Fake AI Personas, Catfishing and Digital Arrest: What Indian Law Says About Online Impersonation

Three complaints, three different stories, one identical wrong. A student builds a wholly fictional foreign influencer with a free AI tool and monetises the followers. A woman discovers a dating profile using her photographs and her employer's name. A retired bank officer spends six hours on a video call with a man in what looks like a police uniform, sitting in front of what looks like a police station backdrop, and transfers his fixed deposit to "secure" it. The masks differ. The wrong is the same: a false identity used to make a real person believe a lie.

Part of the cyber crime and online fraud practice at S Jain & Attorneys, Bangalore.

Indian law does not have a single offence called "online impersonation", "catfishing" or "digital arrest". What it has is a set of provisions that between them cover almost every version of this conduct, spread across the Bharatiya Nyaya Sanhita, 2023 and the Information Technology Act, 2000. Knowing which provision fits your facts is what decides whether the police register a first information report or send you away.

The core idea: deception by a false identity

Whether the mask is a stolen photograph, a cloned voice, a fake uniform on a video call, a spoofed caller ID showing a real police number, or a fully synthetic persona generated by a model, the legal wrong is constant. Someone has been induced to part with money, property, data or consent because they were made to believe something untrue about who they were dealing with.

Indian law attacks this from two directions at once, and in practice a competent first information report will invoke both. The Bharatiya Nyaya Sanhita supplies the substantive offences of cheating, forgery, extortion and intimidation. The Information Technology Act supplies the offences that are specific to the electronic medium, and, just as importantly, the machinery for getting content taken down and for compensation.

Under the Bharatiya Nyaya Sanhita, 2023

The Sanhita replaced the Indian Penal Code with effect from 1 July 2024, so the section numbers most people remember have changed. The relevant ones here are:

• Section 318 (cheating), formerly Section 415 and Sections 417 to 420 IPC. Plain cheating under Section 318(2) carries up to three years, or fine, or both. Where the deceit dishonestly induces the victim to deliver property or to sign a valuable security, Section 318(4) raises it to seven years and fine. Almost every scam that ends in a transfer sits in Section 318(4).
• Section 319 (cheating by personation), formerly Section 416 IPC. This is the provision written for exactly this conduct. The explanation to Section 319(1) makes the point that matters most for AI personas: the offence is committed whether the individual personated is real or imaginary. Punishment under Section 319(2) is up to five years, or fine, or both.
• Section 336 (forgery), formerly Sections 463 and 465 IPC. Forgery of a false electronic record is covered. Simple forgery under Section 336(2) is up to two years. Where the forged document or electronic record is intended to be used for cheating, Section 336(3) makes it seven years and fine. A fake arrest warrant, a doctored court order, a morphed identity card or a fabricated Reserve Bank letterhead falls here.
• Section 351 (criminal intimidation), formerly Section 503 IPC. Section 351(2) carries up to two years. Where the threat is of death or grievous hurt, or of an offence punishable with seven years or more, or imputes unchastity to a woman, Section 351(3) raises it to seven years. Section 351(4) adds a further term of up to two years where the intimidation is by anonymous communication or where the caller has taken precautions to conceal identity, which is the ordinary state of affairs in these calls.
• Section 308 (extortion), formerly Sections 383 and 384 IPC. Section 308(2) carries up to seven years. Where the accused puts the victim in fear of death or grievous hurt in order to extort, Section 308(4) is seven years and fine. Sextortion cases usually belong here rather than in the cheating provisions.
• Section 356 (defamation), formerly Section 499 IPC. Section 356(2) carries simple imprisonment up to two years, or fine, or both, or community service, where a fake persona damages a real person's reputation.

Under the Information Technology Act, 2000

• Section 66C, identity theft. Fraudulent or dishonest use of another person's electronic signature, password or any other unique identification feature. Up to three years and fine up to one lakh rupees.
• Section 66D, cheating by personation using a computer resource. This is the workhorse charge in catfishing and in every scam call conducted over an internet-based platform. Up to three years and fine up to one lakh rupees.
• Section 66E, violation of privacy. Intentionally capturing, publishing or transmitting the image of a private area of a person without consent. Up to three years or fine not exceeding two lakh rupees, or both.
• Section 67, obscene material in electronic form. Up to three years and fine up to five lakh rupees on first conviction; up to five years and fine up to ten lakh rupees on a second or subsequent conviction.
• Section 67A, sexually explicit material. Up to five years and fine up to ten lakh rupees on first conviction; up to seven years and fine up to ten lakh rupees thereafter. Morphed content produced from a victim's ordinary photographs is regularly charged here alongside Section 66E.

Two procedural provisions of the same Act matter more than most complainants realise. Section 78 requires that an offence under the IT Act be investigated by a police officer not below the rank of Inspector, so a sub-inspector cannot lawfully run the investigation. Section 77B provides that an offence punishable with imprisonment of three years and above is cognizable, and an offence punishable with three years is bailable. That is why the police cannot tell you a Section 66D case needs a magistrate's order before an FIR can be registered.

One clarification, because it still causes confusion. Section 66A of the IT Act, which punished sending offensive messages, was struck down as unconstitutionally vague in Shreya Singhal v. Union of India, (2015) 5 SCC 1. If a first information report against you cites Section 66A, that limb is bad in law. Impersonation offences are charged under Sections 66C and 66D, never under Section 66A.

Two statutes work together here, and two procedural provisions decide how your complaint is handled.

"Digital arrest" is a scam with no legal existence

Say it plainly. There is no such thing as a digital arrest in Indian law. No provision of the Bharatiya Nagarik Suraksha Sanhita, 2023, the Information Technology Act, the Prevention of Money-Laundering Act or the Customs Act permits the police, the Central Bureau of Investigation, the Enforcement Directorate, the Narcotics Control Bureau, the Reserve Bank of India or the Telecom Regulatory Authority to place a person under arrest, custody, surveillance or house confinement over a video or telephone call. Arrest is a physical act governed by Chapter V of the Sanhita and it produces paper: an arrest memo, an intimation to a relative, a medical examination, and production before a magistrate within twenty-four hours.

Key takeaway. No agency in India can arrest, detain or interrogate you over a video call, and no genuine investigating agency will ever ask you to transfer money to a "verification account", an "RBI escrow account" or a "secure custody account" to clear your name. The moment money is demanded on a call, you are dealing with a criminal, not an officer. Disconnect, do not call back on the number that called you, and report on 1930 or at cybercrime.gov.in.

The operational tells are consistent. The call opens with a courier parcel said to contain narcotics or fake passports, a SIM card said to be registered in your name, or an Aadhaar said to be linked to a money-laundering account. You are told the matter is confidential and that discussing it with family is itself an offence. You are kept on video so you cannot verify anything independently. The demand escalates from a "refundable verification deposit" to your entire liquid savings. Isolation is the method. Anyone who tells you not to speak to your family or your lawyer is not from a government agency.

Catfishing and synthetic personas

Luring someone through a fake online identity is not a standalone offence by that name, but it rarely stays outside the criminal law. Once money or a gift changes hands, Section 318 read with Sections 319 and 66D applies. Where real details of a living person have been used, Section 66C applies. Where intimate images are obtained and then used as leverage, the case moves into Section 308 extortion together with Sections 66E, 67 and 67A.

Purely synthetic personas raise a genuinely harder question. If the persona corresponds to no real human being, there is no identity theft under Section 66C, because nothing belonging to an identifiable person has been misused. But the explanation to Section 319 BNS closes the gap on the cheating side: personating an imaginary person is still cheating by personation. So a fully AI-generated influencer who takes money from followers on the strength of a false claim of being a real person is not outside the criminal law simply because the person never existed.

Which provision fits which scam

The last row is worth pausing on. Section 111(1) BNS defines organised crime to include continuing unlawful activity in the nature of cyber-crimes carried on by a person or a group acting in concert as part of an organised crime syndicate for material benefit. Section 111(3) extends the same punishment to anyone who abets, conspires or knowingly facilitates such an offence, which reaches mule account holders and SIM suppliers. Where the gang is loose rather than organised, Section 112 (petty organised crime) carries not less than one year and up to seven years. This is a significant change from the old law and it is under-used in first information reports.

What to do in the first twenty-four hours

1. Stop the transfers and preserve the account. Call your bank's fraud line and ask, in terms, for the account to be flagged and outgoing transactions blocked. Note the time of the call and the reference number.
2. Report on 1930 or at cybercrime.gov.in. The national helpline feeds the Citizen Financial Cyber Fraud Reporting and Management System, which pushes a lien request to the beneficiary bank. Speed is the single largest variable in whether money is recovered, because funds are usually layered through several accounts within hours.
3. Notify your bank in writing. Email as well as call, so that the date of intimation is documented. This date determines your liability under the Reserve Bank of India's customer protection directions.
4. Preserve every trace before you delete anything. Screenshots with the full URL and timestamp visible, the profile handle and numeric user ID, call logs, the caller's number, UPI transaction IDs, bank reference numbers, and the original files rather than forwarded copies. Do not crop.
5. File the first information report. Section 173(1) of the Bharatiya Nagarik Suraksha Sanhita, 2023 allows information about a cognizable offence to be given irrespective of the area where the offence was committed, which is the zero FIR now put on a statutory footing, and allows it to be given by electronic communication, taken on record on being signed within three days.
6. If the police refuse. Section 173(4) BNSS lets you send the substance of the information in writing by post to the Superintendent of Police, and if that fails, to apply to the Magistrate. Section 175(3) BNSS empowers a Magistrate to order investigation on an application supported by an affidavit. This replaces the old Section 156(3) of the Code of Criminal Procedure, 1973.
7. Send the takedown complaint to the platform in parallel. Criminal investigation and content removal run on separate tracks and neither waits for the other.

Deadline warning. Two clocks start the moment you realise what has happened. Under the Reserve Bank of India's directions on limiting customer liability in unauthorised electronic banking transactions, a customer has zero liability for a third-party breach if the bank is notified within three working days of receiving the bank's communication about the transaction. Notify between four and seven working days and your liability is capped at the transaction value or a figure in the Reserve Bank's table, five thousand rupees for a basic savings account and ten thousand rupees for ordinary savings accounts, prepaid instruments and smaller current accounts, whichever is lower. Beyond seven working days, the bank's own board-approved policy governs, and that is a much worse place to be.

Getting the fake profile or the morphed image taken down

The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 give you rights that are considerably stronger than most platform help pages suggest, and they are enforceable.

Rule 3(2)(b) requires an intermediary, within twenty-four hours of receiving a complaint from the affected individual or someone on their behalf, to take all reasonable and practicable measures to remove or disable access to content which is prima facie in the nature of impersonation in electronic form, including artificially morphed images, or which exposes a private area, shows the individual in full or partial nudity, or depicts them in a sexual act. Note the words "including artificially morphed images". Deepfakes are squarely inside this rule.

Rule 3(2)(a)(i) requires the platform's Grievance Officer, whose name and contact details must be published on the site or app, to acknowledge a complaint within twenty-four hours and resolve it within fifteen days, with content-removal requests under Rule 3(1)(b) to be resolved within seventy-two hours. Rule 3A allows a person aggrieved by the Grievance Officer's decision, or whose grievance is not resolved within the prescribed period, to appeal to a Grievance Appellate Committee within thirty days, and the Committee is to endeavour to resolve the appeal within thirty calendar days.

Use the Grievance Officer route rather than the in-app report button. An in-app report is triaged by automated systems. A written complaint addressed to the named Grievance Officer, citing Rule 3(2)(b) and the twenty-four hour obligation, starts a clock the platform is legally answerable for. Keep the acknowledgement.

Rule 3(1)(j) separately requires an intermediary to furnish information in its control to a lawfully authorised government agency within seventy-two hours of receiving an order. That is why a properly drafted first information report naming the exact profile URL and numeric user ID gets subscriber data faster than a vague one.

Getting the money back, and civil compensation

Criminal prosecution punishes. It does not, by itself, refund you. Three separate routes run alongside it.

The first is the banking route already described, through the Reserve Bank's customer liability framework and, if the bank stonewalls, the Reserve Bank Integrated Ombudsman scheme. Our guide on UPI and bank fraud recovery under the RBI rules sets out that process in detail, and how to recover money from online fraud in India covers the freeze-and-restitution mechanics.

The second is the adjudication route under the IT Act, which is widely forgotten. Section 43 provides for penalty and compensation where a person accesses, damages or extracts data from a computer resource without authorisation, and Section 46 empowers an adjudicating officer, an officer not below the rank of Director to the Government of India or an equivalent state officer, to decide claims. Section 46(1A) fixes the adjudicating officer's jurisdiction at claims for injury or damage not exceeding five crore rupees, with larger claims going to the competent court. This is a civil, compensation-oriented forum and it is faster than a suit.

The third is restitution through the criminal court itself, either on conviction or through attachment of the proceeds where the investigating agency has traced them.

Evidence: what a court will actually accept

Electronic evidence in India is now governed by the Bharatiya Sakshya Adhiniyam, 2023, which replaced the Indian Evidence Act, 1872 from 1 July 2024. Section 61 BSA confirms that an electronic or digital record is not to be denied admissibility merely because it is electronic. Section 63 BSA governs admissibility of electronic records and, like Section 65B of the old Act, requires a certificate for a copy or printout produced from a computer or communication device.

The practical consequence is that a screenshot pasted into a complaint is weak, and a screenshot produced from the original device by a person who can sign the Section 63 certificate is strong. Do not wipe or replace the phone the messages arrived on. Do not restore it to factory settings. If you must change the device, keep the old one switched off and untouched. Where a document is in the hands of a third party such as a bank or a platform, Section 94 BNSS allows the court or the investigating officer to summon its production.

Costs and timelines, realistically

These figures are indicative ranges for a matter run from Bengaluru and vary with complexity, the number of accused and the court.

• Reporting on 1930 and at cybercrime.gov.in: free, and no lawyer is needed to do it.
• Platform takedown complaint under Rule 3(2)(b): free. Prescribed outcome within twenty-four hours for impersonation and morphed content, though in practice a follow-up is often required. Grievance Appellate Committee appeal is also free to file.
• Assistance with drafting a first information report and a takedown notice: typically twelve thousand to thirty-five thousand rupees in professional fees.
• Application to the Magistrate under Section 175(3) BNSS after a police refusal: typically twenty-five thousand to sixty thousand rupees, with an order commonly taking six weeks to four months depending on the district.
• Freezing and restitution of funds: where reporting is within hours, partial recovery within two to eight weeks is realistic. Where reporting is delayed past a few days, recovery becomes unlikely and the matter turns into a prosecution rather than a refund.
• Trial: a contested cyber-fraud prosecution in a magistrate's court commonly takes two to five years.

The mistakes that cost people their case

Common mistake. Paying once "to make it stop". In every sextortion and digital-arrest pattern, the first payment is treated as proof that the victim can pay, and the demands escalate. The second mistake is deleting the conversation out of embarrassment, which destroys the only evidence that would have proved the offence.

Other recurring errors, in the order they do damage:

• Calling back the number that called you. Verify independently. Look up the police station or agency number yourself and call that instead.
• Waiting for family advice before reporting. The reporting window is measured in hours. Report first, explain later.
• Filing a vague complaint. "Someone cheated me on Instagram" produces nothing. The profile URL, the numeric user ID, the exact transaction IDs and the beneficiary account details produce an investigation.
• Accepting a non-cognizable report. An offence punishable with three years and above under the IT Act is cognizable by force of Section 77B, and Section 318(4) BNS carries seven years. These are FIR cases.
• Letting the case be investigated by an officer below the rank of Inspector. Section 78 of the IT Act requires an Inspector or above.
• Treating a court order emailed as a PDF as genuine. Orders are available on the court's own website or through the registry. A PDF sent by the person demanding money is a forged electronic record under Section 336 BNS.
• Assuming that because the profile is deleted, the record is gone. It usually is not, but you need to ask the platform to preserve data before you ask it to delete the account.

If the person on the other side is abroad

Cross-border operation is a real obstacle but not a jurisdictional bar. Section 1(5)(c) of the Bharatiya Nyaya Sanhita expressly extends the Sanhita to any person in any place outside India who commits an offence targeting a computer resource located in India. Section 75 of the Information Technology Act contains a comparable extraterritorial provision. In practice, the money trail is the more productive line of attack than the identity of the person on camera, because the mule accounts and the payment aggregators are almost always domestic, and Section 111(3) BNS reaches those who facilitate.

Frequently Asked Questions

This article is for general informational purposes only and does not constitute legal advice. Laws change and every situation is different; please consult a qualified advocate about your specific matter.

Related guides and where to get help

If this is a live problem rather than background reading, our cyber crime practice handles these matters from Bengaluru, including for clients who cannot attend court in person. These guides go deeper on the neighbouring questions:

• How to Recover Money From Online Fraud in India
• Right to Be Forgotten: Removing Court Records Online
• UPI and Bank Fraud in India: How to Get Your Money Back Under the RBI Rules