One of my clients recently had a case which I am explaining below and if you are stuck in such similar situation, here is what to do.
Note: Due to attorney-client privilege, I cannot disclose complete case details or identify the actual parties involved. However, I am sharing the essential facts and legal approach so that if you find yourself in a similar situation, you can understand the available solutions and legal remedies.
TL;DR: If someone is threatening and stalking you after a fake Instagram account prank, you can file a criminal complaint for stalking, criminal intimidation, and extortion under the Bharatiya Nyaya Sanhita, 2023. Your mistake of creating the fake account does not justify the other person's threats or doxxing. Report the matter to the local police or cyber crime cell immediately — preserve all emails, screenshots, and coordinate evidence.
A group of college students in Pune — let's call them Arjun, Neha, and Rohan — created a fake Instagram profile of a fictional girl using a random photo from Pinterest. It was meant as a silly prank on their friends. Within weeks, strangers from a neighbouring city started following the account. The group never sent a single message to anyone they didn't know. But then a stranger identified them. Emails started arriving. Full names. A threat: make an apology video or face court. Worse came next. The stranger sent them a photograph — taken from behind — of the three of them inside a multiplex in Koregaon Park. Then came their exact home coordinates. Then their parents' phone numbers. Scared and unsure, they approached the office of Advocate Sudhir Rao. Initial consultations with a general practitioner had gone nowhere — the lawyer had dismissed it as a harmless prank without understanding the magnitude of the threat. But Advocate Sudhir Rao and his office immediately recognised the criminal pattern: doxxing, stalking, and criminal intimidation. They guided the clients to file an FIR at the local cyber crime police station. The specialised handling of evidence preservation and the precise framing of offences under the new BNS led to a swift investigation. Within weeks, the police traced the accused using email headers and Instagram metadata.Key Facts of the Case
- A fake Instagram account was created as a prank; no fraudulent, extortionate, or harassing messages were sent to any stranger.
- A stranger identified the account holders through unknown means and began emailing threats.
- The accused provided the victims' full names, a photograph taken covertly at a movie theatre, home coordinates, and contact numbers of parents.
- The victims did not respond to any of the emails before the deadline set by the accused.
- The victims had preserved all emails, attachments, and communication logs.
- The matter was reported to the Pune Cyber Crime Police under the Bharatiya Nyaya Sanhita, 2023.
- The police investigation was able to trace the accused; the case proceeded to chargesheet.
The Direct Legal Answer
How could he get all this personal information?
It's unfortunately not that hard. Phone numbers, email addresses, and even home coordinates can be obtained through OSINT techniques or from old data breaches. The movie theatre photo suggests the accused physically followed the victims or had an informant. None of this requires "hacking" a phone — it's often just accessing publicly available or leaked data.
Can someone actually track which devices an Instagram account is logged into?
Not without Instagram's cooperation or a court order. Instagram does not publicly disclose device login history to third parties. The accused likely used open-source methods, not real-time tracking. But the threat itself is what matters — and it's illegal.
Could his actions amount to stalking, criminal intimidation, or extortion?
Yes. Under the BNS, stalking includes following or monitoring a person through electronic means in a way that causes fear of violence or serious alarm. Criminal intimidation is threatening injury to reputation or property with intent to cause alarm. If the accused demanded an apology video under threat of court action and doxxing, it falls squarely under these provisions. Extortion may also apply if the demand was coupled with a threat to harm reputation.
Should we report this to the cyber crime authorities, even though creating the fake account was our mistake?
Absolutely. Your mistake does not give someone else the right to stalk, threaten, or dox you. File a complaint at the local cyber crime police station or online at the National Cyber Crime Reporting Portal. Your fake account is a separate issue — one that, in any event, is unlikely to attract criminal liability if no fraud or harassment was committed.
Advice in Such Cases
Don't respond to the threats. Engaging with the accused can escalate the situation and compromise evidence. Let the police handle communication.
Preserve every piece of evidence. Screenshots, email headers (including full message source), chat logs, and any metadata. Do not alter or delete anything.
Report immediately. Cyber stalking cases are time-sensitive. The sooner you file a complaint, the easier it is for police to trace the accused via IP logs and ISP records.
Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation to come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think.
This category of case involves nuanced procedural and evidentiary strategies — preserving digital evidence, understanding jurisdiction for cyber crimes, and framing the FIR correctly. A general practitioner may not be fully familiar with these nuances. Engaging an advocate who regularly handles cyber stalking and criminal intimidation matters typically leads to faster and better outcomes.
Applicable Sections of Law
- Section 351(1) BNS — Stalking: monitoring or following a person through electronic means, causing fear or distress. Punishable with up to three years imprisonment and fine.
- Section 356 BNS — Criminal intimidation: threatening another with injury to reputation or property, with intent to cause alarm. Punishable with up to two years imprisonment, or fine, or both.
- Section 308 BNS — Extortion: putting a person in fear of injury and thereby inducing them to deliver property or valuable security. Punishable with up to three years imprisonment and fine.
- Section 336(3) BNSS — Procedure for investigation of cyber crimes; jurisdiction includes place where the victim resides.
Punishment and Penalties
- Stalking (Section 351 BNS): Up to three years imprisonment and fine for first conviction; up to five years for subsequent conviction.
- Criminal intimidation (Section 356 BNS): Up to two years imprisonment, or fine, or both.
- Extortion (Section 308 BNS): Up to three years imprisonment, or fine, or both.
- All three offences are cognisable (police can arrest without warrant) and bailable in most cases. Stalking is non-compoundable; criminal intimidation and extortion are compoundable with court permission.
Jurisdiction — Where to File the Case
For cyber crimes, jurisdiction lies with the police station where the victim resides, where the accused is located, or where the offence was committed. Under Section 336(3) BNSS, the victim can file a complaint at the local police station regardless of the accused's location. The complaint can also be filed online at the National Cyber Crime Reporting Portal. The matter will then be transferred to the appropriate cyber crime cell.
What if Police Refuse to File FIR?
- First, approach the Superintendent of Police (SP) under Section 173(4) BNSS with a written complaint.
- If still no action, file a private complaint before the Judicial Magistrate under Section 175(3) BNSS.
- The Magistrate can order the police to register an FIR and investigate.
- As a last resort, file a writ petition before the High Court seeking direction to the police to act.
Rights of the Accused
- Right to remain silent and against self-incrimination under Article 20(3) of the Constitution.
- Right to legal representation under Article 22(1).
- Right to be produced before a Magistrate within 24 hours of arrest under Article 22(2).
- Right to a copy of the FIR and to know the grounds of arrest.
Bail Provisions
Stalking, criminal intimidation, and extortion are bailable offences under the BNSS. The accused can apply for regular bail under Section 480 BNSS before the Magistrate or Sessions Court. Anticipatory bail under Section 482 BNSS may also be available if the accused fears arrest. Bail is typically granted on personal bond and surety, but may include conditions such as not contacting the victim or tampering with evidence.
Quashing of FIR / Case
If the FIR is frivolous, malicious, or does not disclose any offence, the accused can approach the High Court under Section 528 BNSS for quashing. Grounds include: no prima facie case, abuse of process of court, or the matter being purely civil in nature. However, in stalking and threat cases involving clear evidence, quashing is rarely granted. The High Court may also quash if the parties reach a settlement in compoundable offences.
If You Are the Victim
- Do not delete any emails, messages, or screenshots — preserve the original source data.
- Do not engage with the accused or respond to threats.
- File a complaint at the local police station or online at cybercrime.gov.in.
- Share all evidence with your lawyer and the investigating officer.
- Consider changing your social media privacy settings and passwords immediately.
Documents You Must Keep Ready
- Identity proof (Aadhaar, PAN, or driving licence).
- All threatening emails — with full message headers (not just screenshots).
- Any photographs or screenshots sent by the accused.
- Details of the fake Instagram account — username, creation date, posts, and any follower information.
- Your own communication logs showing you did not initiate contact with strangers.
- Mobile phone records, if the accused contacted you via phone.
What Evidence Is Required?
- Email headers (including IP addresses, timestamps, and routing info) — these are primary evidence.
- Screenshots of the threatening emails and any attachments.
- Proof of the fake Instagram account and its content (to show no fraud or extortion was involved).
- Any evidence of doxxing — home coordinates, contact numbers, photographs.
- Witness statements from anyone who saw the threats or was present when the accused contacted the victims.
- Forensic analysis of the accused's devices (obtained through police investigation).
How the Police Behave in Such Cases
Cyber crime cells in major cities like Pune are increasingly sensitised to online stalking and doxxing cases. Police will typically register an FIR, collect electronic evidence, and send a request to the platform (Instagram) for user data. Investigation can take a few weeks to a few months. However, smaller police stations may lack expertise — so filing directly with the cyber crime cell or via the national portal is recommended. If the police are unresponsive, follow the escalation steps outlined earlier.
Timeline of Legal Process
- Day 1-30: FIR registered, investigation begins, evidence collection (emails, IP logs, Instagram data).
- 1-3 months: Arrest of accused (if warranted) and filing of chargesheet.
- 3-6 months: Cognizance by Magistrate, framing of charges.
- 6-12 months: Trial — recording of prosecution and defence evidence.
- 12-18 months: Final arguments and judgment.
- Appeals: Typically take 6-12 months at Sessions or High Court level.
Actual duration varies greatly based on court workload, complexity, and whether the accused contests the case.
How Long Will the Investigation Take?
Police typically complete investigation and file a chargesheet within 60 to 90 days from the date of FIR. If the accused is in custody, the chargesheet must be filed within 60 days for bailable offences and 90 days for non-bailable offences. In cyber crime cases, delays can occur if forensic analysis of devices or server logs takes longer.
Understanding the Costs
The total cost of a matter like this varies significantly from one case to the next — it depends on the complexity of the dispute, the forum involved, the number of hearings, and the specific facts of your situation. There is no single fixed figure that applies to everyone.
A professional advocate can give you an accurate estimate only after reviewing all your facts and documents in a consultation.
Can the Matter Be Settled Out of Court?
Stalking (Section 351 BNS) is non-compoundable — it cannot be settled privately once a criminal case is filed. However, criminal intimidation and extortion are compoundable with court permission. If the accused is willing to apologise and the victim is agreeable, a compromise can be recorded before the court, and the case may be quashed or the accused discharged. Pre-litigation mediation through Lok Adalat is also an option for minor cases, but serious stalking and doxxing cases are generally pursued through trial.
Common Mistakes People Make
- Deleting the fake Instagram account: This destroys evidence that could prove the account was harmless. Preserve it.
- Responding to the threats: Engaging with the accused can escalate the situation and make evidence harder to use.
- Waiting too long to report: Delay gives the accused time to delete evidence or escalate threats.
- Posting about the case on social media: This can alert the accused and prejudice the investigation.
- Engaging a lawyer who doesn't handle cyber crime or criminal intimidation cases regularly: This type of matter involves nuanced procedural and evidentiary strategies — preserving digital evidence, framing the FIR correctly, and understanding inter-state jurisdiction. A general practitioner may miss critical steps, weakening the case from the start.
FAQs People Normally Have
Can I be arrested for creating the fake Instagram account?
Not unless the account was used to commit fraud, defame someone, or impersonate a real person with intent to cause harm. A simple prank account with no malicious messages rarely attracts criminal liability.
What if the accused is a friend pulling a reverse prank?
That's possible. If you suspect it, share that with the police. Doxxing and stalking by a "friend" are still illegal — and the friend may face the same legal consequences.
Do I need a lawyer to file an FIR?
No, you can file an FIR yourself. But a lawyer ensures the complaint is framed correctly under the right sections, which makes investigation smoother and faster.
Can the police trace the accused from email headers alone?
Often yes. Email headers contain IP addresses and routing information. The police can then approach the ISP to identify the subscriber. It's not instant, but it's very effective in most cases.
Can this case go to court even if we don't want it to?
Yes, if it's a non-compoundable offence like stalking, the case can proceed even if you want to drop it. The court takes cognizance of the offence, not just the victim's wishes.
This article is general legal information, not legal advice. Consult a qualified advocate about your specific situation.
Advocate Sudhir Rao, Supreme Court of India
Facing a similar matter? Speak to a criminal lawyer in Delhi — Advocate Sudhir Rao appears in bail, trial and appellate matters before the Delhi District Courts, the Delhi High Court and the Supreme Court of India.