Cyber crime

Cyber crime here means the offences committed through computers, phones and networks that an ordinary person or business meets: online cheating, identity theft, impersonation, extortion and the misuse of accounts and data. The page is for a person or a business that is the victim of one of these offences or is accused of one. The page on white-collar and cyber defence overlaps with this one on Information Technology Act offences. The difference is that this page concerns victim and individual matters, while that page concerns proceedings by agencies such as the Serious Fraud Investigation Office and corporate matters.

The offences

The Information Technology Act, 2000 (IT Act) creates offences for the misuse of computer resources. Section 66 punishes a dishonest or fraudulent act of the kind listed in section 43, such as unauthorised access to a computer system or the introduction of a virus. Section 66C punishes the fraudulent or dishonest use of another person's electronic signature, password or other unique identification feature, which is the offence usually called identity theft. Section 66D punishes cheating by personation using a computer resource. Sections 66E, 67, 67A and 67B deal with violation of privacy and the publication or transmission of obscene, sexually explicit material and material depicting children. Section 66A was struck down by the Supreme Court in Shreya Singhal v. Union of India (2015) and cannot found a charge.

The Bharatiya Nyaya Sanhita, 2023 (BNS), which replaced the Indian Penal Code, 1860 (IPC) on 1 July 2024, supplies the general offences that cyber fraud usually also attracts. Cheating is in section 318 (sections 415 and 420 IPC), and cheating by personation in section 319 (section 416 IPC). Others include criminal breach of trust in section 316 (section 405 IPC), forgery from section 336 (the IPC forgery sections), extortion in section 308 (section 383 IPC) and criminal intimidation in section 351 (section 503 IPC). Organised crime under section 111 includes, in its definition, cyber crime among the continuing unlawful activities, where a syndicate acts together. The IT Act and the BNS can both be invoked on one set of facts.

The IT Act also has a civil side. Section 43 gives compensation for unauthorised access and damage, claimed before the adjudicating officer appointed under the Act where the claim does not exceed INR 5 crore, and before the civil court above that, with appeal to the Telecom Disputes Settlement and Appellate Tribunal, which took over from the Cyber Appellate Tribunal.

Reporting and investigation

A complaint can be made on the National Cybercrime Reporting Portal run by the Indian Cyber Crime Coordination Centre of the Ministry of Home Affairs, and at the nearest police station. The national cyber crime helpline is 1930. The portal registers the complaint and routes it to the State. A report that discloses a cognizable offence is recorded as an FIR under section 173 of the Bharatiya Nagarik Suraksha Sanhita, 2023 (BNSS), which replaced the Code of Criminal Procedure, 1973 (CrPC), and the Sanhita permits it to be given electronically.

In Karnataka, cyber crime is dealt with by the Cyber, Economic and Narcotics (CEN) police stations, set up at the level of the districts and the Bengaluru City commissionerate, and by the Cyber Crime unit of the Criminal Investigation Department. Section 78 of the IT Act provides that offences under the Act are investigated by a police officer not below the rank of Inspector. The police can require production of a phone, laptop or account data under section 94 of the BNSS (section 91 CrPC) and seize it under section 106 (section 102 CrPC). Electronic records are proved under section 63 of the Bharatiya Sakshya Adhiniyam, 2023, with the certificate that section requires.

Freezing and release of bank accounts

In a cyber fraud the money often moves through several accounts in quick succession, and the police, on information from the portal or the bank, freeze accounts that received it. The police usually treat a freeze as a seizure under section 106 of the BNSS (section 102 CrPC), which must be reported to the Magistrate, though some High Courts have held that holding funds as suspected proceeds of crime needs an order under section 107. Courts have held that a freeze must be tied to an offence and to the suspected proceeds, and that an account holder whose funds are blocked can apply to the Magistrate for release, or approach the High Court of Karnataka under section 528 of the BNSS or in writ jurisdiction.

The questions that decide such an application are the link between the funds and the alleged offence, the period of the freeze, and the whole of the account balance that is held against a smaller disputed sum. The victim of the fraud may in the same proceedings seek the return of the money, which the court can order on conditions.

Business incidents

A company affected by a breach or by fraud in its systems has reporting duties as well as a complaint to make. Directions issued by the Indian Computer Emergency Response Team (CERT-In) in April 2022 under section 70B of the IT Act require specified kinds of incident to be reported within six hours of being noticed, and the reporting duties under the sector regulations, which differ by sector, may add to this. Section 85 of the IT Act fixes responsibility on those in charge of a company when it contravenes the Act. Where personal data is involved, the Digital Personal Data Protection Act, 2023 applies as its provisions come into force.

The accused

Under section 77B of the IT Act an offence punishable with imprisonment of three years or more is cognizable, and an offence punishable with three years is bailable, which affects arrest and bail. The BNSS procedure for notice of appearance under section 35, bail under sections 480 and 482, and quashing under section 528 apply as in any criminal case, and the general stages are on the page on criminal defence. Common disputes concern who actually operated an account or device, whether the electronic record is certified, and whether an account holder who received money had knowledge of its origin.

What the law does not allow

A prosecution under section 66A of the IT Act. Admission of an electronic record without the certificate section 63 of the BSA requires. An investigation of an IT Act offence by an officer below the rank of Inspector.