Fake Google Pay profile of me: reporting and legal action

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 2 Nov 2026 · Cyber crime

A fake Google Pay profile in your name is identity theft under Section 66C of the Information Technology Act 2000 and cheating by personation under Section 66D, because the offender is using your identity to induce payments from people who trust you. Report it to the app, your bank and the cyber crime portal the same day, and file an FIR with the profile details.

The call usually comes from a relative or a colleague: they sent money to your Google Pay number, and you never received it. What has happened is that someone has built a payment identity around your name, your photograph and a phone number or UPI handle that looks like yours, and is using it to collect transfers from people in your contact list. The harm lands twice, once on the people who paid and once on your name, and both need to be addressed in the same week.

This is a different problem from a hacked account. In a takeover, the offender is inside your account. In an impersonation, your account may be untouched and entirely secure while a parallel identity operates beside it. That distinction decides the remedy: there is nothing to recover inside your account, and the work is to have the impostor identity reported, blocked and prosecuted before more people pay into it.

What the impostor is actually doing

Cloning the visible identity

A UPI payment profile shows a display name and, in many flows, a photograph. An offender who has your photograph from a social media account and knows your name can create a profile that is convincing at a glance. The payment handle behind it, however, must belong to a real bank account. That is the thread the investigation pulls: the money does not vanish, it lands in an account opened in someone's name, and that account holder is traceable.

Using a lookalike number

Phone numbers are the anchor of UPI. An offender may use a number that differs from yours by one digit, or a number saved in a victim's phone under your name because the victim's contact list was updated by a message. A contact list entry is not proof of identity, and the profile shown by the app is supplied by the payer's own phone book in some flows, which is why a familiar name can appear above an unfamiliar account.

Running the request in your name

The most damaging version is a message from a lookalike profile asking for a payment for an emergency, a medical bill or a business invoice. Because the name matches, the payer does not check the handle. By the time the payer calls you, the money has moved. In a variant, the impostor asks your contacts to scan a QR code, which is a payment instruction rather than a receive request.

What the law says

Section 66C of the Information Technology Act 2000 punishes identity theft: the fraudulent or dishonest use of another person's electronic signature, password or other unique identification feature. A payment profile built on another person's name, photograph and number falls within that description. Section 66D punishes cheating by personation using a computer resource or a communication device, and it is the more precise charge where the object was to induce a payment. Section 66 covers computer-related offences generally, and Section 67 applies where the impersonation is used to publish or transmit obscene material.

Section 318 of the Bharatiya Nyaya Sanhita 2023 supplies the cheating charge: the impostor deceives the payer into delivering property, and the delivery is the transfer. Section 316 applies only where property was entrusted to a person acting in a fiduciary capacity and then misappropriated, which is not the ordinary impersonation case. Section 351 applies where the impostor threatens the victim to stop him from reporting, which happens more often than complainants expect.

Where the impostor's messages make false statements about the victim's character or conduct, the civil claim is defamation, and it can be brought against the person who published the statement once identified. Where the impostor uses the victim's photograph, the victim's own copyright in that photograph and the right to control its commercial use may also be relevant, though the practical remedy is removal rather than damages. India does not yet have a standalone statutory tort of impersonation, so the criminal provisions and defamation carry the weight.

On procedure, Section 173 of the Bharatiya Nagarik Suraksha Sanhita 2023 governs the FIR in a cognizable case, and Section 175(3) allows a magistrate to direct investigation where the police decline to register. Section 63 of the Bharatiya Sakshya Adhiniyam 2023 governs the proof of electronic records and requires the prescribed certificate, which is why screenshots alone are a weak substitute for a preserved profile page and a transaction record.

Two regulators are relevant. The bank that holds the impostor's account is regulated by the Reserve Bank of India, and the payment system is operated by the National Payments Corporation of India under the RBI's oversight. A complaint that reaches the beneficiary bank through the police or through 1930 can lead to the account being frozen and the onboarding records being examined. Complaints to the app alone do not reach either regulator.

The first seven days

Day one: capture the profile. Open the impostor's profile in the app, record the screen showing the display name, photograph, UPI handle and the number, and note the date and time. Do not block the profile yet; blocking can remove it from your view before you have finished documenting it.
Day one: tell your contacts. A short, factual message to family, friends and business contacts that a fake profile in your name is operating and that no payment request from any new number should be honoured. This reduces the number of victims and it is evidence that you acted promptly.
Day one: report inside Google Pay. Use the report or help option to flag impersonation and the specific handle. Record the reference number. Ask the support channel in writing to preserve the account details for investigation.
Day two: file on cybercrime.gov.in. Choose the cyber crime category for impersonation and identity theft, upload the screen recording and the profile details, and note the acknowledgement number.
Day two or three: give a written complaint at the police station. Attach the profile capture, the messages received by payers, the statement of any person who paid, and the portal acknowledgement. Ask for the FIR, citing Sections 66C and 66D of the Information Technology Act 2000 and Section 318 of the Bharatiya Nyaya Sanhita 2023.
Day three to five: inform your bank. Ask the bank to note the impersonation on your account and to flag any UPI handle that uses your name but is not linked to your account. Some banks will record a caution note; the request itself creates a record.
Day five to seven: follow up in writing. If the profile is still live, write again to the app and to the police, quoting the earlier references. Where an FIR has not been registered, prepare the application under Section 175(3) of the Bharatiya Nagarik Suraksha Sanhita 2023 for the magistrate.

What the fake profile is and is not

Situation	What it means	Correct route
A handle using your name that you never created	Impersonation by a third party	App report, portal complaint, FIR
Your own handle, with unauthorised transactions	Account takeover, not impersonation	Bank dispute, 1930, FIR
A payer's phone showing your name against a strange handle	The payer's contact list is mislabelled	Correct the contact, report the handle
A photograph of you used on a profile	Identity misuse, possibly copyright	Report, FIR, takedown request
A message asking you to approve a collect request	Payment fraud aimed at you	Do not approve, report, preserve

What decides the outcome

The first factor is whether the beneficiary account can be identified. The payer's transaction record shows the handle and the receiving bank. If the account was opened with verified documents, the investigation has a person at the end of it. If it was opened with a rented or stolen identity, the chain lengthens and the case slows. The second factor is how quickly the freeze request reaches the beneficiary bank, because a balance that is still there can be held and a balance that has moved cannot.

The third factor is whether payers cooperate. An impersonation case is built on the statements of the people who paid. A complainant who gathers three signed statements with transaction references in the first week gives the police a ready file; one who says only that people paid because of him gives them a puzzle. The fourth is the clarity of the victim's own conduct. If the victim's photograph and number were public, the defence will argue that the impostor's identity was easy to guess and that the payers were careless, but that argument goes to the payers' diligence rather than to the impostor's guilt.

The fifth factor is whether the profile is taken down. Removal stops the loss but does not identify anyone, and platforms act on their own policies at their own pace. A victim who treats removal as the end of the matter usually finds that the same offender returns with a new handle. The FIR is what makes the second attempt traceable to the first. None of these factors produces a guaranteed result, and the outcome in any individual case depends on evidence that only the investigation can produce.

Mistakes that make it worse

Do not publish the impostor's number or photograph on social media with a call to harass, because a coordinated pile-on can expose the victim to a complaint. Do not pay the impostor to stop, which confirms that the identity is valuable and invites a repeat demand. Do not tell payers that you will reimburse them informally before the transactions are documented, because a payment made without a record weakens the account of what happened. Do not delete the messages from payers after noting them.

Do not assume that the app's removal of the profile closes the police case; the investigation is about the bank account behind the handle. And do not name a suspect on the basis of a similar name or a mutual acquaintance. Identification comes from bank records, not from intuition, and a wrongly named person can sue.

When to involve a lawyer

Where the profile is removed within a week and no one paid, the platform report and a portal complaint are enough. A lawyer becomes useful where money was collected in the victim's name and payers are looking to the victim for reimbursement, where the police treat the complaint as a civil dispute, where a defamatory statement accompanies the impersonation, or where the victim is being asked to explain transactions he never made. The immediate task in those cases is to separate the victim's liability from the impostor's, in writing, before positions harden. A cyber crime lawyer in Kolkata can prepare that record, and the parallel defamation and recovery options are described under civil litigation.

Need help with a cyber crime matter?

Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.

Call +91-9007000603 WhatsApp

Frequently asked questions

Someone made a fake Google Pay profile with my name. What do I do first?

Record the profile page showing the name, photograph, handle and number before doing anything else, then report it inside Google Pay and file a complaint at cybercrime.gov.in. Tell your contacts immediately that no payment request from a new number should be honoured. Do not block the profile until the capture is complete.

Is a fake Google Pay profile a criminal offence?

Yes. It is identity theft under Section 66C of the Information Technology Act 2000 and cheating by personation under Section 66D, with the cheating charge under Section 318 of the Bharatiya Nyaya Sanhita 2023. Each payer who was deceived adds a separate transaction to the case.

Am I liable if people sent money to a fake profile in my name?

Generally no, because you did not receive the money and did not authorise the profile. Liability would require your involvement or negligence in permitting the misuse. Report promptly and in writing so that your position is documented before payers begin demanding reimbursement. Keep the bank statement showing that no money reached you.

Can I get the fake profile removed quickly?

Removal depends on the app's review, and there is no guaranteed timeframe. Reporting impersonation with the profile capture and the payer's transaction record improves the chances of prompt action. Removal does not identify the offender, so the police complaint should continue. Ask the app to preserve the account records for the investigation.

What evidence should I keep about the fake profile?

A screen recording of the profile loading in the app, the display name, photograph, UPI handle and phone number, the date and time, the messages received by payers, their transaction references and signed statements. Keep the original device rather than forwarding screenshots. Section 63 of the Bharatiya Sakshya Adhiniyam 2023 applies to these records.

Can I sue for defamation over a fake payment profile?

Yes, where the impersonation included false statements about you that were published to others. The suit can seek damages and an injunction, and it runs separately from the criminal case. Identification of the person behind the profile is usually the practical obstacle. A conviction is not required for the civil suit to proceed.

What if the police refuse to register my impersonation complaint?

Ask for the refusal in writing, then apply to the magistrate under Section 175(3) of the Bharatiya Nagarik Suraksha Sanhita 2023 for a direction to investigate. Attach the portal acknowledgement and proof of the written complaint given at the police station. Attach the refusal in writing, not a verbal account of it.

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Cyber crime lawyer in your city · Bank account freeze help · Contact