Identity Theft in India: Section 66C of the IT Act Explained

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 4 Nov 2026 · Cyber law

Identity theft in India is the offence under Section 66C of the Information Technology Act, 2000, which punishes a person who fraudulently or dishonestly makes use of another person's electronic signature, password or any other unique identification feature, with imprisonment up to three years and a fine up to one lakh rupees.

Identity theft, as a criminal offence in India, is Section 66C of the Information Technology Act, 2000. It punishes a person who fraudulently or dishonestly makes use of the electronic signature, password or any other unique identification feature of any other person. The punishment is imprisonment of either description up to three years and a fine up to one lakh rupees. The offence is cognizable and bailable, which means the police may register a case and arrest, but bail is a matter of right rather than a discretion of the court once the conditions are satisfied.

The section is narrower than the phrase suggests, and getting the ingredients right is what decides a case. Section 66C is not a general prohibition on copying personal data, and it is not a remedy for every fake profile. It applies to the use of a specific credential or identifier that belongs to another person, used dishonestly or fraudulently. That focus is why the section is often charged together with broader provisions for cheating and forgery, rather than instead of them.

The exact ingredients of Section 66C

Three elements must be shown. First, there must be a use, not mere possession: the section punishes making use of the credential, so holding someone's password without using it is not by itself an offence under this section. Second, the thing used must be an electronic signature, a password, or any other unique identification feature of another person, which includes things such as a one-time password, a biometric template, or another person's account credentials. Third, the use must be fraudulent or dishonest, which imports the ordinary criminal law meaning of acting with intent to gain wrongfully or to injure. If the use is unauthorised but innocent in intent, the case may fail on this element even though the access was wrongful.

How the credential is usually obtained

The way a credential is taken rarely matters to the definition of the offence, but it matters enormously to proof and to the connected charges. The most common routes are phishing, where a person is induced to enter a password on a look-alike page; SIM swap, where the mobile number that receives a one-time password is taken over; credential stuffing, where passwords leaked from one service are tried on another; and insider access, where an employee or family member already has the credentials. Each route leaves a different trail. A phishing attack leaves the fake page and the message that delivered it; a SIM swap leaves a trail at the telecom operator; credential stuffing leaves repeated failed logins; insider access leaves contemporaneous, legitimate-looking activity that is nevertheless unauthorised. Building the complaint around the actual route is what makes the misuse provable rather than merely alleged.

How Section 66C sits beside 66B, 66D and 66

Identity theft rarely travels alone. The same facts commonly satisfy several sections, and the charge sheet may cite more than one. Understanding the division avoids the common error of pitching a complaint to the wrong provision.

Provision	What it covers	Punishment
Section 66C	Using another person's e-signature, password or unique identification feature	Up to 3 years and fine up to one lakh rupees
Section 66D	Cheating by personation using a computer or communication device	Up to 3 years and fine up to one lakh rupees
Section 66B	Dishonestly receiving or retaining a stolen computer resource or device	Up to 3 years or fine up to one lakh rupees or both
Section 66	Computer-related offences done dishonestly or fraudulently, such as unauthorised access	Up to 3 years or fine up to five lakh rupees or both

The practical difference is where the harm lands. Section 66C targets the misuse of the credential itself. Section 66D targets the deception of the victim who is induced to act, such as a person who transfers money believing a fake profile. Section 66 targets the wrongful access to the computer resource. Where money is moved from a hacked bank account, a charge sheet may well use 66C and 66D together, and the court will look at each element separately rather than treat them as one offence.

Other laws that stack on the same facts

Because identity theft usually produces a gain, the penal law of the Bharatiya Nyaya Sanhita, 2023 also applies. Where the identity is used to induce the delivery of property, Section 318(4) does the work, with imprisonment up to seven years and fine. Where the offender cheats by pretending to be someone else, Section 319 applies, with imprisonment up to five years or fine or both. Where the identity is used to create or use a forged document or electronic record, the forgery provisions, including Section 336, come into play. Under the IT Act, Section 72 punishes a person who has access to records and discloses them in breach of a lawful contract or confidentiality, with imprisonment up to two years or fine up to one lakh rupees. Where personal data is involved, the Digital Personal Data Protection Act, 2023 imposes obligations on a data fiduciary to safeguard the data and to report a breach, and a failure to comply carries consequences under that Act.

Identity theft against a business, not only a person

The section protects any person's unique identification feature, and businesses are victims as often as individuals. A takeover of a company's email account, a compromise of a payment gateway login, or the use of a director's digital signature to authorise a transfer are all within the section. For a business, the practical harm is not only the money moved but the loss of control over its own identity, which can be used to defraud customers, suppliers and bankers. Treating a business account takeover as a mere internal security incident, rather than a criminal offence worth reporting, is a frequent and expensive error.

Step-by-step: what to do when your identity is used

Secure the account at once. Change the password, revoke active sessions, and enable two-factor authentication, so that the use stops and the trail is not overwritten by further activity.
Report to the platform or service provider through its official channel, and keep the reference number. Ask it to preserve the access logs.
If any money moved, call your bank immediately and inform the bank's nodal officer, then report on the national cyber crime portal cybercrime.gov.in or the helpline 1930. Under the RBI directions on unauthorised electronic transactions, prompt reporting can limit your liability.
Collect and preserve your own evidence: the transaction reference, the message headers, the fake profile, the screenshots with visible dates, and the platform's acknowledgement.
File a written complaint at the jurisdictional police station, giving the facts in chronological order and identifying the specific credential misused, so that Section 66C is evident on the face of the complaint.
If the police do not register the case, you may apply to the Magistrate under Section 175(3) of the BNSS to direct an investigation, or file a complaint before the Magistrate.
Where electronic records are relied on, keep the certificate requirement of Section 63 of the Bharatiya Sakshya Adhiniyam, 2023 in mind, so the records are capable of being proved in court.
Preserve everything in its original form. Do not reformat the device, delete the messages, or clear the account history, because that destroys the very record that proves the misuse.

What decides whether an identity theft case succeeds

The first question is elemental: can the prosecution show the use of a feature that is genuinely unique to the victim, such as a password, a one-time password, or a biometric identifier? A generic piece of information that many people share may not qualify. The second is intent: was the use dishonest or fraudulent, or merely careless or unauthorised? The third is attribution: who actually used the credential? In a cyber case, the log may show that an account was used from an internet connection, which is not the same as showing which person was at the keyboard, and courts are alert to that gap. The fourth is the victim's own conduct: sharing a password, or failing to report a known compromise for a long period, may be weighed when liability is decided. The fifth is promptness, because delay in reporting lets the trail go cold and weakens the complaint.

A court also looks at whether the harm was completed or merely attempted, because the punishment and the framing of the charge can differ, and at whether the accused had authority that was exceeded rather than no authority at all. Where access was within the scope of a person's role but was used for a dishonest purpose, the case is often run as a cheating or breach of trust matter alongside the credential misuse, rather than as a pure identity theft.

Common mistakes after identity theft

Deleting the fake profile, messages or emails before preserving them, which removes the best evidence.
Reporting only to the platform and not to the police, so no criminal case is ever registered.
Framing the complaint as a general fraud without identifying the credential misused, which makes Section 66C harder to apply.
Waiting weeks to tell the bank, which allows the money to be layered and weakens any claim to limited liability.
Assuming the offence must have been committed by a stranger, when in fact internal access is often involved.
Ignoring the civil side, where a civil claim for recovery may supplement the criminal complaint in civil litigation.

The defences that are actually run

Defences in identity theft cases tend to follow a few patterns. The accused may argue that the victim consented to the use, which negates dishonesty, though consent to one use is not consent to every use. The accused may argue that the credential was not a unique identification feature within the meaning of the section. The accused may argue misidentification, pointing to shared devices or shared connections, and asking the prosecution to prove who was operating the device. The accused may argue that there was no fraudulent or dishonest intent, particularly where the use was within a family or employment relationship that the parties later fell out over. These defences succeed or fail on the evidence trail, which is why preservation matters to both sides.

When to involve a cyber crime lawyer

Identity theft cases are decided on the quality of the record: what was used, by whom, and with what intent. A lawyer can help a victim frame the complaint so that Section 66C and the connected provisions are properly invoked, and can help an accused test whether the prosecution has truly proved the use and the intent, rather than merely the access. For matters in Kolkata and across West Bengal, a cyber crime lawyer in Kolkata can work with the local police and courts on both the complaint and any connected application. To discuss a specific case, use the contact page.

Need help with a cyber crime matter?

Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.

Call +91-9007000603 WhatsApp

Frequently asked questions

What is identity theft under Section 66C of the IT Act?

Section 66C of the Information Technology Act, 2000 punishes a person who fraudulently or dishonestly makes use of the electronic signature, password or any other unique identification feature of another person. The punishment is imprisonment of either description up to three years and a fine up to one lakh rupees. The offence is cognizable and bailable under the IT Act framework.

What is the punishment for identity theft in India?

The punishment under Section 66C is imprisonment of either description for a term which may extend to three years, and a fine which may extend to one lakh rupees. Because the offence is bailable, a person accused under this section can seek bail as a matter of right. Where cheating and forgery are also charged, the maximum punishment can be higher.

Does Section 66C apply to using someone's password without permission?

Yes, if the use is fraudulent or dishonest. Section 66C punishes making use of another person's password, electronic signature or unique identification feature. Mere possession without use is not the offence, but logging into an account with another person's password, or using their one-time password, plainly falls within the section when the intent is dishonest or fraudulent.

How is Section 66C different from Section 66D?

Section 66C targets the misuse of the credential itself, such as a password or electronic signature. Section 66D targets cheating by personation, where a person deceives someone by pretending to be another, using a computer or communication device. The two often apply to the same facts, and a charge sheet may cite both, because the court examines each element separately.

How do I report identity theft in India?

First secure the account and change the password. Report to the platform and, if money moved, to the bank's nodal officer and the national helpline 1930 or the portal cybercrime.gov.in. Then file a written complaint at the jurisdictional police station identifying the exact credential misused. If the police do not register the case, apply to the Magistrate under Section 175(3) of the BNSS.

Can a business be a victim of Section 66C identity theft?

Yes. The section protects any person's unique identification feature, and a company account takeover, a compromised payment login or the misuse of a director's digital signature all fall within it. For a business, the loss of control over its own identity can be used to defraud customers and suppliers, so treating the matter as a mere security incident rather than a criminal offence is a costly mistake.

What evidence should I preserve after identity theft?

Preserve the original device, the screenshots with visible dates, the fake profile, the message headers, the transaction reference and every acknowledgement from the platform and bank. Do not delete messages, clear the history or reformat the device. Where electronic records are later relied on in court, the certificate requirement under Section 63 of the Bharatiya Sakshya Adhiniyam, 2023 also becomes relevant.

What defences are used in identity theft cases in India?

Common defences are that the victim consented to the use, that the information was not a unique identification feature, that the accused was misidentified because devices or connections were shared, and that there was no fraudulent or dishonest intent. These defences turn on the evidence trail, which is why the preservation of logs and original records matters to both the prosecution and the accused.

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Cyber crime lawyer in your city · Bank account freeze help · Contact