Fake Instagram Account Using Real Photos – Legal Remedies in India

One of my clients recently had a case which I am explaining below and if you are stuck in such similar situation, here is what to do.

Note: Due to attorney-client privilege, I cannot disclose complete case details or identify the actual parties involved. However, I am sharing the essential facts and legal approach so that if you find yourself in a similar situation, you can understand the available solutions and legal remedies.

TL;DR: If a fake Instagram account is using your family member's real photos with vulgar content, do not contact the impersonator directly. Preserve all evidence, report the account to Instagram, file a complaint with the cyber crime cell online, and if needed, approach the police to register an FIR under the Bharatiya Nyaya Sanhita (BNS), 2023. A lawyer with experience in cyber crime cases can expedite the process significantly.

A family from Jaipur faced a disturbing situation. Someone created a fake Instagram account using their sister-in-law's real photos. The account posted vulgar, offensive content without her consent. The family discovered this in early March 2025. They immediately took screenshots, recorded URLs, and preserved the evidence.

The impersonator then sent them a phone number via Instagram, asking them to call. The family felt it could be a scam or blackmail attempt. They did not call. Instead, they approached a general lawyer first, but that did not yield results — the lawyer lacked specific expertise in cyber crime procedure.

Then the family approached the office of Advocate Sudhir Rao. Advocate Sudhir Rao and his office assessed the situation. They advised the clients to file a formal cyber crime complaint online and simultaneously approach the local police station to register an FIR under the BNS. The specialised handling helped because the police were initially reluctant. Advocate Sudhir Rao's familiarity with cyber crime protocols helped the family secure the FIR and get Instagram to suspend the fake account within two weeks. The impersonator's actions stopped.

And here's the thing — the family never called that number. That was the right call.

Key Facts of the Case

• A fake Instagram account used real photos of a woman from Jaipur to post vulgar content without consent.
• The impersonator sent a phone number to the family, asking them to call — indicating potential blackmail or financial fraud.
• The family did not contact the impersonator directly, which avoided escalation and preserved evidence.
• An FIR was registered under Section 318 BNS (defamation by electronic means) and related cyber crime provisions.
• The fake account was suspended by Instagram after the police complaint and a formal legal notice to Meta.
• The matter was resolved within approximately two weeks due to early evidence preservation and coordinated police action.

The Direct Legal Answer

Should I contact the impersonator directly?

No. Do not call or message the number they provided. This could be a scam, a phishing attempt, or an attempt to intimidate you. Once you engage, they may use your conversation to blackmail you further. Let the police and platform handle all contact.

What is the best way to get the fake account removed?

First, report the account on Instagram using the in-app reporting feature for impersonation. Then, file a complaint with the cyber crime cell through the national portal (cybercrime.gov.in). Simultaneously, approach your local police station to register an FIR under the BNS. Instagram typically responds faster once a police complaint is shared with them via their law enforcement request system.

Is filing a complaint online enough, or do I need to go to the police station in person?

You should do both. Filing an online complaint creates a record, but an offline FIR at the police station carries more legal weight. For serious cases involving vulgar content, an FIR is essential. Do not skip either step.

Advice in Such Cases

Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation to come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think.

This type of cyber crime case involves nuanced procedural steps — from preserving metadata to drafting the right legal notice to Meta. A general practitioner may miss crucial evidence or procedural deadlines. An advocate who regularly handles cyber crime matters will know exactly what to ask the police for, how to frame the complaint, and how to push for swift platform action.

Also, do not post about the case on social media during the investigation. It can prejudice the police probe and harm the victim's reputation further.

Applicable Sections of Law

Under the Bharatiya Nyaya Sanhita (BNS), 2023, the following sections apply to this case: Section 318 (defamation by words or signs intended to harm reputation, including electronic communication), Section 319 (defamation by publication of imputations), and Section 356 (criminal intimidation by anonymous communication). Under the Information Technology Act, 2000, Section 66E applies for violation of privacy by capturing, publishing, or transmitting images of a private area without consent. Section 67 of the IT Act also applies for publishing obscene content electronically. The procedural handling is governed by the Bharatiya Nagarik Suraksha Sanhita (BNSS), 2023.

Punishment and Penalties

Under Section 318 BNS, defamation is punishable with simple imprisonment up to two years, or fine, or both. Under Section 356 BNS, criminal intimidation can carry imprisonment up to two years, and if the threat involves death or grievous hurt, up to seven years. Under Section 66E of the IT Act, punishment for violation of privacy is imprisonment up to three years, or fine up to Rs. 2 lakh, or both. Under Section 67 of the IT Act, publishing obscene content electronically can attract imprisonment up to three years and fine up to Rs. 5 lakh on first conviction. Most of these offences are cognizable, non-bailable, and non-compoundable.

Jurisdiction — Where to File the Case

For cyber crimes, jurisdiction is flexible. You can file an FIR at the police station where the victim resides, where the content was accessed, or where the impersonator operates. The Supreme Court has held that cyber crime jurisdiction follows the victim's place of residence for convenience. The case will be heard by the Magistrate's court having territorial jurisdiction over the police station where the FIR is registered. For high-value or complex cases, the Sessions Court may also have jurisdiction. It is advisable to file the case in the city where the victim lives to minimise hassle during investigation and trial.

What if Police Refuse to File FIR?

If the police refuse to register your FIR, you have legal remedies:

• Approach the Superintendent of Police (SP) under Section 173(4) BNSS with a written complaint. The SP must either direct the police to register the FIR or conduct a preliminary inquiry.
• If that does not work, file a private complaint before the Magistrate under Section 175(3) BNSS. The Magistrate can order the police to investigate.
• As a last resort, file a writ petition before the High Court for a direction to register an FIR.
• Document every refusal in writing, noting the date, time, and name of the officer who refused.

Rights of the Accused

Even in cyber crime cases, the accused has fundamental rights:

• Right to remain silent and against self-incrimination under Article 20(3) of the Constitution.
• Right to legal representation under Article 22.
• Right to be produced before a Magistrate within 24 hours of arrest.
• Right to receive a copy of the FIR and to know the grounds of arrest.
• Right to seek bail, anticipatory bail, or quashing of FIR if the complaint is malicious.

Bail Provisions

Offences under Sections 318 and 356 BNS are generally non-bailable. However, if the threat is not serious, bail can be applied for. The accused can seek anticipatory bail under Section 482 BNSS before arrest, if they believe the complaint is false. Regular bail under Section 480 BNSS can be filed after arrest. The court considers factors like the nature of the content, the accused's criminal history, and the likelihood of tampering with evidence. In many cyber impersonation cases, courts grant bail on conditions like surrendering the device and not contacting the victim.

Quashing of FIR / Case

The High Court has inherent powers under Section 528 BNSS to quash an FIR if the complaint is frivolous, does not disclose a cognizable offence, or is an abuse of process. Common grounds include settlement between parties (if the offence is compoundable), lack of prima facie evidence, or the complaint being filed with ulterior motives. Quashing is a viable strategy if the impersonation was a prank without malicious intent and the accused apologises. But in serious cases involving vulgar content, courts rarely quash the FIR.

If You Are the Victim

• Do not engage with the impersonator — no calls, no replies, no negotiation.
• Take screenshots of the fake profile, posts, messages, and the sent phone number. Note the profile URL and date/time.
• Report the account on Instagram and also file a complaint on the national cyber crime portal (cybercrime.gov.in).
• Visit your local police station with the evidence and insist on registering an FIR under BNS and IT Act.
• Consult a lawyer who specialises in cyber crime. Domain expertise makes a real difference in how the police and the platform respond.

Documents You Must Keep Ready

• Aadhaar card and PAN card of the victim for identity proof.
• Screenshots of the fake Instagram profile and all vulgar posts (with URLs visible).
• Screenshots of the message from the impersonator containing the phone number.
• Call detail records (if any calls were made or received) and any call recordings (with consent as per law).
• Any correspondence with Instagram (report IDs, email responses).
• A written complaint/affidavit describing the sequence of events.
• Any other digital evidence like emails, WhatsApp chats, or SMS related to the impersonation.

What Evidence Is Required?

• Primary evidence: the fake Instagram account URL, profile picture, and posts — captured as screenshots or screen recordings with date and time stamps.
• Metadata: store the evidence in its original digital format (e.g., PNG, MP4) to preserve timestamps and file properties.
• Witness statements: family members who saw the account or received messages from it can provide affidavit evidence.
• Phone number evidence: the number provided by the impersonator — its call records, SMS logs, or WhatsApp profile (if linked).
• Police complaint copy: the FIR or acknowledgment from the cyber crime portal.
• Instagram's response: any email or ticket ID from Meta confirming the report or suspension action.

How the Police Behave in Such Cases

Police response to cyber crime cases varies. In metropolitan cities, cyber crime cells are generally responsive and understand digital evidence. In smaller towns, officers may be less familiar with procedure. They may ask you to "solve it through Instagram" or refuse to file an FIR. Stand your ground. If an officer refuses, demand a written refusal. Then escalate to the SP or approach a lawyer. In this case, having an advocate with domain expertise helped ensure the police treated the matter seriously and processed the FIR within 24 hours.

Timeline of Legal Process

• Day 1: Preserve evidence, report account on Instagram, file online complaint on cybercrime.gov.in.
• Day 1-3: Visit police station to register FIR under BNS and IT Act. Lawyer can accompany to expedite.
• Day 3-7: Police investigate — may serve notice to Instagram for account details under Section 91 BNSS.
• Day 7-14: Instagram typically suspends the fake account after receiving law enforcement request.
• Week 2-4: Police file chargesheet (if accused is identified) or file closure report (if not traceable).
• Month 1-3: Magistrate takes cognizance and issues summons to accused (if identified).
• Month 3-6: Trial begins — evidence, cross-examination; may conclude in 3-6 months if straightforward.

How Long Will the Investigation Take?

Police investigation in cyber impersonation cases typically takes two to four weeks if the accused is identifiable. If the impersonator used a VPN, fake SIM, or proxy, the police may take longer — up to two months — to obtain subscriber details from Instagram under the IT Act and mutual legal assistance treaties. The investigating officer must file a chargesheet within 60 to 90 days from arrest, otherwise the accused gets default bail.

Understanding the Costs

The total cost of a matter like this varies significantly from one case to the next — it depends on the complexity of the dispute, the forum involved, the number of hearings, and the specific facts of your situation. There is no single fixed figure that applies to everyone.

A professional advocate can give you an accurate estimate only after reviewing all your facts and documents in a consultation.

Can the Matter Be Settled Out of Court?

Cyber impersonation offences under the BNS and IT Act are generally non-compoundable — they cannot be withdrawn by the victim once the court takes cognizance. However, if the accused apologises, removes the content, and compensates the victim, the court may consider a lenient sentence or even discharge in very minor cases. Mediation is possible for certain aspects, like defamation (Section 318 BNS is compoundable with the court's permission). But for serious vulgar content, the state's interest in prosecution overrides private settlement. A Lok Adalat may also attempt resolution if both parties agree.

Common Mistakes People Make

• Contacting the impersonator directly — this can escalate the harassment or lead to blackmail.
• Deleting or ignoring the evidence — preserve everything immediately, including screenshots and URLs.
• Posting about the case on social media before the investigation is complete — this can prejudice the case and hurt the victim's reputation.
• Engaging a lawyer who does not regularly handle cyber crime cases — domain-specific experience matters for evidence handling, police coordination, and platform takedowns.
• Going only to the police without preserving digital evidence first — police may take time to record, and if evidence is lost, the case weakens.
• Not reporting the account on the platform and relying solely on police action — platform takedowns are often faster than police investigation.

FAQs People Normally Have

Can I file a case anonymously?

Not directly. The victim must provide their identity to the police and court. However, the police can redact the victim's name in public records to protect privacy. For vulnerable women victims, in-camera proceedings can be requested under Section 327 CrPC / BNSS.

What if the impersonator is from another country?

If the account creator is abroad, Indian police can still investigate through mutual legal assistance treaties (MLAT). The cyber crime cell can request Instagram to share IP logs and account details, which may help identify the person. Practical success varies.

How long does Instagram take to remove a fake account after a police complaint?

Typically within 3 to 10 business days after the police submit a law enforcement request through their dedicated portal. The platform responds faster to official requests than individual reports. In this case, the account was suspended within two weeks.

Can I claim compensation from the impersonator?

Yes. You can file a civil suit for defamation and violation of privacy seeking damages. The amount depends on the harm caused. A criminal court can also order compensation under Section 357 BNSS upon conviction. For serious mental trauma, a separate civil claim for damages is advisable.

Is a screen recording enough evidence?

Yes, screen recordings showing the fake account, posts, and messages are good evidence. But ensure the recording captures the URL bar and date/time stamp. Store the original file — do not edit or compress it. Also take individual screenshots as backup.

This article is general legal information, not legal advice. Consult a qualified advocate about your specific situation.

Advocate Sudhir Rao, Supreme Court of India

Facing a similar matter? Speak to a criminal advocate in Delhi — Advocate Sudhir Rao appears in bail, trial and appellate matters before the Delhi District Courts, the Delhi High Court and the Supreme Court of India.