Fake Social Media Account Used to Cheat People in My Name

What Just Happened to Me?

Your phone has been buzzing all morning. A school friend you haven't heard from in years sends a worried message: "Are you stuck? Why did you ask me for ten thousand on Instagram?" Then your cousin calls. Then a colleague. Same story. Someone has copied your name, your photo, perhaps even your bio, and is now sliding into your contacts' DMs with a hard-luck story and a UPI link. You feel a strange mix of shame, anger, and fear. None of this is your fault. None of it is your debt. And yet your reputation is already taking damage.

This is one of the fastest-growing complaints handled at every cybercrime cell in India. The good news is the law has caught up. Indian statutes treat this exact scenario as a stack of offences, not just one. The not-so-good news is that nobody hands you a checklist when it happens. So this guide gives you that checklist, in plain language, with real legal authority underneath every step.

What the Law Actually Calls This

In ordinary speech we call it a "fake account". In legal language it is a bundle: identity theft, cheating by personation, and where money is involved, plain old cheating. Each of those has a separate provision and a separate punishment.

The Information Technology Act 2000 was specifically expanded in 2008 to cover this kind of conduct. Where the wrongdoer uses a computer or a phone to cheat by pretending to be another person, the IT Act treats it as a special offence carved out from ordinary cheating. The Indian Penal Code already had a provision for cheating by personation since 1860, and that provision continues to apply in parallel. So the impostor is rarely facing one charge; they are usually facing three or four, stacked together.

The Two IT Act Sections That Bite

Two sections of the IT Act do most of the work in fake-account cases. Both were inserted by the 2008 amendment when Parliament realised the original 2000 law had no clear answer to identity theft online.

The first is Section 66C, identity theft. The provision punishes anyone who "fraudulently or dishonestly" makes use of the electronic signature, password or any other unique identification feature of another person. The maximum sentence is three years' imprisonment and a fine up to one lakh rupees. The phrase "any other unique identification feature" is deliberately wide. It captures your photographs, your video clips, your registered handle, your OTP, anything that ordinary people associate uniquely with you. The provision is drafted to keep up with technology that did not exist when the law was written.

The second is Section 66D, cheating by personation by using a computer resource. This is the operative section in 90 percent of fake-account cases. The text reads:

Whoever, by means of any communication device or computer resource cheats by personating, shall be punished with imprisonment of either description for a term which may extend to three years and shall also be liable to fine which may extend to one lakh rupees.

The IT Act commentary itself ties Section 66D back to the IPC. The expression "cheats by personation" is borrowed straight from Section 416 of the Indian Penal Code: a person cheats by personation if he cheats by pretending to be some other person, or by knowingly substituting one person for another, or by representing that he or any other person is a person other than he really is. The explanation under Section 416 makes clear it does not matter whether the person being impersonated is real, imaginary, or even deceased. So if someone makes a fake account in your name, your late grandmother's name, or a fictitious identity, and uses it to deceive your contacts, the offence is made out.

One honest caveat: Section 66D is currently a bailable offence. That is a statutory shortcoming the legal community has flagged. It means an arrested impostor can claim bail as a matter of right. This is why FIRs are almost always registered with both 66D and the IPC sections, because the IPC sections raise the stakes considerably.

IPC: Cheating, Personation and Forgery

Three IPC provisions sit alongside the IT Act in your complaint. Knowing what each one does helps you brief the police properly.

Section 415, IPC defines cheating in general. To deceive someone, and by that deception induce them to deliver property, or to do or abstain from doing something which causes harm to their body, mind, reputation or property, is cheating.

Section 416, IPC defines cheating by personation. The Supreme Court has held in State of UP v Ram Dhani (1987) that securing benefits by posing as someone connected to authority is squarely within personation. In Appasami (1889), an early but still cited ruling, a person who falsely represented himself as another at a university exam was held guilty of cheating by personation and forgery. The principle is that pretending to be someone else and reaping a benefit is itself the harm; the law does not wait for actual money to change hands.

Section 419, IPC is the punishment provision. Whoever cheats by personation can be punished with imprisonment of either description up to three years, fine, or both.

Section 420, IPC applies the moment the impostor extracts money or anything that is property. Cheating combined with dishonest inducement to deliver property is punishable with imprisonment up to seven years and fine. Section 420 is non-bailable, which is why it transforms the seriousness of any FIR. When even one of your contacts has actually transferred money to the impostor, Section 420 comes into play.

Where the impostor has gone further and fabricated documents in your name (forged ID cards, screenshot edits showing fake transactions, edited bank statements to support the scam), Sections 463, 464, 465 and 471 of the IPC on forgery and using a forged document as genuine come into play. The Supreme Court in Mohammed Ibrahim v State of Bihar (2009) spelt out the three categories of "false document" under Section 464: the document is signed claiming to be by someone else; the document is altered without authority; or the signature is obtained from someone who could not understand its contents.

The First Hour: What to Do Before Anything Else

The hour after you discover the fake account is the most important hour. Three things matter and they all happen in parallel.

One, warn your contacts. Post a clear notice from your real account saying a fake profile is impersonating you. Send the same message to your closest people on a separate channel. This protects them and creates a contemporaneous record that you knew about the fraud and acted.

Two, take screenshots. Capture the fake profile page, the URL bar, the messages your contacts received, any payment requests, and any link in the bio. Use the date and time visible. Save them in a folder named after the date.

Three, dial 1930 if money has changed hands. The national cybercrime helpline 1930 and the portal cybercrime.gov.in trigger inter-bank coordination that can put a hold on the destination account. Speed is everything; delays of even a few hours often allow money to be drained through a chain of mule accounts.

Filing the FIR or a Zero-FIR

The FIR is the formal first information report under Section 154 of the criminal procedure law. A leading commentary describes it as "the earliest information given to the Police which sets the investigation in motion". Once the FIR is registered, the police are duty-bound to investigate.

Two practical points. First, the FIR does not need every detail. The Supreme Court has repeatedly held that the FIR is not an encyclopaedia of the incident; it has to set out the gravamen, the broad outline. So do not waste hours drafting the perfect document. Get the basics on paper and let the investigating officer fill the gaps later.

Second, jurisdiction is rarely a problem. If the local police station argues that the impostor is in another city and so the case is not theirs, you can lodge a zero-FIR. A zero-FIR is registered without a serial number at any police station, and is then transferred to the station with proper jurisdiction. This is precisely the safety valve for cyber offences where the offender may be anywhere in India.

Bring three things to the police station: a printed copy of your screenshots, your photo ID, and a one-page written complaint listing the IT Act 66C and 66D charges, IPC 419 and 420 if money is involved, and any forgery sections if relevant. If you have already received a refusal at the police station and want to know your options, that is an exhausted route worth understanding before going further.

Getting the Platform to Pull the Account Down

Reporting a fake profile inside the app is step one but rarely enough. Indian intermediary law layers grievance officers on top of in-app reporting. Under the Information Technology Rules 2021, every social media platform with significant Indian users must publish the name and contact of an India-based grievance officer who must acknowledge a complaint within 24 hours and resolve it within roughly 15 days.

So the second step is to write directly to the grievance officer. The email goes from your real registered email and contains your photo ID, the URL of the fake profile, the URL of your genuine profile, and a clear sentence that says someone is impersonating you for fraud. Attach the screenshots. Attach a copy of your FIR or your cybercrime portal acknowledgement number. Once the FIR copy goes in, removal usually accelerates because intermediaries treat law-enforcement-linked complaints with a different priority.

If the platform delays beyond 15 days, escalation goes up to the appellate body created under the IT Rules. Note that none of this stops your criminal case; it runs in parallel.

When to Send a Civil Notice for Defamation

Not every fake account requires a civil suit. If the only damage is annoyance, the criminal route is enough. But fake accounts often go further: they post abusive content, send sexually charged messages to your colleagues, or damage your professional standing.

Where reputation injury has crossed the line, a civil legal notice for defamation is a parallel remedy. The notice asks for an unconditional apology, removal of the offending content, and damages. If the impostor and the platform do not comply, the next step is a civil suit for defamation seeking damages and a permanent injunction. The civil court can also order the platform to take the content down even before the criminal investigation concludes.

Where the case involves financial harm to your contacts, this overlaps with the topic of criminal cheating and fraud, which may add charges and shift the bargaining position considerably.

Preserving Evidence the Court Will Accept

Most victims fail at the evidence stage even though they had everything in their hands on day one. Indian law treats screenshots, chat exports and platform records as electronic records. The Indian Evidence Act, in Section 65B, lays down the conditions under which such records are admissible.

Two practical takeaways. The first is the Section 65B certificate. The certificate is a short document signed by a person responsible for the device used to capture the evidence. It identifies the electronic record, describes the device, confirms the device was working normally during the relevant period, and confirms the output was produced in the regular course of activity. The Supreme Court in Anvar P V v P K Basheer (2014) held that compliance with Section 65B is mandatory for secondary electronic evidence, and that without the certificate, the secondary evidence is inadmissible. The Court warned that "electronic records being more susceptible to tampering, alteration, transposition, excision" need such safeguards or "the whole trial based on proof of electronic records can lead to travesty of justice".

The earlier ruling in Tomaso Bruno v State of Uttar Pradesh (2015) reinforced that paper printouts of electronic records stored in optical or magnetic media are admissible under Section 65B(1) only when the conditions of Section 65B(2) are met.

The second takeaway is hygiene. Keep the originals untouched. Copy them once into a separate folder. Hash the files if you can. Note the device and software used. Note whether the screenshot was taken from your phone, your laptop, or downloaded from the platform's data export. The fewer hands the data passes through, and the cleaner the chain of custody, the harder it is for any defence lawyer to argue tampering at trial.

Reasonable Timelines and Honest Limits

Speak honestly to yourself about timelines. A typical fake-account case in India looks like this. FIR registration takes a day if all your papers are in order. The platform typically removes the profile within 7 to 15 days of a clean grievance officer notice. Police identification of the impostor, where they are within India and used a domestic SIM or bank account, takes 4 to 12 weeks. Where the operator is abroad, behind a VPN, or using crypto, identification may take much longer or never reach a clear conclusion.

Civil suits for defamation, if filed, run on civil timelines, which means months at the notice stage and a year or more if the matter is contested.

This is not meant to discourage you. It is meant to set realistic expectations so you do not lose patience. The system works, but it works at its own pace, and the cleanest cases are the ones where the victim acted within hours of discovery.

What Should I Actually Do Now?

1. Post a public warning from your real account within the first hour. Tell your contacts a fake profile is circulating and ask them not to act on any payment request received from any account other than yours.
2. Capture every shred of evidence. Take screenshots of the fake profile, the URL, the messages sent to your contacts, the payment requests. Save them dated.
3. Call 1930 immediately if any money has been transferred. The faster the call, the higher the chance the destination account can be put on temporary hold by the bank. File the parallel complaint at cybercrime.gov.in.
4. Lodge an FIR at your nearest police station. If they push back on jurisdiction, ask for a zero-FIR. The complaint should mention IT Act Sections 66C and 66D, IPC Sections 419 and 420, and IPC forgery sections if any document has been fabricated.
5. Email the platform grievance officer. Include your ID proof, the fake profile URL, the screenshots, and the FIR acknowledgement. Demand removal within 15 days under the IT Rules.
6. Decide on the civil notice. If the impostor has damaged your reputation, instruct a lawyer to send a defamation notice asking for apology, takedown, and damages.
7. Preserve your evidence formally. Keep originals untouched. Prepare a Section 65B certificate noting the device and the regular use. If possible, get the screenshots notarised; that adds an extra layer of credibility for trial.
8. Tell your bank. Add an SMS alert and a transaction notification on every account so any related fraud attempt is flagged early.
9. Track your case number. Note the FIR number, the police station, the IO's name and number, the cybercrime portal complaint ID, and the platform ticket ID. Follow up every 7 to 10 days.
10. Stay off the impostor's profile. Do not message them, do not engage. Every interaction muddies the evidence. Let the police make contact.

If you reach a point where the police are not making progress, the platform is unresponsive, and your contacts are still receiving messages from the fake profile, that is a good moment to bring a lawyer in. At Pinaka Legal we routinely help victims escalate stalled cyber complaints through a structured combination of follow-up writs, grievance appellate complaints, and parallel civil notices. The aim is straightforward: get the account down, get the impostor identified, and protect your reputation while it is still recoverable.

Frequently Asked Questions

Is making a fake account in my name a crime in India?

Yes. Pretending to be someone else online and using that pretence to deceive others is a punishable offence. Section 66D of the Information Technology Act treats cheating by personation through a computer resource as an offence with imprisonment up to three years and fine up to one lakh rupees. Where the impostor misuses your photos, password or another unique identifier, Section 66C IT Act adds a further charge. The IPC offences of cheating by personation under Section 419 and cheating under Section 420 also commonly apply when the impostor extracts money from your friends.

What is the difference between Section 66C and Section 66D of the IT Act?

Section 66C punishes the dishonest or fraudulent misuse of someone's electronic signature, password or any other unique identification feature. Lifting your photo, OTP or login credentials falls here. Section 66D punishes cheating by personation that is carried out through any computer resource or communication device. Most fake-account-and-money-request cases trigger both: the impostor uses your photo and identifiers (66C) and uses that pretence to cheat your contacts (66D). The police often charge them together along with IPC 419 and 420.

Can I file an FIR or do I have to use the cybercrime portal?

You can do either, and ideally do both. Cybercrime is a cognizable offence in most fact patterns, so the police are duty-bound to register an FIR. The online portal cybercrime.gov.in and helpline 1930 give you a paper trail and a complaint number, especially useful when money has been transferred. The FIR is the document that formally sets the investigation in motion under Section 154 of the criminal procedure law. If a local police station refuses, a zero-FIR can be lodged at any police station and transferred.

Will the platform delete the fake account if I just report it?

Sometimes yes, often slowly. Major platforms have impersonation reporting flows and an India-based grievance officer under the IT Rules 2021. Submit the in-app report first, then write to the grievance officer with your ID proof, the offending profile URL and screenshots. Acknowledgement is generally within 24 hours and resolution within about 15 days under the Rules. If the platform delays, your FIR copy plus a follow-up notice usually accelerates removal because non-compliance has consequences for the intermediary.

My friend has already paid the impostor. What can be recovered?

Move fast. Report on 1930 within the golden hour so the destination bank account can be put on a temporary hold. The faster the report, the higher the chance of clawback. Your friend should also lodge a separate FIR as the actual victim of cheating. Recovery is not guaranteed because money may move through several mule accounts within minutes, but freezing the first beneficiary account is the only realistic legal route. Civil recovery against the impostor will only work once the police trace the real person behind the account.

Should I send a legal notice for defamation also?

It depends on the harm. If the fake account has only sent money requests, the criminal case usually does the job. If the impostor has posted abusive content, made false statements about you, or damaged your professional reputation, a civil defamation notice and suit for damages is a separate parallel route. The criminal complaint deals with the offence; the civil suit deals with compensation and a permanent injunction restraining the impostor and the platform from re-publishing the content.

How do I preserve evidence so it is accepted in court?

Take full-window screenshots showing the URL, profile name, date and time. Save the chat exports the impostor sent to your contacts, including any payment requests. Note the device you used to capture the data. The Indian Evidence Act treats such printouts and computer outputs as documents, but they must be accompanied by a Section 65B certificate naming the device, confirming it was working normally and that the output was produced in the regular course. Keep the originals untouched in a separate folder.

Will the police really catch the person behind a fake account?

Honestly, sometimes yes and sometimes no. If the impostor is in India and used a domestic SIM, an Indian email, or a domestic bank account, tracing is realistic within weeks. If the account is operated from abroad, behind a VPN, or uses crypto for payouts, identification is much harder and may stall. Your job is to give the police every digital crumb you have so they can issue notices to the platform and the bank. The investigation's success depends heavily on the speed of your report and the quality of evidence you preserve.

Is Section 66D bailable?

Yes. Section 66D of the IT Act is currently a bailable offence, which is one of the practical limitations victims face. Bailability means an arrested accused gets bail as a matter of right. This is precisely why most fake-account complaints are filed with both 66D and IPC sections like 419 and 420 added. IPC 420 cheating, where the impostor has actually obtained money or property, attracts a higher sentence and is non-bailable, giving the investigation real bite.

How long does the takedown process usually take?

Realistically, a clear impersonation report on a major Indian-compliant platform is acted on within 7 to 15 days. If you also send the platform's grievance officer your FIR copy and your ID proof on day one, removal can happen in 48 to 72 hours. If the platform asks for additional verification, respond fast. Save the platform's acknowledgement email; it becomes useful evidence both in the criminal case and any future civil suit for damages.

Can the impostor turn around and accuse me of misuse?

It is rare but possible. To pre-empt this, lodge your complaint and notify your contacts in writing very early. Keep dated copies of your ID, your real social media profile screenshots, and the messages your contacts received from the fake handle. The early paper trail clearly shows you were the victim, not a participant. If you receive any counter-notice from the platform alleging misuse, do not respond informally; let your lawyer answer.

Do I need a lawyer or can I handle this myself?

You can absolutely file the FIR and the cybercrime portal complaint yourself; nothing in law requires a lawyer at that stage. A lawyer becomes important when the investigation stalls, when the impostor is identified and you want to push for chargesheet and trial, when you need to send a civil legal notice for defamation, or when a parallel suit for damages is on the cards. For ordinary takedown and FIR registration, going it alone is fine; for everything that comes after, an experienced cyber-crime advocate saves time and avoidable mistakes.

For more articles on Indian law, visit the Pinaka Legal Blog. For queries, call +91 8595704798 or email info@pinakalegal.com.