What To Do If Your Identity Is Stolen Online?

In a digital world where everything from a bank transaction to social networking is literally just a click away from fraud, identity theft now ranks as one of India’s most shocking cybercrimes. Identity theft involves stealing someone’s personal information, whether a name, Aadhaar number, PAN, bank information, or biometric data and using it for fraud without consent.  

Identity theft can include a myriad of illegal actions, from using someone’s credit card number without authorization to sim plucking (a process of taking your mobile number and impersonating and pretending to be that person) to opening fake social network accounts. Identity theft can result in immense financial loss, emotional loss, and loss of reputation.

This article describes the steps that Indian citizens can take in the event that their identity has been stolen online, as well as what laws they may want to reference, real cases, potential judicial remedies, and what this fraud may look like.

What is Online Identity Theft?

Online identity theft occurs when someone uses your personal information, Aadhaar, PAN, phone number, or other banking details, without your express consent, to commit fraud. Common tricks:

• Open loans or credit cards in your name 
• Accessing your email or social media accounts
• Cloning your SIM to intercept OTPs
• Creating fake profiles to scam others using your name
• Filing fake income tax returns or opening wallets linked to your Aadhaar

You might only discover it after receiving a bank alert, credit rejection, or legal notice.

What Indian Law Says About Identity Theft?

Indian law certainly recognizes identity theft in the statute, but you need to know what sections apply.

Under the IT Act 2000:

• Section 66C: Identity theft (prison 3 years maximum + 1 lakh fine) 
• Section 66D: Impersonation using digital tools
• Section 43A: Right to compensation if your data wasn’t protected properly
• Section 72A: Punishment for leaking your information without consent

Under the Indian Penal Code/ Bhartiya Nyaya Sanhita:

• Section 419 IPC/ Section 319 (2) BNS: Cheating by impersonation
• Section 420 IPC/ Section 318 (4) BNS: Inducing delivery of property (i.e., financial fraud)
• Sections 468 & 471 IPC/ Sections 336 (3) & 340 (2) BNS: Forgery and using fake documents

Aadhaar Act, 2016:

• Section 37: Impersonation during Aadhaar-based authentication

Step-by-Step: What to Do When Identity Was Stolen?

1. Collect Every Bit of Evidence 

Take screenshots of:

• Suspicious messages or emails
• Fake profiles or transactions
• OTPs or SMS logs
• Fraudulent emails or loan messages

2. Change All Passwords Immediately

Before filing anything, secure your digital life:

• Change all passwords to your emails, banking, and social media accounts
• Use two-factor authentication (2FA) wherever possible 
• Factory reset your phone 
• Reinstall only trusted apps

3. Report It to the National Cyber Crime Portal

India has a central online reporting system: www.cybercrime.gov.in Choose “Report Other Cyber Crimes,” describe your case in detail, and upload evidence. Within 48 hours, you will receive a tracking number and a follow-up from the local cyber cell.

4. File an FIR 

Your digital complaint is not enough if money or reputation is at stake. Go to the nearest police station and file an FIR under relevant IPC/BNS and IT Act sections.

If the police refuse: Use Section 154(3) CrPC/Section 173 BNSS (to the SP) or Section 156(3) CrPC/Section 175 BNSS (to a magistrate) to escalate.

5. Alert Your Bank, SIM Provider, and Credit Agencies

• Bank: Block the debit card and enable fraud alerts
• Mobile provider: Issue a new SIM to prevent OTP theft
• CIBIL & Experian: Flag your credit profile
• UIDAI: Lock your Aadhaar biometrics so they can’t be used again 

What Happens to You Legally After You Lodge a Complaint?

You can seek criminal punishment or a civil penalty. 

Criminal Route:

• IT Act and IPC/BNS allow prosecution with penalties from 3 to 7 years imprisonment

Civil Route:

• Under Section 43A, you can demand compensation for the stress and time wasted
• You can also ask the court for an injunction to remove fake profiles created using my identity

Indian Cases That Made a Difference

• State of Tamil Nadu v. Suhas Katti (2004): India’s first cyber conviction, an imposter used a woman’s name online. The accused was jailed under the IT Act and IPC.
• Avnish Bajaj (Bazee.com Case): Taught us that digital platforms can be held liable for failing to prevent misuse of your identity.
• Shreya Singhal v. Union of India (2015): Even if it was focused on “speech,” it enabled clearer cybercrimes for punishment. 

How do you stop identity theft from starting?

• Enable 2FA everywhere
• Don’t share personal data on unknown sites or phone calls
• Lock your Aadhaar biometrics
• Review your credit report every few months
• Be cautious with social media, your oversharing could help scammers

Why Identity Theft Cases Are Hard to Solve in India?

• Lack of awareness: Many don’t even report it
• Police are under resourced: Cyber cell are overpowered
• Cross border fraud: Some perpetrators sit in other states, or even countries 
• Victims act late: By then, the damage is already done

Latest Indian Legal Tools That Help Victims

• Digital Personal Data Protection Act 2023: This enables you to sue platforms in a court of law for mishandling your data
• CERT-In Rules (in force from 2022): Companies must report breaches within 6 hours of being aware of the breach
• Indian Cyber Crime Coordination Centre: It is a central system for all the digital complaints
• Cyber Surakshit Bharat: It is a government initiative on awareness and training

Final Thoughts

It may be frightening if you had your identity stolen via online means, however, there are both legal and practical ways to fight back. 

Act quickly. Secure your accounts. Report to cybercrime authorities. File an FIR. And don’t stop until action is taken. India’s laws are finally catching up with the digital age, and your best defense is awareness, speed, and knowing your rights.

One can talk to lawyer from Lead India for any kind of legal support. In India, free legal advice online can be obtained at Lead India. Along with receiving free legal advice online, one can also ask questions to the experts online free through Lead India.

FAQs

1. Is Aadhaar misuse identity theft? 

Yes, it is considered identity theft. In the event that a party uses your Aadhaar for authentication purposes, in financial transactions or for the purposes of activating a SIM card without your consent, it would be classified as identity theft.  Identity theft in this sense is an offence under Section 37 of the Aadhaar Act. 

2. How can I tell if someone is misusing my PAN or Aadhaar?  

You can check your credit report from CIBIL or other credit bureaus for unknown loans or inquiries. Also, UIDAI and PAN services often show authentication logs and linked service requests.

3. Under the new Digital Personal Data Protection Act, 2023, can I sue a company if they leak my personal data? 

Yes. As per the Digital Personal Data Protection Act, 2023, you can make a complaint to the Data Protection Board and claim compensation if, as a consumer, the company has failed to protect your personal data or has misused it.