. LL.B. and LL.B. students preparing for cyber law and criminal law papers, and for any citizen who has received a fake "bank KYC" message or a call from someone claiming to be a police officer. Knowing which section applies, and where to report quickly, often decides whether money can be traced at all.

What do identity theft, phishing and personation mean in law?

The statutes do not use the word "phishing", so you have to map the facts to the sections. A typical phishing case has three stages, and each stage fits a different provision:

• The bait: a fake SMS, email or website that pretends to come from a bank, courier or government office. Pretending to be someone else in order to deceive is personation.
• The capture: the victim types a password, card number or OTP into the fake page. Using those credentials later is identity theft under Section 66C.
• The loss: money leaves the account. Deceiving a person into parting with property is cheating, and when it is done through a communication device or computer resource by personation, Section 66D applies.

Take a student in Nagercoil who gets a WhatsApp message from a number showing her college principal's photo, asking her to pay an "exam fee" urgently through a link. The fraudster has cheated by personation using a communication device. If he also used her saved login to her payment app, Section 66C is attracted as well.

What does the Information Technology Act say?

• Section 66C (identity theft): fraudulently or dishonestly making use of another person's electronic signature, password or any other unique identification feature. Imprisonment up to three years and fine up to one lakh rupees.
• Section 66D (cheating by personation using a computer resource): cheating by personation by means of any communication device or computer resource. Imprisonment up to three years and fine up to one lakh rupees.
• Section 66 (computer related offences): dishonest or fraudulent acts referred to in Section 43, punishable with up to three years or a fine up to five lakh rupees, or both.
• Section 77B: notwithstanding the Code of Criminal Procedure, an offence punishable with three years and above is cognizable, and an offence punishable with three years is bailable.

So Sections 66C and 66D offences are cognizable (police can register and investigate without a magistrate's order) but bailable. In Maharaj Saran v. State of Punjab (July 2026), a bench of Justices M.M. Sundresh and Prasanna B. Varale set aside a Punjab and Haryana High Court view that a Section 66 offence was non-bailable. The High Court had not considered Section 77B, which must be read with the punishment section.

What does the Bharatiya Nyaya Sanhita add?

Chapter XVII of the BNS restates the old IPC cheating provisions with new numbers:

• Section 318(1): definition of cheating (formerly IPC 415). A dishonest concealment of facts is deception.
• Section 318(2): simple cheating, up to three years, or fine, or both (formerly IPC 417).
• Section 318(4): cheating and dishonestly inducing delivery of property, up to seven years and fine (formerly IPC 420). Most phishing losses fall here.
• Section 319(1): cheating by personation (formerly IPC 416): pretending to be some other person, knowingly substituting one person for another, or representing oneself or another as someone else. The person impersonated may be real or imaginary.
• Section 319(2): punishment for cheating by personation, up to five years, or fine, or both (formerly IPC 419).

Because Section 318(4) carries up to seven years, it is often the heaviest charge in an online fraud FIR, far above the three years under Section 66D.

Can the IT Act and the BNS apply to the same act?

This is the favourite exam question. Two lines of reasoning exist:

1. Sharat Babu Digumarti v. Government of NCT of Delhi (Supreme Court, decided 14 December 2016): the Court described the IT Act as a special enactment and, reading Section 81 (overriding effect), held that where electronic obscenity is covered by the IT Act, the accused cannot be prosecuted under IPC Section 292 for the same conduct. A special law prevails over the general law.
2. Awadhesh Kumar Parasnath Pathak v. State of Maharashtra (Bombay High Court, three judge bench at Aurangabad, 15 April 2024): the Court limited Sharat Babu to cases where the two offences are the same. It held that Sections 43 and 66 of the IT Act do not capture the element of deceit, so cheating under IPC Sections 415 and 420 survives. The IPC offence is excluded only when every one of its ingredients is present in the IT Act offence. It disagreed with the earlier division bench in Gagan Harsh Sharma.

A third case anchors the cheating side: in Hridaya Ranjan Prasad Verma v. State of Bihar (2000), the Supreme Court held that a mere breach of contract is not cheating. Fraudulent or dishonest intention must exist at the time of the inducement. Phishing cases rarely have this problem, since the fake identity shows the intention from the start.

What should a victim do?

1. Call 1930, the national cyber crime helpline, as soon as you notice the loss. It is linked to the Citizen Financial Cyber Fraud Reporting and Management System, set up in 2021 so that fraud is reported quickly and funds can be stopped from moving onward.
2. File a complaint on the National Cyber Crime Reporting Portal, cybercrime.gov.in. Complaints there are passed to State police for conversion into FIRs.
3. Inform your bank and block the card or UPI handle. Keep screenshots, SMS headers, transaction IDs and the fraudster's number.
4. Remember that under Section 173 of the Bharatiya Nagarik Suraksha Sanhita, 2023 (BNSS), an FIR can be given at any police station irrespective of where the offence happened (Zero FIR), and information sent electronically must be signed by the informant within three days.

A tenant in Madurai who loses a rent deposit to a fake "landlord" profile on a property website follows the same steps. If you cannot afford a lawyer, the college legal aid clinic can explain the next steps.

How should you write this in an exam?

• Open with the definitions in BNS Section 318(1) and 319(1), then the special provisions in IT Act Sections 66C and 66D.
• Always give the old IPC number in brackets as a pointer, never as the main citation.
• Apply the ingredients to the facts: deception, dishonest inducement, personation, and use of a device.
• Discuss the overlap using Sharat Babu Digumarti and the 2024 Bombay High Court full bench, and conclude which charges can stand together.
• Close with Section 77B on cognizability and bail.

Sources

• NCRB, Bharatiya Nyaya Sanhita, 2023 (with BNS to IPC correspondence table): official text index and section mapping.
• Haryana Police, Information Technology Act, 2000 offence table: punishments and bail status for Sections 66, 66C and 66D.
• PIB, Strengthening the mechanism to deal with cyber frauds (6 August 2024): 1930 helpline, cybercrime.gov.in and the 2021 fraud reporting system.
• PIB, Steps taken to address digital arrest scams (12 March 2025): impersonation of police and agencies, awareness steps.
• Bombay High Court, Awadhesh Kumar Parasnath Pathak v. State of Maharashtra (15 April 2024): judgment on IT Act and IPC overlap.
• LiveLaw, Supreme Court on bailability of Section 66 IT Act (July 2026): report of Maharaj Saran v. State of Punjab.