Impersonation accounts are usually removed quickly if you report them correctly, and the criminal provisions are clear.
Report to the platform first
Every major platform has a dedicated impersonation reporting flow, separate from generic abuse reporting, and it is far faster. You will normally need to upload a government photo ID. Use the impersonation route, not the "harassment" route, because it goes to a different queue.
Under the IT Rules, 2021, qualifying electronic impersonation of an individual, including artificially morphed images, is subject to reasonable and practicable removal measures within two hours of a complaint under Rule 3(2)(b). Cite it.
Order matters. Capture the profile before you report it: the URL, the handle, the display name, the bio, the photograph, the follower list if visible, and any message sent from it. Once the account is removed all of that is gone, and the police cannot investigate a URL that no longer resolves. Then use the in-app impersonation form, which asks for a government photo ID and goes to a faster queue than generic abuse. Then email the platform's India grievance officer, naming Rule 3(2)(b) and asking for two things: removal, and preservation of the subscriber, registration and access log records pending a police request. That preservation line is the one people leave out, and it decides whether the account can ever be traced. Our note on how to report a cyber crime in India covers the portal side.
- The fake profile URL and user ID, captured before it is taken down
- Full screenshots of the profile, the posts and any messages sent from it
- Screenshots of your own genuine account for comparison
- A list of people who were contacted from it, with their statements if possible
- The platform report reference and the Grievance Officer correspondence
- Evidence of any financial loss caused to you or to those contacted
- Your own identity proof, which the police will require to establish impersonation
The criminal provisions
- Section 66C, IT Act: fraudulent or dishonest use of another person's electronic signature, password or any other unique identification feature. Up to three years and fine.
- Section 66D, IT Act: cheating by personation using a computer resource. Up to three years and fine.
- Section 319 BNS: cheating by personation.
- Section 336 BNS: forgery, where documents or images are fabricated.
- Where the fake profile is used to defame, Section 356 BNS also applies.
The overwhelming majority of fake profiles exist to defraud the impersonated person's friends and family, usually with an urgent request for money. Post a notice from your genuine account, and message close contacts directly. This prevents the actual harm, which the takedown alone does not, because the messages have often already gone out.
File the complaint
Report on cybercrime.gov.in with the profile URL, screenshots, and the date you discovered it, and at the local cyber police station. If money has been taken from anyone, call 1930 at once so the beneficiary account can be frozen.
In Bengaluru the physical complaint goes to the jurisdictional CEN police station, the Cyber, Economic Offences and Narcotics station attached to your police division. Ask specifically that the investigating officer write to the intermediary for the subscriber details, the registration email and mobile number and the IP logs, and to the telecom operator for the subscriber behind any number used. These cases are solved or lost on that request, and its usefulness decays as retention periods run out. Where the account has been used to take money from someone you know, that person should file his own complaint, because he carries the transaction trail.
The civil track runs in parallel and often faster. A suit can produce an order directing removal of the account and restraining further use of your name and photographs, and where the impersonator is unidentified courts pass orders against unnamed defendants and direct disclosure of subscriber information. Where your name is also a business name or a mark you use in trade, plead passing off alongside: it is easier to prove than falsity and produces the same takedown.
Deepfakes and morphed content
Where the impersonation extends to synthetic audio or video, the same 24 hour takedown rule applies to artificially morphed images. Courts have also begun to recognise personality rights, granting injunctions restraining the unauthorised use of a person's name, image, likeness and voice, particularly against AI-generated content.
Ask for the order to cover copies as they appear rather than a fixed schedule of links, because a synthetic video is re-uploaded within hours and an order tied to a list is obsolete before it is served. Keep the original photographs or recordings the fake was built from; their metadata is how you show a court which is which.
The commonest version of this is not on social media
Impersonation for money runs more often through a messaging app. Someone lifts your photograph and display name, opens an account on a new number, messages your contacts as you and asks for an urgent transfer. There is no profile to report in the usual sense, so do three things: report the number in the app, tell your contacts through a channel that is verifiably you, and if anyone has paid, get that person to call 1930 within the hour with the beneficiary account details. Our note on online impersonation and digital arrest frauds covers this pattern and the related calls claiming to be from the police.
Afterwards
Close the door behind it. Turn on two factor authentication, review sessions and connected applications, and reduce what is publicly visible: a public friend list and photograph album are the raw material for the next attempt. Keep the ticket numbers, the portal acknowledgement and the police complaint together, because the same person often returns under a new handle, and a fresh complaint annexing the earlier one is treated as a continuing course of conduct rather than an isolated report.