If you are stuck in such a situation, here is what to do.

A few years ago, Mr. Kumar uploaded his father’s PAN and Aadhaar card details to a social media platform’s advertising account for identity verification purposes. Recently, he discovered that the account had been compromised. An unknown individual had gained unauthorized access, created several new ad accounts under his profile, and attempted to run fraudulent advertisements after adding small amounts of funds.

Mr. Kumar took immediate action by changing the account password, enabling two-factor authentication (2FA), removing the hacker’s access, reporting the incident to the platform’s parent company, “ConnectSphere Inc.”, and subsequently deleting the entire social media profile to prevent further misuse. However, he remains deeply concerned about the potential consequences of the data breach. The primary worry is that the hacker might have downloaded and saved his father’s PAN and Aadhaar documents. He is anxious about the possibility of these documents being used for illegal activities, such as creating fake businesses, running large-scale scam campaigns, or fraudulently obtaining loans in his father’s name, which could lead to serious legal complications for his father.

Advice in such cases

If you find yourself in a similar situation, it is crucial to act methodically to mitigate the risks and build a legal safeguard.

• Secure Your Digital Presence: Immediately change the passwords for the compromised account and any associated email accounts. Enable two-factor authentication (2FA) on all important online accounts as an added layer of security.
• Document Everything: Take screenshots of the hacked account, any fraudulent posts or ads, unauthorized account additions, and any communication with the hacker. This digital trail is invaluable evidence.
• Report to the Platform: Formally report the hacking incident to the social media company. Use their official reporting channels. Keep a record of the report confirmation and all subsequent correspondence.
• File a Cyber Crime Complaint: This is a critical step. File a formal complaint on the National Cyber Crime Reporting Portal (www.cybercrime.gov.in) or visit your nearest Cyber Crime police station. This creates an official record of the incident and the date you reported it, which is essential to prove you are a victim and not a perpetrator.
• Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation of come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think.

Applicable Sections of Law

Such incidents involve violations under the Information Technology Act, 2000, and the Bharatiya Nyaya Sanhita, 2023 (BNS).

• Section 66C of the Information Technology Act, 2000: This section specifically deals with punishment for identity theft. Anyone who fraudulently or dishonestly makes use of the electronic signature, password, or any other unique identification feature of any other person shall be punished.
• Section 66D of the Information Technology Act, 2000: This section addresses punishment for cheating by personation by using a computer resource. If the hacker used the identity to deceive others, this section would apply.
• Section 318 of the Bharatiya Nyaya Sanhita, 2023 (BNS): This section defines the offence of cheating. If the compromised documents are used to deceive any person or institution into delivering property or money, the perpetrator can be prosecuted under this section.
• Section 319 of the Bharatiya Nyaya Sanhita, 2023 (BNS): This section deals with cheating by personation. If the hacker pretends to be your father to open a bank account or take a loan, it constitutes a crime under this section.
• Section 335 of the Bharatiya Nyaya Sanhita, 2023 (BNS): This section covers forgery for the purpose of cheating. Creating fake documents or using genuine documents for fraudulent purposes falls under this category.

If you are the complainant

As the person who discovered the hack (like Mr. Kumar), your role is crucial in initiating the legal process.

• Gather and Organize Evidence: Compile all the screenshots, communication records with the platform, and any financial statements showing fraudulent transactions.
• File a Detailed Complaint: When filing a complaint with the cyber police, provide a clear, chronological account of the events. Include all details, such as the date you noticed the hack, the actions you took, and the specific data you believe was compromised.
• Preserve Digital Footprints: Do not delete any emails, messages, or notifications related to the incident until the police have advised you to do so. These are critical pieces of evidence.
• Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation of come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think.

If you are the victim

The person whose identity documents were stolen (like Mr. Kumar’s father) is the primary victim of potential identity theft.

• Proactive Reporting: The most important step is to be named as a victim in the cyber crime complaint. This officially establishes that his identity credentials were compromised without his consent. This FIR or complaint copy serves as a powerful defense against any future liability.
• Monitor Financial Health: Keep a close watch on credit scores (e.g., CIBIL) for any unauthorized credit inquiries or new loans taken out in his name. You can set up alerts for this.
• Inform Financial Institutions: While not always necessary, if there is a high risk, he can preemptively inform his banks about the potential misuse of his identity documents.
• Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation of come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think.

How the police behave in such cases

Upon receiving a complaint, the Cyber Crime police will typically initiate a preliminary inquiry or register a First Information Report (FIR). They will ask for all the evidence you have gathered. The investigating officer may issue a notice under the Bharatiya Nagarik Suraksha Sanhita, 2023 (BNSS) to the social media platform, requesting technical data like IP addresses, login timestamps, and other details of the perpetrator. Investigations can be time-consuming due to the need for cooperation from large tech corporations, which often have servers located outside India. The police will focus on tracing the digital and financial trail left by the hacker.

FAQs people normally have

Can a hacker actually get a loan using just a PAN and Aadhaar?
Yes, unfortunately, it is possible. With the rise of digital lending apps, some have less stringent verification processes. However, having a police complaint on record is your strongest defense to prove that the loan was obtained fraudulently.

Will my father be held legally responsible if his ID is misused?
He will not be held liable if it can be proven that his identity was stolen and used without his knowledge or consent. The cyber crime complaint filed promptly is the most crucial piece of evidence to establish this. It demonstrates that he took immediate steps to report the crime.

Was it a mistake to delete the social media account?
While deleting the account helps prevent further immediate misuse, it is best to do so after taking comprehensive screenshots and documenting all evidence for the police. If you have already deleted it, provide the police with the account’s last known URL or username to aid their investigation.

What evidence is required?

• Screenshots of the hacked profile, fraudulent ad campaigns, and unauthorized changes.
• The URL of the compromised social media profile.
• Copies of all communication with the social media platform’s support team.
• Bank or card statements if any unauthorized financial transactions occurred.
• A copy of the identity documents (PAN, Aadhaar) that were compromised.

How long will the investigation take?

Cybercrime investigations are inherently complex and often slow. Tracing anonymous perpetrators across different jurisdictions can take several months, or even years. The speed of the investigation depends heavily on the digital trail left by the hacker and the level of cooperation received from intermediaries like social media companies and internet service providers.

Advocate Sudhir Rao, Supreme Court of India