If you are stuck in such a situation, here is what to do.

Mr. Alok Sharma, a respected retired government official from Jayanagar, found himself in a distressing situation. Scammers hacked his WhatsApp account and, impersonating him, sent messages to his extensive list of contacts, fabricating a story about an urgent need for money. Given Mr. Sharma’s stellar reputation, many of his friends and former colleagues didn’t hesitate to help. Within a few hours, the fraudsters had managed to collect nearly ₹2.5 lakhs. His son, Rohan, is now seeking guidance as the local Cyber Crime unit’s response has been sluggish.

Advice in such cases

When faced with such a sophisticated scam, it’s crucial to act swiftly and methodically. Here are the immediate steps you should take:

• Immediately try to regain control of the WhatsApp account. If you cannot, use other means like phone calls or SMS to alert all your contacts about the hack. Post a message on other social media platforms if possible.
• Gather all the information from the contacts who transferred money, including transaction IDs, the scammers’ UPI ID or bank account number, and screenshots of the chat.
• File a formal complaint immediately on the National Cyber Crime Reporting Portal (www.cybercrime.gov.in) or by calling the helpline number 1930. Time is critical, as a quick report can help in freezing the fraudulent account.
• Draft a detailed written complaint and submit it to the nearest police station or the Cyber Crime Cell in your city. Attach all the evidence you have collected.
• Consult with a Lawyer: The very basic and important step to start is to talk to a Lawyer/advocate. You should not hesitate in paying his consultation fee, i.e., it might be in the range of Rs. 10,000 to 50,000, depending on the case. He is helping you in this situation to come out. He is an expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved in 7-10 days.

Applicable Sections of Law

Such crimes are covered under the Information Technology Act, 2000, and the new Bharatiya Nyaya Sanhita, 2023 (BNS). The relevant sections include:

• Section 318 of the Bharatiya Nyaya Sanhita, 2023 (BNS): This section deals with cheating and dishonestly inducing the delivery of property.
• Section 316 of the Bharatiya Nyaya Sanhita, 2023 (BNS): This section addresses cheating by personation.
• Section 66C of the Information Technology Act, 2000: This law penalizes identity theft. Using someone’s password, or other unique identification features without their permission is a punishable offense.
• Section 66D of the Information Technology Act, 2000: This section specifically punishes cheating by personation using a computer resource or a communication device.

If you are the complainant

As the son of the person whose account was hacked (like Rohan), your role is that of the primary complainant. Your responsibility is to coordinate the legal and procedural response.

• Systematically collect all evidence. Create a master document with details of every person who was scammed, the amount they lost, transaction details, and screenshots of their conversations with the scammer.
• You will be the main point of contact for the police. Ensure you have a copy of the FIR or the complaint receipt (CSR).
• Follow up with the investigating officer regularly for updates on the case. Persistence is key in ensuring the police prioritize the investigation.
• Coordinate with the victims (your father’s contacts) and guide them on reporting the fraud to their respective banks.

If you are the victim

If you are one of the contacts who sent money to the scammer, you are a victim of fraud. Here is what you must do:

• Immediately report the fraudulent transaction to your bank, providing the transaction ID and details of the fraud. This is the first step in trying to get the money reversed or the recipient’s account frozen.
• File a complaint on the National Cyber Crime Reporting Portal (cybercrime.gov.in) under the “Financial Fraud” category.
• Share all evidence, including your bank statement showing the debit, screenshots of the chat, and the UPI/bank details of the scammer, with the primary complainant (Rohan) and the police.
• You may be required to give a statement to the police as a witness. Your cooperation is crucial for building a strong case.

How the police behave in such cases

Upon receiving a complaint, the Cyber Crime Cell or the local police station will typically register a First Information Report (FIR) or, in some cases, start a preliminary inquiry. The investigation involves tracing the digital trail left by the criminals. This includes identifying the IP address used to access the WhatsApp account, the location of the phone, and details of the bank accounts or UPI IDs where the money was transferred. Often, scammers use a chain of “mule accounts” to layer the money, making it difficult to trace. Due to the high volume of cybercrimes and the interstate or even international nature of these scams, investigations can be complex and time-consuming. Patience and persistent follow-up are necessary.

FAQs people normally have

Can the stolen money be recovered?
Recovery is possible but challenging. The chances are highest if the fraud is reported to the bank and the cybercrime portal (helpline 1930) within the “golden hour” (the first few hours after the transaction). This allows authorities to act quickly to freeze the funds before the scammer withdraws them.

Is my father legally responsible for the money his contacts lost?
No. Your father is a victim of identity theft. The criminal liability lies entirely with the scammers who perpetrated the fraud. Your father has no legal obligation to repay the money his contacts lost, although he might feel a moral one.

Should each person who sent money file a separate police complaint?
It is highly recommended. While they should cooperate and provide evidence for the main FIR filed by you, filing individual complaints on the cybercrime portal strengthens the overall case. It also creates a record of the fraud for each victim with their respective bank.

What evidence is required?

To build a strong case against the scammers, you need to collect and preserve the following evidence:

• Screenshots of the entire WhatsApp conversation the scammer had with each victim.
• The mobile number of your father’s hacked WhatsApp account.
• The UPI IDs, bank account numbers, or phone numbers to which the money was sent.
• Transaction IDs, dates, and times for all fraudulent transactions.
• A detailed list of all victims, their contact information, and the amount each person lost.
• Any login alerts or emails received from WhatsApp regarding suspicious activity.

How long will the investigation take?

There is no fixed timeline for a cybercrime investigation. The duration depends on several factors: the complexity of the case, the speed of response from banks and telecom service providers in sharing information, and the workload of the investigating agency. Tracing scammers who use sophisticated methods to hide their identity can take anywhere from a few months to over a year. The legal process that follows the investigation can also be lengthy.

Advocate Sudhir Rao, Supreme Court of India