A fake recruiter using your letterhead is not stealing your brand so much as using your name to cheat strangers. The remedy that matches that is criminal, fast and aimed at the platforms, and it sits alongside the trademark and passing-off action our answer on someone using your brand name already covers. This answer is about the other half: the FIR, the takedowns, the public notice, and the applicants who have already paid.
Which offences, and who complains?
The company complains, through an officer authorised by a board resolution or an authorisation letter, and each applicant who paid complains too. Section 173(1) of the Bharatiya Nagarik Suraksha Sanhita, 2023 allows the information to be given at any station and by electronic communication signed within three days, and Section 78 of the Information Technology Act, 2000 requires an Inspector-rank officer to investigate. Name the sections.
| Provision | The conduct it catches | Maximum punishment |
|---|---|---|
| Section 319(2) BNS | Cheating by personation, pretending to be the company or its HR, real or imaginary person | Five years, or fine, or both |
| Section 318(4) BNS | Cheating that induces the applicant to pay a "registration" or "security" fee | Seven years and fine |
| Section 336(3) BNS | Forging an offer letter, appointment letter or letterhead as a false electronic record for cheating | Seven years and fine |
| Section 336(4) BNS | Forgery intended to harm the reputation of any party, which is the company's own head of loss | Three years and fine |
| Section 66D IT Act | Cheating by personation using a computer resource, the emails, WhatsApp and portals | Three years and fine up to Rs 1 lakh |
| Section 111 BNS | Organised crime where a syndicate runs "any scheme to defraud several persons" | Five years to life, fine not less than Rs 5 lakh |
The first thing an investigating officer asks a corporate complainant is "what is your loss?". Answer it in two parts: the reputational harm and the disruption to genuine hiring, which Section 336(4) recognises, and the applicants' money, which is the Section 318(4) loss. Attach statements from applicants as witnesses. A complaint that arrives with three victims and their payment references is registered the same day. One that arrives with a trademark certificate and nothing else is sent to the civil court.
How do we get the fake pages, numbers and emails taken down?
Use the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and use them in writing to the named Grievance Officer of each platform, not through a generic report button. Rule 3(1)(b)(vi) obliges an intermediary to make reasonable efforts to keep users from hosting information that impersonates another person, and Rule 3(1)(b)(v) covers information that deceives the addressee about its origin. Rule 3(2)(a) requires the Grievance Officer to acknowledge within twenty-four hours, resolve within seven days, and resolve qualifying removal complaints specified in Rule 3(2)(a) within thirty-six hours. Rule 3(2)(b) gives a two-hour period for reasonable and practicable removal measures on qualifying intimate content or electronic impersonation complaints concerning an individual. A fake company identity does not automatically fall within that individual-content rule. Rule 3(1)(g) requires removed content and its records to be preserved for one hundred and eighty days, and Rule 3(1)(j) requires the platform to give the police the account data within seventy-two hours of a lawful order, so ask the investigating officer to issue that request the day the FIR is registered. If a platform ignores you, Rule 3A gives an appeal to the Grievance Appellate Committee within thirty days, and Section 79(3)(b) of the IT Act strips an intermediary of its safe harbour where it fails to act expeditiously on actual knowledge.
- Job portals and social networks: written complaint to the Grievance Officer citing Rule 3(2)(b), with the fake listing URL, screenshots and your genuine domain and letterhead for comparison.
- Domain registrar and hosting provider for the look-alike website: abuse complaint with the WHOIS record and the FIR number.
- Phone numbers and WhatsApp accounts: report the numbers through Chakshu on the Sanchar Saathi portal, and list them, the UPI handles and the bank accounts on the Report Suspect facility at cybercrime.gov.in, so they enter the I4C Suspect Registry that banks and platforms now check.
- Email: report the sending domain to the mail provider's abuse desk, and if it spoofs your own domain, tighten your SPF and DMARC records the same day.
Should we publish a public caution notice?
Yes, and quickly, because it does three things at once: it warns applicants, it fixes the date from which you can show the world knew, and it answers any later suggestion that the company sat on its hands. Keep it factual. State that the company never charges any fee at any stage of recruitment, list the only official domains and email addresses, give a verification number or address, and say that a police complaint has been filed. Put it on the website, the careers page, LinkedIn and, for a large racket, in a newspaper. Do not name individuals you suspect, because a wrong name in a public notice is defamation under Section 356 of the Bharatiya Nyaya Sanhita, 2023 and the fraudsters' names are usually borrowed anyway.
What do we owe the people who paid?
In law, nothing, if the company had no part in it. In practice, quite a lot, because these applicants are your witnesses and the racket's victims, and they will judge the company by how it treats them. Open a single email address and a phone line for them, give each of them the FIR number so they can register their own information at their local station under Section 173(1) BNSS, point them to 1930 and cybercrime.gov.in for the fee they paid, and take their statements for the file. Do not refund "as a goodwill gesture" without advice, since a payment can be read as an admission of involvement, and do not promise a job. Where the racket used a clone of your careers page, tell applicants exactly how to distinguish the real one.
- Screenshots of every fake listing, page and profile with the URL and date visible
- The fake offer letters and appointment letters, and your genuine templates for comparison
- The phone numbers, email addresses, WhatsApp accounts, UPI handles and bank accounts used
- WHOIS and hosting details of any look-alike domain
- Written statements and payment references from applicants who paid
- The board resolution or authorisation under which the company's officer signs the complaint
What I tell companies in this position
Move on the platforms in the first forty-eight hours and the FIR in the same week, in that order, because the listings are what keep new victims arriving. A takedown letter that cites Rule 3(2)(b) by number and encloses the FIR acknowledgement is acted on within a day at most large platforms, and the same letter without the rule number sits in a queue for a fortnight. Once the pages are down, the civil remedies in our answer on defamation of a business online and the trademark route can follow at a normal pace. Our post on registering a zero FIR explains how applicants in other cities can file without travelling.