A Practical Legal Guide for Victims of Online Impersonation in India 🇮🇳
Imagine receiving a message from a friend:
“Why are you asking me for money on WhatsApp?”
You are confused. You check your phone—and discover that someone has created a WhatsApp account using your name and photograph.
Or perhaps you find an Instagram profile using your name, profile picture, photographs and personal information, making other people believe that the account actually belongs to you.
You did not create it.
You did not authorize anyone to use your identity.
Yet someone is pretending to be you online. 😟
This situation is commonly described as online impersonation, fake-profile creation or identity misuse. Depending on what the person does through the fake account, the conduct may attract provisions relating to identity theft, cheating by personation, privacy violations, defamation, publication of obscene material, threats, harassment or other offences.
The good news is that a victim is not completely helpless.
India has mechanisms through which a person can:
🚨 report the cybercrime;
📱 report the fake Instagram/WhatsApp account;
👮 approach the police/cyber police;
💻 file a complaint through the National Cyber Crime Reporting Portal;
🧾 preserve digital evidence;
⚖️ seek investigation and appropriate criminal action;
🛑 request removal/blocking of the fake account or unlawful content; and
💰 pursue appropriate civil remedies where legally available.
The exact legal provisions depend heavily on what the fake-account creator actually did.
🔎 1. What Does “Fake Account in My Name” Legally Mean?
A fake account does not automatically mean that one particular offence has been committed in every case.
The legal consequences depend on the conduct behind the account.
For example:
Situation 1️⃣ — Someone simply creates a fake Instagram profile
Suppose someone creates:
“Rahul Sharma Official”
and uses Rahul's photograph without permission.
If the account merely exists but does not involve further harmful conduct, the appropriate response may initially be:
report the account to Instagram;
preserve screenshots and URL;
submit a cybercrime complaint if identity misuse or other unlawful conduct is involved.
Situation 2️⃣ — The person starts messaging Rahul's friends
Suppose the fake account starts telling Rahul's friends:
“I need ₹20,000 urgently. Please transfer it to this UPI.”
Now the situation becomes much more serious.
The fake identity is being used to deceive people and potentially obtain money.
This can bring cheating/personation provisions into consideration.
Situation 3️⃣ — Someone uses your identity to obtain information or deceive people
For example, the person pretends to be you while contacting:
your employer;
relatives;
customers;
business contacts;
friends;
educational institutions.
The legal implications depend on the exact conduct and resulting harm.
Situation 4️⃣ — Fake account posts obscene or private material
If someone creates a fake account and uploads:
private photographs;
morphed photographs;
sexually explicit material;
obscene content;
manipulated videos;
additional legal provisions may become relevant.
Situation 5️⃣ — Fake account threatens or harasses you
If the person uses the fake identity to:
threaten you;
stalk you;
repeatedly contact you;
harass your family;
damage your reputation;
the complaint can involve offences beyond simple impersonation.
Therefore, “fake account” is the starting point—not necessarily the end of the legal analysis.
⚖️ 2. Is Creating a Fake Social-Media Account Illegal in India?
The answer is: it can be.
There is an important distinction between merely creating an account and using another person's identity to deceive, cause harm, commit fraud, invade privacy or commit another offence.
Indian law contains specific provisions dealing with cyber-related identity misuse and personation.
The Information Technology Act, 2000 contains provisions including Section 66C concerning identity theft and Section 66D concerning cheating by personation using a computer resource.
The Bharatiya Nyaya Sanhita, 2023 (BNS), which replaced the IPC framework for offences from 1 July 2024, also contains provisions concerning cheating and cheating by personation.
Section 319 BNS defines cheating by personation and provides punishment where a person cheats by pretending to be another person or representing himself/herself as someone other than who they really are.
Therefore, depending upon the facts, a fake Instagram or WhatsApp account can potentially become a criminal matter, particularly where the account is being used to deceive or harm others.
🆔 3. What Is Identity Theft Under the IT Act?
One of the important provisions in online identity misuse cases is Section 66C of the Information Technology Act, 2000.
The provision deals with punishment for identity theft.
In practical terms, identity theft concerns situations where another person's identifying information is dishonestly or fraudulently used in the manner covered by the provision.
For example, imagine:
Someone obtains your login credentials or other identifying information and uses them to impersonate you online.
The investigation would examine:
What information was taken?
How was it obtained?
How was it used?
Was it used dishonestly or fraudulently?
Was a computer resource or communication device involved?
This is why victims should not simply write:
“Someone made a fake account.”
Instead, the complaint should explain exactly how the person's identity was misused.
💻 4. What Is Section 66D of the IT Act?
Section 66D deals with:
Cheating by personation by using computer resource or communication device
The provision is particularly relevant when technology is used to impersonate another person for cheating.
The official India Code listing specifically identifies Section 66D as the provision dealing with cheating by personation using a computer resources.
Example
Suppose somebody creates a WhatsApp account using:
your name;
your photograph;
and then messages your friend:
“I am in an emergency. Send ₹15,000 to this UPI account.”
Your friend believes the message is genuinely from you.
Money is transferred.
This is substantially different from merely having a fake profile.
The fake identity is being used as a mechanism for deception and financial gain.
In such circumstances, the police may examine Section 66D IT Act along with other applicable provisions.
⚖️ 5. What About Section 319 of the Bharatiya Nyaya Sanhita?
Another important provision is Section 319 BNS — Cheating by personation.
The statutory provision says that a person cheats by personation when they cheat by pretending to be some other person or knowingly representing themselves or another person as someone other than who they actually are.
The punishment provided under Section 319 BNS may extend to five years' imprisonment, or fine, or both.
Simple example
Suppose:
Real person: Anjali
Fake person: Unknown individual
The fake individual creates an account:
“Anjali Sharma”
and communicates with Anjali's contacts while pretending to actually be Anjali.
If the necessary ingredients of cheating/personation are established, Section 319 may become relevant.
But remember:
The mere existence of a fake account does not automatically establish every ingredient of cheating by personation.
The actual conduct and intention matter.
🧠 6. What Is the Difference Between Fake Account, Identity Theft and Personation?
These expressions are often used interchangeably by ordinary people, but legally they can involve different concepts.
Situation
Possible legal concern
Someone creates a profile using your name/photo
Identity misuse / impersonation
Someone pretends to be you to deceive others
Personation
Someone uses identifying information dishonestly/fraudulently
Identity theft
Someone pretends to be you to obtain money
Cheating + personation
Someone uses fake account to threaten you
Threat/harassment-related offences may arise
Someone uploads private material
Privacy/other cyber offences may arise
Someone publishes obscene material
IT Act provisions may become relevant
Someone damages your reputation
Defamation-related remedies may be considered
The final offence depends upon the facts, evidence and intention.
🚨 7. What Should I Do Immediately After Discovering the Fake Account?
Do not wait for the account to become more harmful.
Your first response should be evidence preservation.
Step 1: Take screenshots 📸
Capture:
profile name;
username;
profile picture;
bio;
account URL;
posts;
stories;
messages;
phone number;
WhatsApp profile;
UPI details;
bank details;
threatening messages;
conversations with other people.
Make sure the screenshots clearly show the relevant information.
🔗 8. Save the Profile URL
This is extremely important.
Do not only take a screenshot.
Copy and save the:
Instagram profile URL
or relevant:
WhatsApp contact/number information.
The National Cyber Crime Reporting Portal specifically identifies social-media URLs, WhatsApp numbers/Telegram handles, phone numbers and other identifiers as information that can be reported.
📱 9. Report the Fake Account to Instagram or WhatsApp
You should also use the platform's own reporting mechanism.
For Instagram, report the profile for impersonation or the relevant violation.
For WhatsApp, use the available reporting/blocking options for the account.
The National Cyber Crime Reporting Portal itself provides links/information for reporting abuse to social-media intermediaries, including Instagram and WhatsApp.
Why should you report it to the platform?
Because the platform may be able to take measures such as:
restricting the account;
disabling the account;
removing unlawful content;
limiting its reach;
preventing further contact.
However:
Platform reporting and a police/cybercrime complaint are not the same thing.
If the conduct amounts to a cybercrime, reporting only to Instagram or WhatsApp may not be sufficient.
👮 10. Can I File a Cybercrime Complaint?
Yes.
India's National Cyber Crime Reporting Portal (NCRP) allows citizens to report cybercrime complaints.
The portal specifically includes complaints concerning:
online and social-media crimes;
mobile crimes;
financial fraud;
hacking;
ransomware;
cryptocurrency-related crimes;
other cyber offence.
National Cyber Crime Reporting Portal
For a fake Instagram/WhatsApp account, you can generally use the “Report Other Cybercrimes” route where appropriate.
📝 11. What Information Should I Put in the Cybercrime Complaint?
Your complaint should be factual and chronological.
For example:
A. Your identity
Provide:
name;
mobile number;
email;
relevant identification information as requested by the portal.
B. Fake account information
Provide:
username;
profile URL;
phone number;
WhatsApp number;
email address, if available.
C. What happened
Explain:
when you discovered the fake account;
what name/photo it is using;
how you know that it is not your account;
whom the fake account contacted;
what messages were sent;
whether money was requested;
whether anyone suffered loss;
whether threats were made;
whether your photographs were misused;
whether any private material was uploaded.
D. Evidence
Attach relevant:
screenshots;
URLs;
chat records;
photographs;
videos;
transaction details;
emails;
other documents.
The NCRP advises complainants to keep evidence such as webpage URLs, chat transcripts, screenshots, emails, videos, images and other relevant documents.
📂 12. What Evidence Should I Preserve?
Evidence is often the difference between:
“Someone made a fake account.”
and:
“Here is a complete digital trail showing what happened.”
Evidence checklist ✅
Keep:
☑ Screenshot of fake profile
☑ Profile URL
☑ Username
☑ Phone number
☑ WhatsApp number
☑ Messages
☑ Voice messages
☑ Screenshots of posts
☑ Screen recording where useful
☑ Names of people contacted by the fake account
☑ Transaction records
☑ UPI ID
☑ Bank details communicated by the suspect
☑ Emails
☑ Platform complaint/reference number
☑ Cybercrime complaint number
☑ Police complaint copy
☑ Date and time of discovery
The NCRP's complaint checklist also identifies incident date/time, incident details, relevant evidence and suspect details as useful information for reporting.
⚠️ 13. Don't Delete the Fake Account Evidence Immediately
A common mistake is:
“I reported the account, so now I will block it and delete everything.”
Don't do that before preserving evidence.
If the account disappears later, your screenshots and saved information may become particularly important.
Better approach:
Capture → Save → Report → Preserve → Then Block
Keep the original files safely.
💰 14. What If the Fake Account Is Asking People for Money?
This situation should be treated as urgent.
Suppose the fake account sends:
“I am your friend. I urgently need ₹50,000.”
and gives a UPI ID.
You should immediately preserve:
UPI ID;
mobile number;
transaction details;
bank account information;
payment screenshots;
chats;
timestamps.
If money has actually been transferred in a cyber financial fraud, report it immediately through the appropriate cyber-fraud mechanism, including 1930 where applicable. The official cybercrime portal identifies 1930 as the national helpline for immediate reporting of cyber financial fraud.
⏰ Why is speed important?
Because financial transactions may involve multiple accounts and movement of funds.
The sooner the authorities are informed, the better the possibility of timely intervention.
👩⚖️ 15. Can I Go Directly to the Police?
Yes.
You can approach the police with your complaint and supporting evidence.
Depending upon the circumstances, you may approach:
local police station;
cyber police station/cybercrime unit;
appropriate investigating authority.
You should carry:
📄 Written complaint
📱 Mobile phone containing relevant evidence
📸 Screenshots
🔗 URLs
🧾 Transaction documents, if any
🪪 Identification documents where required
Ask for an acknowledgement/diary number or other proof of submission, as applicable.
🚔 16. What If the Police Say “It Is Only a Fake Account”?
Do not panic.
Politely explain:
“The account is impersonating me and is using my name/photo to represent itself as me. It is contacting other persons/using my identity/causing reputational or financial harm.”
Then provide your evidence.
The important point is that the complaint should explain the actual conduct and harm, rather than merely using legal labels.
For example, instead of:
“Section 66D has been committed.”
write:
“The unknown person created an account using my name and photograph and contacted my relatives pretending to be me. The person requested money from them and provided a UPI ID.”
The police can then determine the appropriate offences.
📜 17. Can Multiple Legal Provisions Apply?
Yes.
A single incident may involve multiple offences.
For example:
A person:
creates a fake Instagram account;
uses your photograph;
pretends to be you;
asks your contacts for money;
sends threatening messages;
publishes private photographs.
This is not necessarily one simple legal issue.
Depending upon the facts, investigation may consider provisions relating to:
identity theft;
cheating;
personation;
privacy;
threats;
obscene/sexually explicit material;
defamation;
other applicable offences.
The IT Act expressly contains provisions dealing with identity theft, cheating by personation, privacy violations and certain forms of obscene/sexually explicit electronic content.
🧑⚖️ 18. What If Someone Uses My Photograph Without Permission?
This is one of the most common questions.
The legal answer depends on how the photograph is being used.
Merely taking an ordinary publicly available photograph and using it in a fake profile may present a different legal situation from:
using the photograph to deceive people;
using it commercially;
attaching false statements to it;
using it for fraud;
manipulating it into obscene content;
using it to threaten or harass you.
Therefore, don't assume that every unauthorized photograph automatically produces the same criminal offence.
The context and purpose of use are critical.
😨 19. What If the Fake Account Is Posting Abusive or Defamatory Content?
Suppose someone creates an account in your name and posts:
“I cheated people.”
or:
“I am involved in illegal activities.”
and other people believe those statements are actually coming from you.
Now the issue can extend beyond impersonation.
Potential legal concerns may include:
reputational harm;
defamation;
cheating/personation;
harassment;
other applicable offences.
The victim should preserve:
screenshots;
URLs;
names of people who saw the post;
messages received from others;
date/time;
comments;
shares/reposts.
🔐 20. What If the Fake WhatsApp Account Uses My Name and Photo?
WhatsApp impersonation can be particularly dangerous because the fake user may directly contact:
family;
friends;
colleagues;
customers;
clients.
The victim should immediately inform important contacts:
“This WhatsApp number/account is not operated by me. Please do not transfer money or share personal information.”
This can prevent secondary victims.
You should also:
screenshot the account;
save the number;
preserve messages;
report the account;
block it after evidence preservation;
file a cybercrime complaint if the conduct is unlawful.
The NCRP specifically provides a mechanism for reporting suspicious WhatsApp numbers and social-media URLs.
📢 21. Should I Inform My Friends and Family?
Yes—especially if the fake account is contacting them.
A short warning can prevent financial or reputational damage.
Tell them:
“A fake account has been created using my identity. Please do not respond to requests for money, OTPs, passwords or personal information.”
This is particularly important where the impersonator is trying to exploit your social network.
🔑 22. Should I Change My Passwords?
Absolutely.
If you suspect that the fake account may be connected to compromised credentials, change passwords for:
Instagram;
Facebook;
Gmail;
WhatsApp-related accounts;
other important accounts.
Enable:
🔐 Two-factor authentication
🔐 Strong passwords
🔐 Login alerts
🔐 Recovery email/phone security
Also review active sessions and logged-in devices where the platform provides that facility.
🕵️ 23. Can Police Find Who Created the Fake Account?
Potentially, yes—but victims should not assume that identification is automatic.
Investigators may examine available digital evidence and relevant records.
Depending on the circumstances, investigation can involve:
phone numbers;
email addresses;
account information;
IP-related information;
device information;
transaction records;
platform records;
communication records;
other digital evidence.
However, the victim generally cannot independently obtain all such information from Instagram or WhatsApp.
That is one reason why making a formal complaint can matter.
🌐 24. Can I Ask Instagram/WhatsApp to Remove the Account?
Yes.
You should use the platform's reporting mechanism.
The Government's National Cyber Crime Reporting Portal itself provides a facility directing citizens toward reporting abuse to social-media intermediaries, including Instagram and WhatsApp.
Your request should clearly explain:
“This account is impersonating me and is using my name/photo without authorization.”
If the account is additionally:
committing fraud;
threatening people;
publishing illegal material;
harassing people;
🛑 25. Should I Confront the Person Behind the Fake Account?
Generally, do not put yourself at risk by confronting or threatening the suspected person.
You may not even know whether your suspicion is correct.
Instead:
Preserve → Report → Complain → Let authorities investigate.
Avoid posting:
“I know who did this and I will take revenge.”
Such statements can unnecessarily escalate the situation.
🔍 26. Can I Find the Person Myself?
You can collect publicly available information such as:
username;
phone number;
profile URL;
messages;
payment details.
But don't attempt unlawful methods such as:
❌ hacking the account
❌ accessing someone's private account
❌ stealing passwords
❌ installing spyware
❌ impersonating the suspect
❌ threatening the suspect
Your objective should be to preserve evidence, not conduct an illegal investigation yourself.
🚨 27. What If the Fake Account Is Threatening Me?
If the impersonator is threatening you, the matter becomes more urgent.
Preserve every:
threat message;
voice note;
photograph;
video;
call record;
username;
phone number.
If you reasonably fear for your immediate physical safety, contact the police/emergency authorities rather than relying only on an online complaint.
The complaint should clearly state:
“I am concerned about my safety because the person is threatening me through the fake account.”
Don't minimize threats merely because they were made online.
👩 28. What If the Victim Is a Woman?
Additional issues may arise where a woman is subjected to:
sexual harassment;
obscene messages;
sexually explicit content;
morphed images;
stalking;
threats;
non-consensual intimate-image sharing.
In such circumstances, the victim should clearly identify the nature of the conduct in the complaint.
Don't simply write:
“Someone made a fake account.”
Explain:
“The account is using my photograph and sending sexually explicit messages to other persons while pretending to be me.”
Specific facts allow authorities to assess the appropriate legal provisions.
🧑💻 29. What If the Fake Account Uses AI-Generated or Morphed Images?
This is becoming an increasingly important issue.
A person may use:
AI-generated images;
face-swapping;
deepfake technology;
digitally altered photographs;
manipulated videos.
The legal analysis again depends on what the content depicts and how it is being used.
The Government has recently highlighted the legal framework applicable to AI-generated deepfakes and identified provisions of the IT Act relating to identity theft, impersonation, privacy and certain unlawful electronic content.
Therefore, victims should preserve the original manipulated content, URL and surrounding context.
📱 30. What If the Fake Account Has Already Been Deleted?
Don't assume that the case is over.
You should still preserve:
screenshots;
URL;
username;
phone number;
messages;
emails;
previous reports;
information from people who interacted with the account.
Report the incident to the cybercrime authorities if appropriate.
Digital evidence may still be relevant to investigation.
🧾 31. What If I Don't Know Who Created the Account?
That's completely possible.
Most victims initially know only:
“Someone unknown created this account.”
You do not necessarily need to identify the offender yourself before making a complaint.
Give authorities whatever information you have:
username;
profile link;
phone number;
email;
screenshots;
transaction details;
messages.
The NCRP allows complainants to provide suspected identifiers and other available suspect information; it also explains that complaints are handled by the concerned State/UT police authorities.
🏛️ 32. What Happens After Filing the Cybercrime Complaint?
Broadly, the process may look like this:
Step 1️⃣ — Complaint submitted
You submit the complaint through the appropriate channel.
Step 2️⃣ — Complaint reaches authorities
The NCRP states that complaints are handled by the concerned State/UT police authorities based on the selection made during reporting.
Step 3️⃣ — Preliminary assessment
Authorities examine:
nature of allegations;
available evidence;
account details;
financial information, if any;
jurisdiction and applicable offences.
Step 4️⃣ — Investigation
Where a criminal case is made out, investigation may involve collection of digital evidence and identification of the person responsible.
Step 5️⃣ — Further legal action
Depending on the evidence and applicable law, the matter may proceed through the criminal justice system.
📌 33. What If I Only Want the Fake Account Removed?
If your primary concern is:
“I don't want prosecution; I just want the fake profile removed.”
You can still report the account to the platform.
However, if the person is:
committing fraud;
threatening you;
harassing you;
damaging your reputation;
misusing private information;
you should seriously consider making a formal cybercrime/police complaint as well.
Why?
Because simply deleting the account may stop the immediate problem but may not address the underlying unlawful conduct.
💡 34. A Practical “Do This Today” Checklist
If you discover a fake Instagram/WhatsApp account today, follow this sequence:
🚨 FIRST 30 MINUTES
1. Screenshot everything. 📸
2. Copy the account URL. 🔗
3. Save the username and phone number. 📱
4. Record messages and payment details. 💳
5. Inform people who may be targeted. 📢
⏰ NEXT FEW HOURS
6. Report the account to Instagram/WhatsApp.
7. Submit a cybercrime complaint where appropriate.
8. If financial fraud has occurred, report immediately through the appropriate financial-fraud channel, including 1930.
9. Change relevant passwords.
10. Enable two-factor authentication.
📂 AFTER THAT
11. Keep all complaint/reference numbers.
12. Keep the original evidence.
13. Don't confront or threaten the suspected person.
14. Follow up with the investigating authority where necessary.
🚫 35. Common Mistakes Victims Should Avoid
❌ Mistake 1: Immediately deleting evidence
Save it first.
❌ Mistake 2: Only reporting the account to Instagram
Platform reporting may not substitute for a cybercrime complaint where criminal conduct is involved.
❌ Mistake 3: Ignoring requests for money
Warn your contacts immediately.
❌ Mistake 4: Confronting the suspected person
Let the authorities investigate.
❌ Mistake 5: Giving vague information
Provide:
Username + URL + phone number + screenshots + dates + messages.
❌ Mistake 6: Waiting for weeks
Digital evidence and online accounts can change quickly.
❌ Mistake 7: Making unsupported accusations
Report facts rather than assumptions.
🏁 36. Final Takeaway
Someone creating a fake Instagram or WhatsApp account in your name is not something you should simply ignore—especially when the account is being used to pretend to be you, deceive others, seek money, threaten people, misuse photographs, invade privacy or damage your reputation.
Indian law provides several possible legal routes depending on the facts. The Information Technology Act, 2000 contains provisions relating to identity theft and cheating by personation, while the Bharatiya Nyaya Sanhita, 2023 contains a provision specifically addressing cheating by personation.
The practical approach is straightforward:
📸 Preserve evidence
🔗 Save the account URL and number
📱 Report the fake account
💻 File a cybercrime complaint where appropriate
👮 Approach the police/cyber police when criminal conduct is involved
💰 Report financial fraud immediately
🔐 Secure your genuine accounts
⚖️ Seek legal advice where serious harm has occurred
Most importantly, do not wait until the fake account causes significant damage.
A quick, well-documented response can help prevent the impersonator from deceiving more people and can preserve evidence necessary for investigation.
Your online identity is part of your personal identity. If someone misuses it, you have legal and practical options to respond.
⚠️ Legal Disclaimer
This article is intended for general legal awareness and educational purposes in India.
Leave a Comment
Your email address and mobile number will not be published. Required fields are marked *