It is past midnight. A message comes from a stranger. Pay this much by morning, or your private photos will be sent to your family, your office, your contact list. Your hands shake. You read the message again. You are sure no one was supposed to see those photos. The phone feels heavy. You don't know whether to reply, to delete, to call someone, to pay.
If you are reading this in that state, please pause for a minute. Read this paragraph and the next one slowly. The fear is real. The threat is meant to make you act in panic. That panic is the blackmailer's weapon. The moment you stop responding to it, the weapon loses most of its edge. Indian law treats what is being done to you as a crime — extortion, criminal intimidation, and obscene-content offences — punishable by imprisonment. There is a clear, well-trodden process, and people in your situation walk out of it every week. You are not alone.
This guide is written for the first hour and the first few days. It is not a textbook. It tells you what to do, what to avoid, which sections of law apply, and where to ask for help. Our intention is to make you feel less alone, and to put a plan in your hands.
First, Take One Breath
Before any practical step, give yourself one minute. Sit down. Drink a glass of water. The threat will still be there a minute from now, and you will be in a better state to act. Cyber-crime officers who handle these cases every day will tell you that the worst decisions are made in the first ten minutes — paying, deleting, replying angrily, deleting the offender's number. None of those help. The slow, calm steps below help.
If you have one trusted person — a sibling, a close friend, a parent, an older colleague — please consider bringing them in. The shame and isolation that the blackmailer is counting on dissolve quickly when one other human being is in the loop. There is no judgement here, and there should be no judgement at home either. The crime is not what is in your photos. The crime is the threat.
What Not to Do in the First Hour
This list is short, and breaking any of these rules can quietly hurt your case. Please read it carefully.
Do not pay. Indian cyber-crime cells say this consistently — the first payment is almost never the last. The blackmailer learns that pressure works on you and comes back for more. Some victims have ended up paying eight, ten, fifteen times before realising it never ends. Your money will not buy peace. Your evidence and your complaint will.
Do not delete the chats. The messages, the screenshots, the threats — they are your strongest evidence. The IT Act read with Section 65B of the Indian Evidence Act treats electronic records as admissible in court. Without them, your complaint is your word against theirs.
Do not delete the offender's number or block them yet. Blocking is fine after you have preserved the evidence and reported. But premature blocking can sometimes make it harder for police to track the offender. Ask the cyber officer when you call.
Do not factory-reset your phone. Investigators may need to extract data later. A reset can wipe out important traces.
Do not engage in long arguments with the offender. The more you reply, the more material they have. One short, neutral message — or no reply at all — is fine.
Do not try to fix it through "agents" or random websites that promise to remove content for a fee. Many of these are themselves frauds. The official channels — cybercrime.gov.in, helpline 1930, your local police — are free and effective.
Preserve the Evidence Before You Touch Anything Else
Before you do anything else — even before reporting — preserve the evidence. This takes 15 minutes and changes the strength of your case.
Take screenshots of every threatening message. Make sure each screenshot shows the date, time, sender's display name, and any phone number, email or username. Capture profile pages of the offender's account. If they have called you, screenshot the call log. If money has already moved through UPI or a card, screenshot the transaction reference.
Save these screenshots into a separate folder named with the date. Email the folder to yourself, or upload it to your own Google Drive or iCloud. This creates a date-stamped backup outside your phone. Note the URL of any account or post (Instagram link, Telegram channel, etc.).
Write a short, factual note for yourself: when did the threat first come, on which platform, what was demanded, what have you replied. This will become your written statement when you file the FIR. The faster you write it while memory is fresh, the stronger your case.
Section 65B of the Indian Evidence Act lays down how electronic records are admitted in court — usually with a certificate from the person in charge of the device or system. Your job at the start is just to preserve the data; the formal certificate can be drawn up later with your lawyer.
Which Laws Are on Your Side
It helps to know what you are accusing the offender of. The criminal law in India treats online blackmail with photos as a stack of offences, not just one. The police usually invoke several together.
Section 503, IPC — Criminal intimidation. Whoever threatens another with any injury to his person, reputation or property, or to the person or reputation of someone he is interested in, with intent to cause alarm or to compel that person to do something or to refrain from doing something he is legally entitled to, commits criminal intimidation. The Supreme Court has held that threatening to publish indecent photographs of a girl unless "hush money" is paid is criminal intimidation. Romesh Chandra Arora v State (1960) said exactly this.
Section 506, IPC — Punishment for criminal intimidation. Two years' imprisonment, or fine, or both. If the threat is to cause death, grievous hurt, destruction of property, or to "impute unchastity to a woman", it goes up to seven years.
Section 384, IPC — Punishment for extortion. Whoever intentionally puts a person in fear of injury and dishonestly induces him to part with property or valuable security commits extortion. Up to three years' imprisonment, fine, or both. This is the section that fits when money has been demanded against the threat.
Section 67, IT Act — Publishing or transmitting obscene material in electronic form. Up to three years and Rs 5 lakh fine on first conviction; up to five years and Rs 10 lakh fine on subsequent conviction. The act of publishing or transmitting — or even causing to be published or transmitted — obscene material in electronic form is the offence.
Section 67A, IT Act — Sexually explicit material in electronic form. Higher punishment — up to five years on first conviction.
Section 66E, IT Act — Violation of privacy. Capturing, publishing or transmitting the image of a private area of any person without consent, under circumstances violating that person's privacy, is punishable with up to three years and Rs 2 lakh fine. The Explanation makes clear that "circumstances violating privacy" include where a person could reasonably expect to be private — bedroom, bathroom, changing area — or where they could expect the image not to be visible to the public. This section was introduced precisely to deal with the kind of MMS and spy-camera situations the law saw growing in the 2000s.
Section 507, IPC — Anonymous criminal intimidation. Where the intimidation comes through an anonymous communication or with concealed identity, this section adds to the punishment under Section 506.
Section 67 was originally based on Section 292 IPC and the definition of "obscene" in case law. Indian courts have adapted the test for the electronic medium. The point for you is simpler: if someone is threatening to publish your private images online, several criminal sections fit, and the police can build the FIR around them.
How and Where to Report
You have three lines of action and you can use all of them in parallel. None of them costs money.
1. National Cyber Crime Reporting Portal — cybercrime.gov.in. Open the portal on a phone or computer. Pick "Report Other Cybercrimes" — there is a separate flow for "Women / Child Related Crime" if that fits. Fill in the details. Upload the screenshots. The complaint is forwarded to the cyber-crime cell of your state. You receive a complaint number to track the case.
2. Helpline 1930. The national cyber-crime helpline number is 1930. Call from any phone in India. Officers can guide you in real time, especially if money has just been transferred. They can sometimes freeze suspect accounts within hours of a financial transaction.
3. Walk into the police station and file an FIR. Section 154 of the Code of Criminal Procedure (now mirrored in BNSS) requires every police officer to record information of a cognizable offence. Section 67 IT Act, Section 384 IPC and Section 506 IPC are all cognizable in their relevant form. The police cannot tell you, "Sir, this is not our area." More on this in the next section.
You can do all three. The cybercrime.gov.in portal is fastest for documentation. The FIR is the strongest legally. The helpline is best for live emergencies.
Zero FIR — Police Cannot Refuse
One question stops many people from going to the police: "What if the offender is in another state? My local police will say it is not their jurisdiction."
The law has an answer. The police cannot refuse to record an FIR on the ground of territorial jurisdiction. The proper course, when the place of crime falls outside their station, is to record the information and forward the same to the police station having jurisdiction. The standard authoritative texts on the Criminal Procedure Code and the BNSS framework state this clearly. This is what is popularly called a Zero FIR — an FIR with serial number "zero" until it reaches the proper police station.
So if the threats are coming from a number in another state, walk into your nearest police station. If the duty officer hesitates, politely point out that the law requires them to register the information of a cognizable offence even if the crime happened elsewhere. If they still refuse, the next step is provided in Section 154(3) CrPC / BNSS — send the substance of the information in writing and by post to the Superintendent of Police. The SP, if satisfied that a cognizable offence is disclosed, must investigate or order an investigation. Beyond that, an application under Section 156(3) CrPC / BNSS can be made to the magistrate.
You will rarely need these later steps. Police stations across India now have cybercrime SOPs, and online blackmail cases are taken seriously. But it helps to know your rights walking in.
Tell the Platform Too
Police action runs on its own clock. A parallel and faster track is to report to the platform itself. Every major platform has a non-consensual intimate imagery and harassment reporting flow.
Instagram, Facebook, X (Twitter), YouTube, Snapchat, Telegram, WhatsApp, Reddit — each has a dedicated form for "report content" or "report account". For sensitive imagery, look for "non-consensual intimate imagery" or "intimate image abuse" categories. Many platforms now use hashing technology like StopNCII to prevent re-uploads of the same image even if you cannot find every copy.
Under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021, intermediaries are required to act within strict timelines on take-down of objectionable content, particularly involving private images. They risk losing safe-harbour protection if they don't. A formal letter from your lawyer, citing the IT Rules and your FIR, often speeds up action.
The law in this area continues to develop, and our cluster page on online harm tracks these developments — fake profiles, doxxing, deepfakes, and related issues.
Protect Your Accounts and Yourself
While the case is on, treat your digital life as a building under repair. Small steps add up.
Change passwords for every account that touches the offender — email, Instagram, Facebook, Snapchat, the dating app, WhatsApp Web, anywhere. Pick long, unique passwords. Turn on two-factor authentication. Sign out of all sessions on every device.
Lock down privacy settings. Set Instagram and Facebook profiles to private. Restrict who can see your friends list. Remove any cloud-sync that you don't fully control.
Tell the people who matter. If the blackmailer is threatening to message your family or office, consider beating them to it. A short, calm note to your closest people — "I am being targeted by an online blackmailer. The police are involved. Please ignore any messages claiming to be about me." — collapses the leverage. Many victims who pre-empted the leak found that family and employers were entirely supportive.
Take care of yourself. The first 48 hours of one of these cases is exhausting. Eat. Sleep. Stay off the threatening messages once they are preserved. If you are struggling emotionally, helplines like iCall (9152987821) and Vandrevala Foundation (1860-2662-345) are free, confidential and trained.
Court Orders to Stop the Spread
Where police action is slow or where the offender is identified, a civil court can grant an injunction — an order forbidding the offender from publishing, transmitting or sharing the images. Indian High Courts have, in several cases, also directed search engines, social media platforms and ISPs to remove specific content and prevent re-uploads, sometimes globally.
The relief is granted under the Specific Relief Act 1963 and the Code of Civil Procedure. An interim injunction can be obtained quickly if the case is urgent. A writ petition in the High Court can also be considered, especially when intermediaries are involved or constitutional rights of privacy and dignity are engaged.
This is where having a lawyer beside you matters. The drafting of the application, the choice of forum, and the speed of service can change outcomes. Pinaka Legal in Delhi handles these matters with the discretion they deserve. A short consultation can map out whether an injunction or a writ is the right next step in your situation, and whether the FIR and the civil action should run together.
What Should I Actually Do Now?
- Stop replying. A neutral non-reply is fine. Do not pay. Do not delete. Do not factory-reset.
- Preserve evidence. Screenshots of every message, profile, transaction. Save in a date-stamped folder and email a copy to yourself.
- Tell one trusted person. A family member, friend, or older colleague who will sit with you for the next two hours.
- File at cybercrime.gov.in. Use the right category. Upload screenshots. Note the complaint number.
- Call 1930. Especially if money has just been demanded or transferred. Officers can guide live and freeze accounts.
- Walk into the nearest police station for an FIR. If the duty officer hesitates on jurisdiction, politely insist on a Zero FIR. Carry one printed copy of the screenshots.
- Report on the platform. Use the "non-consensual intimate imagery" or "harassment" category on Instagram, Facebook, Telegram, etc.
- Change passwords and enable 2FA. On every account that touches the offender. Sign out of all sessions.
- Pre-empt if needed. A short, calm message to your closest family members removes the blackmailer's leverage in minutes.
- Talk to a lawyer about an injunction. If the offender is identified or the content has started to spread, a civil injunction or a writ petition can stop the harm. Read more on cheating and online fraud cases for related criminal-side remedies.
Frequently Asked Questions
Should I pay the blackmailer just to make this go away?
Please don't. Paying once almost always invites a second demand and a third. The blackmailer learns that pressure works on you and comes back. Indian cyber-crime cells deal with these cases every day, and the consistent advice is the same: do not pay, do not negotiate, and do not delete the messages. The law is on your side. Online blackmail and threats to leak private photos are punishable offences under Section 384 IPC (extortion), Section 506 IPC (criminal intimidation) and Section 67 of the IT Act. The faster you preserve evidence and report, the faster the threat loses power.
Which sections of law cover online blackmail with photos?
Several at once. Section 384 of the Indian Penal Code punishes extortion — putting a person in fear of injury and dishonestly inducing them to part with property or money. Section 506 IPC punishes criminal intimidation — threats to harm reputation or person. Section 67 of the IT Act punishes publishing or transmitting obscene material in electronic form, and Section 67A covers sexually explicit material. Section 66E of the IT Act covers capturing or transmitting an image of a private area without consent. Most blackmail cases attract more than one section, which is why the FIR usually lists several together.
Where do I file the complaint?
You have three lines of action and you can use all of them in parallel. First, the National Cyber Crime Reporting Portal at cybercrime.gov.in lets you file a complaint online from any phone or computer. Second, dial 1930 — the national cyber-crime helpline — to speak to a trained officer, especially in active or financial-fraud situations. Third, walk into any police station in India and ask to file an FIR. Police cannot refuse on the ground of territorial jurisdiction; they must record the FIR and forward it to the police station having jurisdiction. This is what people commonly call a Zero FIR.
What is a Zero FIR and why does it matter here?
A Zero FIR is an FIR registered at any police station, not necessarily the one with territorial jurisdiction. The Supreme Court and the BNSS framework make clear that police cannot refuse to record information of a cognizable offence on the ground of jurisdiction. They must record it, forward it to the appropriate police station, and the investigation begins. In online blackmail cases, the offender, the victim and the server may all be in different states or countries, so jurisdiction can be murky. Zero FIR makes sure the clock starts ticking immediately, no matter where you are. For deeper reading, see our explainer on FIR problems and your rights.
Should I delete the WhatsApp chats and messages?
Please don't, even though the urge is strong. The chats are your evidence. Take screenshots first, save them in a separate folder with date and time visible, back them up to email or a secure cloud, and only then think about your phone hygiene. Do not delete the offender's number from your phone — it preserves the metadata. Do not factory-reset the phone. Investigators may need to extract data later, and once it is gone it is hard to get back. Section 65B of the Indian Evidence Act treats electronic records as admissible in court, but proper preservation makes the case stronger.
What if the photos in question are real and personal?
This is the part that makes people freeze. Please remember: it does not change the law's response. Section 67 and 67A of the IT Act punish the person who publishes or transmits obscene or sexually explicit material in electronic form. Section 66E punishes the violation of privacy where someone captures, publishes or transmits images of a private area without consent. The fact that you are the subject does not make you the offender. The offender is the person threatening to publish. Indian courts and police have handled these cases for years and the focus is on the blackmailer, not on the victim's personal choices.
How long will the case take?
The immediate steps — complaint at cybercrime.gov.in, helpline 1930, FIR — can happen in 24 to 72 hours. Account take-down requests by police to platforms (Instagram, Facebook, Telegram, WhatsApp) often resolve within days. Investigation, arrest and trial take much longer — months to a couple of years. But the practical relief you usually need first — the threats stopping, the content being taken down, the offender being identified and warned — often happens fast once the police get involved. Don't measure success by trial timelines; measure it by how soon the immediate threat is contained.
Can I get a court order to stop the offender from posting the photos?
Yes. A civil court can grant a restraining injunction against an identified offender, ordering them not to publish, transmit, or share the images. High Courts have, in several cases, also directed intermediaries (platforms) to remove the content and prevent re-uploads. Talk to a lawyer about a writ petition or a civil suit with an interim application, especially if the police are slow or if the content has already started to spread. An order in your hand is a strong tool to take to platforms and ISPs.
What is the role of the platform — Instagram, WhatsApp, Telegram?
Every major platform has a reporting mechanism for non-consensual intimate imagery, harassment, and impersonation. File a report there as well as with the police. Under the Information Technology (Intermediary Guidelines) Rules 2021, intermediaries are required to act within strict timelines on take-down notices for objectionable content, especially involving private images. If they don't, they risk losing safe-harbour protection. The FIR or police notice carries weight with these platforms; do not skip it.
Should I tell my family?
This is a personal call. There is no legal answer. But many victims who handled it alone said later they wished they had had support. If you have one trusted person — a parent, a sibling, a friend, an older colleague — bring them in. Cyber-crime officers who handle these cases say the first 48 hours are easier when the victim is not alone with their phone. There is also no shame in calling a helpline like iCall or Vandrevala Foundation for emotional support while the legal process runs.
What about the threat to send the photos to my family?
This is the standard sextortion script and it almost always works on people who are isolated and silent. The blackmailer is betting on your fear. The moment you bring family or police into the loop, the threat collapses because the leverage disappears. Section 503 IPC covers exactly this — threatening another with injury to reputation or to a person they care about. The moment such a threat is made, the offence is complete, even if the photos are never actually sent. Document the threat, report it, and trust the process.
What if the offender is anonymous or in another country?
That makes the case slower, not impossible. Section 507 IPC specifically covers anonymous criminal intimidation. Cyber-crime cells regularly track Indian-rupee transactions, UPI handles, mobile numbers, IP logs and account details to identify offenders, even when they hide behind fake names. Cross-border cases involve mutual legal assistance and can take longer, but platforms and payment processors often cooperate with valid Indian police requests. The process is slower, the principle is the same: report, preserve, do not pay.
For more on Indian cyber law in plain English, browse the Pinaka Legal blog. For confidential legal help in an active blackmail or sextortion situation, our team handles these matters with the discretion they deserve. Call +91 8595704798 or email info@pinakalegal.com.
For more articles on Indian law, visit the Pinaka Legal Blog.