What Is Identity Theft And Its Legal Consequences?

Identity theft is a serious cybercrime where an individual’s personal information is stolen and misused to commit fraud, impersonate the victim, or access sensitive services and financial accounts. With increasing online transactions and digital footprints, cybercriminals are using phishing, data breaches, and spyware to obtain data like Aadhaar numbers, credit card details, and login credentials. Legal systems in India and around the world treat identity theft as a punishable offense due to its potential to cause significant financial and reputational damage to victims.

What Is Identity Theft?

Identity theft occurs when someone unlawfully obtains and uses another person's personal or financial information, typically for fraud or deception.

Types of Identity Theft:

Financial Identity Theft: Using stolen bank or credit card details to make unauthorized purchases.

Medical Identity Theft: Misusing someone’s identity to obtain medical services or drugs.

Criminal Identity Theft: Using another person’s name when arrested or charged with a crime.

Synthetic Identity Theft: Creating fake identities using a mix of real and fabricated information.

Social Media or Online Impersonation: Taking over someone's online account or creating fake profiles to deceive others.

Common Methods of Identity Theft

Phishing Emails/SMS: Tricking users into revealing sensitive information via fake links.

Data Breaches: Gaining access to large databases containing personal details.

Skimming Devices: Capturing card details from ATMs or point-of-sale machines.

Social Engineering: Manipulating individuals to voluntarily share confidential data.

Malware & Spyware: Software that logs keystrokes or captures personal data.

Legal Consequences of Identity Theft in India

Under Indian law, identity theft is addressed under various provisions of the Information Technology Act, 2000 and Indian Penal Code (IPC).

Key Legal Provisions:

Section 66C (IT Act): Punishes identity theft involving the dishonest use of someone else’s digital signature, password, or identification.

Penalty: Up to 3 years of imprisonment and/or ₹1 lakh fine.

Section 66D (IT Act): Covers cheating by impersonation using electronic communication.

Penalty: Up to 3 years of imprisonment and/or ₹1 lakh fine.

IPC Section 419 & 420: Impersonation and cheating.

Penalty: Up to 7 years imprisonment and/or fine.

Other Laws:

Aadhaar Act, 2016: Misuse of Aadhaar data can attract imprisonment of up to 3 years and fines.

Consumer Protection Act, 2019: Protects consumers from unauthorized use of their identity.

Global Legal Perspective

USA: Identity Theft and Assumption Deterrence Act (ITADA) – up to 15 years imprisonment.

UK: Identity Theft falls under the Fraud Act, 2006 – up to 10 years.

EU: GDPR holds firms accountable for data misuse or leaks, with heavy penalties.

How to Protect Against Identity Theft

Avoid sharing personal info on unsecured websites.

Use strong and unique passwords for different accounts.

Enable two-factor authentication (2FA).

Regularly monitor bank statements and credit reports.

Be cautious with emails and SMS from unknown sources.

Use antivirus software and update systems regularly.

Shred sensitive documents before disposal.

Don’t share Aadhaar or PAN without verifying the requester.

What To Do If You’re a Victim

Block affected cards/accounts immediately.

File a complaint with your bank or service provider.

Report to Cyber Crime Police or file an online complaint at https://cybercrime.gov.in

Inform credit bureaus to prevent misuse of your credit profile.

Collect evidence like screenshots, messages, or transaction history.

File an FIR if necessary for legal proceedings.

Example

Scenario:

A college student in Delhi receives a fake job offer email asking him to submit scanned copies of his Aadhaar and PAN card. Weeks later, he receives calls from banks about unpaid loans he never took.

Steps taken by the victim:

Realizes his identity documents were misused for fraud.

Files a cybercrime complaint at cybercrime.gov.in.

Contacts the credit bureau to flag the fraudulent loans.

Submits an affidavit and police report to the bank to dispute the loan.

Enables alerts for all financial accounts and changes passwords.

Learns to verify sender credentials before sharing documents online.