Someone Made a Fake Profile of Me: What Can I Do?

You opened Instagram on a quiet Sunday evening and a friend's WhatsApp message stopped your heart: "Bro, why are you asking me for money on this new account?" You clicked the link. There it was — your photograph, a similar bio, slightly different spelling of your name, and a fresh account that had already started DMing your contacts. Maybe it began as a single screenshot from your wedding gallery. Maybe somebody lifted your LinkedIn picture. Right now, your face is being used to build a lie, and every minute you wait is another minute that lie travels.

This is not just an embarrassment. Indian law treats it as a serious offence with multiple parallel remedies. The point of this article is to tell you exactly what those remedies are, in the order you should use them, so that by tomorrow morning the fake account is on its way out and a paper trail exists in your name.

What Is Actually Happening to You

From a legal angle, the fake profile is doing three things at once. First, it is stealing a "unique identification feature" of yours — your name, photograph, voice clip, sometimes even your date of birth. Second, it is pretending to be you in front of strangers, friends, employers or matrimonial prospects. Third, in many cases it is also using that pretence to cheat someone — to get money, intimate photos, OTPs, or to harass another person under your name.

Each of those three things is a separate offence under Indian law. You do not have to choose between them. They can all be cited in the same FIR. The reader who only knows the words "I have been impersonated" needs to understand this layered structure, because it is what gives a cyber lawyer the leverage to push the police, the platform and the court to act.

Which Laws In India Protect You

Section 66C of the IT Act — the law against identity theft. This section punishes anyone who "fraudulently or dishonestly" makes use of the electronic signature, password or any other unique identification feature of any other person. The punishment is imprisonment up to three years plus a fine up to one lakh rupees. The commentary on Section 66C makes clear that the words "any other unique identification feature" are deliberately wide and futuristic — your photograph, your handle, even your voice cloning sample, all qualify. The catch, candidly, is that the offence is bailable, so the impersonator usually walks out within hours of arrest. The strength of Section 66C lies in registration of the FIR and identification of the accused — not in immediate jail time.

66C. Whoever, fraudulently or dishonestly make use of the electronic signature, password or any other unique identification feature of any other person, shall be punished with imprisonment of either description for a term which may extend to three years and shall also be liable to fine which may extend to rupees one lakh.

Section 66D of the IT Act — cheating by personation using a computer. If the fake profile is used to fool a real human being — your aunt sends Rs 25,000 to a UPI ID thinking it is you — Section 66D kicks in. It punishes whoever, by means of any communication device or computer resource, "cheats by personating" with imprisonment up to three years and fine up to one lakh rupees. The expression "cheating by personation" is borrowed from Section 416 of the IPC, which says a person cheats by personation when he pretends to be some other person, real or imaginary. Where Section 66C deals with the theft of your identity, Section 66D deals with what was done with that stolen identity.

Section 66E of the IT Act — privacy violation. If the fake profile contains your nude or intimate image — captured, published or transmitted without your consent — Section 66E is attracted, with a separate punishment of up to three years' imprisonment or fine up to two lakh rupees. The "private area" is statutorily defined as naked or undergarment-clad genitals, pubic area, buttocks or female breast.

IPC Sections 415, 416 and 419 — the offline anchor. Section 415 of the IPC defines cheating; Section 416 defines cheating by personation; Section 419 makes that cheating punishable with up to three years and fine. Adding the IPC to the FIR strengthens the case because IPC offences are non-time-bound under the IT Act and let the Magistrate take cognizance even where the IT Act offence is bailable.

Is The Fake Profile Cheating Someone Too?

Most fake profiles are not made to merely embarrass you. They are made to cheat someone — your friend, your client, an unsuspecting stranger on a matrimonial site. The moment that happens, two more legal angles open up.

The first is criminal intimidation under Section 503 of the IPC, which kicks in whenever the impersonator threatens any person with injury to their person, reputation or property. Romesh Chandra Arora (1960) 1 SCR 924 and Chander Kala v Ram Kishan AIR 1985 SC 1268 both involved use of indecent photographs as a tool of threat — exactly the modern fake-profile scenario — and the Supreme Court held it amounted to criminal intimidation. The punishment under Section 506 of the IPC goes up to two years, and where the threat is of death or grievous hurt, up to seven years.

The second is Section 507 of the IPC — criminal intimidation by anonymous communication. Read this once: it adds up to two years on top of Section 506, specifically when the threat comes from an anonymous source or one whose identity is concealed. In practice, every fake profile is by design an anonymous communication. The maker has "taken precaution to conceal the name or abode of the person from whom the threat comes". Section 507 is therefore tailor-made for online impersonation cases that turn nasty. The 1924 Madras decision in Doraiswamy Ayyar (1924) 48 Mad 774 made clear, even in the postal era, that the offence is complete the moment the anonymous communication conveying the threat is made.

If your impersonator is also draining money from your contacts, an additional criminal angle on cheating and fraud can be invoked — cyber-crime registration of theft and fraud cases follows the same FIR procedure as ordinary cheating.

What Evidence Should I Collect First?

Indian courts admit screenshots and chat logs as electronic records, but they have to be properly preserved. The minute you discover the fake account, do four things in this order. One, screenshot the entire profile — bio, profile picture, follower list, any posts, the URL or username — with date and time visible in the system clock of your phone. Two, share the screenshots with yourself by email, so a server-stamped copy exists outside your phone. Three, ask any friend who received a suspicious DM from the fake account to forward it to you with the original timestamps intact. Four, write down a contemporaneous note of who saw the profile, when, and what it said — this is your "first information" diary entry, valuable when filing the FIR.

Do not — repeat, do not — engage with the impersonator. Do not message them, do not "warn" them. Anything you say feeds the record they are building, and a smart impersonator will weaponise your reply. Save, don't speak.

Getting The Profile Taken Down

The Information Technology (Intermediary Guidelines) Rules require every social media platform — Facebook, Instagram, X, LinkedIn, YouTube — to remove or disable access to impersonating content within thirty-six hours of receiving actual knowledge from the aggrieved person. Each platform has a dedicated impersonation report form. You will need to attach a clear photograph of your government-issued photo ID and a selfie. The takedown is usually quicker than the FIR.

If the platform does not respond, escalate to the Resident Grievance Officer for India whose contact details every social-media intermediary is required to publish on its website. Beyond that, the Grievance Appellate Committee notified by the Ministry of Electronics and IT can be approached for review of the platform's decision.

Filing An FIR Or A Cyber Complaint

For cyber-impersonation, you have two parallel options and you can use both.

Option 1 — file at cybercrime.gov.in. The National Cyber Crime Reporting Portal accepts complaints twenty-four hours a day. Upload your screenshots, the URL of the fake account, and a written complaint narrating the events. The portal forwards the complaint to the relevant cyber cell.

Option 2 — file an FIR at any police station. Under BNSS Section 173 — the new procedural law that replaced CrPC Section 154 from 1 July 2024 — every information relating to the commission of a cognizable offence shall be reduced to writing by the SHO. The BNSS specifically expanded the scope to allow registration "irrespective of the area where the offence is committed", that is, the so-called zero-FIR concept. The Act also recognises FIR by electronic communication. The classical authority on what constitutes an FIR — Soma v State of Gujarat AIR 1975 SC 1453 — held that the earliest information given to the police, which sets the investigation in motion, is the FIR. A cryptic anonymous message is not enough; your written complaint with screenshots is.

Do not let the SHO turn you away with the line "the IP address is in another state". Section 173 of the BNSS settles that argument. Insist on a copy of the FIR with the FIR number, date and time. If the SHO refuses, ask politely for the refusal in writing — they rarely give it, which itself becomes useful evidence later.

If The Police Refuse To Register The FIR

You are not stuck. BNSS Section 173(4) — corresponding to old CrPC Section 154(3) — entitles you to send the substance of the information by post to the Superintendent of Police. The SP is bound to satisfy himself, and if a cognizable offence is disclosed, either investigate the case himself or direct an investigation. If even the SP route fails, you can file a private complaint before the jurisdictional Judicial Magistrate under BNSS Section 223 (old CrPC Section 200). The Magistrate has two powers — to take cognizance directly and proceed under Section 200, or to order a police investigation under BNSS Section 175(3) (old CrPC Section 156(3)). The Supreme Court in All India Institute of Medical Sciences Employees Union v Union of India (1996) 11 SCC 582 upheld that this Magistrate route is the correct legal answer when the police "does not register the case".

If you reach this stage, getting the right advice on FIR refusal and the Magistrate route is essential — small drafting choices in the private complaint affect whether the Magistrate orders investigation or starts trying the case himself.

Money Damages And Civil Remedies

Criminal complaint is one track. The civil track for compensation is separate. Under Chapter IX of the IT Act, the Adjudicating Officer can award compensation for damage caused by an offence under the Act. A separate civil suit can also be filed for damages under tort principles for defamation, mental harassment and loss of reputation.

Beyond that, the Supreme Court's nine-judge bench in KS Puttaswamy (Retd) v Union of India held in 2017 that the right to privacy is part of the fundamental right to life under Article 21 of the Constitution. Where the fake profile has caused a serious privacy violation — leaked photographs, morphed intimate imagery, harassment causing demonstrable mental injury — a constitutional remedy under Article 226 before the High Court is also available, especially against the State or against an intermediary refusing to act.

If you are unsure which route fits the harm caused to you, an early consultation with a cyber-law specialist saves months. The team at Pinaka Legal handles online impersonation, takedowns, FIR registration and Adjudicating Officer compensation claims as a single workflow — useful when the same fake profile is doing all three at once.

What Should I Actually Do Now?

1. Screenshot the fake profile in full — bio, picture, posts, URL, follower list — with the system clock visible.
2. Email the screenshots to yourself; this creates a server-side time-stamped copy.
3. Ask any friend who received messages from the fake account to forward those chats with timestamps to you.
4. Report the profile through the platform's official impersonation form, attaching a copy of your photo ID.
5. File a written complaint at cybercrime.gov.in and read the related cyber scam guidance for the exact upload format the portal expects.
6. Walk into the nearest police station with a printed complaint, your photo ID, and the screenshots, and insist on FIR registration under Sections 66C and 66D of the IT Act and Sections 419, 503, 506 and 507 of the IPC.
7. Get a copy of the FIR with the FIR number, station, and date — never leave without it.
8. If the SHO refuses, send your complaint by registered post to the Superintendent of Police on the same day.
9. If the SP also fails, file a private complaint before the Judicial Magistrate under BNSS Section 223 within thirty days.
10. Keep a single folder — physical and digital — with all screenshots, FIR copy, postal receipts and your contemporaneous diary entry.

The One Mistake You Must Not Make

Do not delete anything. Not the fake account from your block list, not your own posts that the impersonator copied, not your old WhatsApp chats. Indian courts treat electronic records as a structured class of evidence, and once a record is gone, no certificate or affidavit can resurrect it. The same screenshot you think is "useless" may be what proves the timeline of harassment to a Magistrate six months from now. Keep everything. The fake profile may go dark in seventy-two hours; your case file should not.

An impersonation case in 2026 is not a he-said-she-said matter. It is a digital trail with platform logs, screenshots, FIR numbers and intermediary takedown records. The reader who keeps that trail intact and walks the four-step path — screenshot, takedown, FIR, follow-up — is the reader who watches the fake profile vanish and the impersonator either apologise or face prosecution. The law is squarely on your side. What it asks of you is calm documentation, not panic.

Frequently Asked Questions

Is making a fake profile of someone a crime in India?

Yes. If the impersonator dishonestly uses your photo, name or other unique identifying feature, the act squarely falls under Section 66C of the IT Act, which punishes identity theft with up to three years' imprisonment and a fine up to one lakh rupees. If the fake account is used to cheat someone — say to ask money from your friends in your name — Section 66D of the IT Act (cheating by personation using a computer resource) is also attracted, with the same punishment. Sections 416 and 419 of the IPC dealing with cheating by personation continue to apply for the offline elements of the fraud.

Which is the right police station for filing a complaint about a fake online profile?

You can file at any police station — even your nearest one. Under BNSS Section 173 (which replaced CrPC Section 154 from 1 July 2024) FIR can be registered irrespective of where the offence was actually committed. This is the so-called "zero FIR". You can also file online at cybercrime.gov.in. In larger cities, dedicated cyber police stations exist. The local SHO cannot refuse the FIR on the ground that the impersonator's IP address is in another state.

Will Instagram or Facebook take down a fake profile of me?

Usually, yes — if you use the platform's official impersonation reporting form and attach a government photo ID. Under the Information Technology (Intermediary Guidelines) Rules, on receiving actual knowledge from an aggrieved person, the intermediary is mandated to act within thirty-six hours and remove or disable access to such information. If the platform ignores you, you can file a grievance with its Resident Grievance Officer for India, and ultimately with the Grievance Appellate Committee notified by MeitY.

What should I save from the fake account before reporting it?

Take screenshots of the entire profile — bio, profile picture, posts, follower count, the URL or username, and any messages the impersonator has sent to others. Save the date and time on each screenshot. If anyone has been duped, ask them to forward the chats to you. These are your electronic records. They will need to be produced before a court along with a certificate identifying the device on which they were captured, so do not delete the originals from your phone.

Can I claim money for the harassment a fake profile caused me?

Yes, but the route is civil, not criminal. The Adjudicating Officer under Chapter IX of the IT Act has power to award compensation for damages caused by violation of the Act. Where the cheating done through the fake profile has caused you financial loss, defamation, or mental harassment, you can also file a civil suit for damages. In the Puttaswamy judgment, the Supreme Court of India held that the right to privacy is part of the fundamental right to life under Article 21, opening the door to constitutional remedies in extreme cases. More on privacy-based constitutional remedies here.

Someone made a fake profile of me using my morphed photo. Is it different?

It is more serious. If the morphed image shows the private area of your body — naked or undergarment-clad genitals, pubic area, buttocks or female breast — the offence shifts into Section 66E of the IT Act, which punishes the capture, publication or transmission of such an image without consent with up to three years' imprisonment or fine up to two lakh rupees. If the morphed image is sexually explicit, Section 67A of the IT Act is attracted. The cumulative effect is a much harsher cyber complaint and a non-bailable colour to the FIR.

The fake profile is sending threats to people in my name. What law applies?

In addition to the impersonation offences, Section 503 of the IPC (criminal intimidation) is attracted whenever someone threatens another with injury to person, reputation or property to cause alarm. Section 506 prescribes the punishment — up to two years, or up to seven years if the threat is of death or grievous hurt. Importantly, where the threat comes from an anonymous or concealed source — exactly the case with most fake profiles — Section 507 adds an extra punishment of up to two years over and above Section 506.

How long does a cyber complaint of impersonation take?

It depends. Takedown of the fake profile can happen within seventy-two hours if the platform cooperates and your evidence is in order. Identification of the accused — recovering IP logs from the platform via legal request — usually takes weeks. Filing of the police chargesheet under BNSS Section 193 (old Section 173 CrPC) is required within sixty or ninety days from arrest, but where no arrest happens the timeline is fluid. A simple, well-documented case can see the chargesheet filed in three to six months.

Can I directly approach a Magistrate if the police refuse to register my FIR?

Yes. Two routes are open. First, you may write to the Superintendent of Police under BNSS Section 173(4) (old CrPC Section 154(3)) and ask the senior officer to direct the registration of the FIR. Second, you may file a private complaint before the jurisdictional Magistrate under BNSS Section 223 (old CrPC Section 200), and request that the Magistrate either take cognizance directly or order an investigation under BNSS Section 175(3) (old CrPC Section 156(3)) by the police.

Is a fake profile case bailable or non-bailable?

Section 66C and 66D of the IT Act, with three-year maximum sentences, are bailable offences — the accused, even if arrested, is entitled to bail as a matter of right. Section 66E (privacy violation) and Section 67 (obscene material in electronic form) are also bailable in the present statutory scheme. However, where Section 67A or 67B of the IT Act, or Section 354A or 354D of the IPC come in (because of sexual content or stalking), the case becomes more serious. The cyber-only fake-profile case stays bailable.

Will I have to appear in court for a fake profile case?

As the complainant, yes — at the stage when the Magistrate takes cognizance and at the trial. You will be expected to identify your screenshots, your photographs that were misused, and to depose about the harassment caused. Most cyber-impersonation matters are tried in summary trial under BNSS Chapter 21 (old CrPC Chapter XXI), where evidence recording is brief. Many cases also end in compounding or quashing once the fake account is shut down and the accused tenders an unconditional apology.

What if the fake profile is created from another country?

Your right to file the complaint in India is not lost. Sections 1(2) and 75 of the IT Act extend the Act to any offence committed by any person of any nationality outside India, provided the act involves a computer or communication device located in India. The cyber cell will route the request through CERT-In or MLAT (Mutual Legal Assistance Treaty) channels to the foreign platform or country. The investigation will be slower, but takedown via the platform's India grievance officer is usually quick because intermediaries follow the IT Rules irrespective of where the user is.

For more articles on Indian law, visit the Pinaka Legal Blog. For queries, call +91 8595704798 or email info@pinakalegal.com.