One of my clients recently had a case which I am explaining below and if you are stuck in such similar situation, here is what to do.
Note: Due to attorney-client privilege, I cannot disclose complete case details or identify the actual parties involved. However, I am sharing the essential facts and legal approach so that if you find yourself in a similar situation, you can understand the available solutions and legal remedies.
TL;DR: You should never share your Aadhaar or PAN card copies with an HR unless you have a formal offer letter or employment contract in hand. Asking for these documents before confirming selection or issuing an offer letter is a red flag under Indian data protection and employment laws. Your safety depends on verifying the company's legitimacy and insisting on proper documentation first.
He applied for a job in Pune, at a company called TechVista Solutions. The interview was in a co-working space in Baner. Next day, the HR, who called himself Rohan Kapoor, asked for scans of Aadhaar, PAN, and salary slips on WhatsApp. Reason? "To get manager approval." No offer letter. No selection confirmation. Nothing. The client felt uneasy. The company website and social media looked fine. But the co-working space address raised doubts. He approached the Chamber of Advocate Sudhir Rao in the same week. Earlier, he had consulted a general lawyer who said "it's probably fine" — but that didn't sit right. Advocate Sudhir Rao and his office dug into the matter. They sent a formal email to TechVista's registered address, demanding a written confirmation of the offer and a data handling policy. The result? The HR stopped responding. The company's domain email bounced back. A follow-up check revealed the company had no physical presence beyond a rented desk in the co-working space. The specialised approach here — focusing on data privacy law and employment fraud indicators — helped the client dodge what could have been a serious identity theft or phishing attempt. And here's the thing: had he sent those documents, his data could have been used for fraudulent loans or telecom connections. Period.Key Facts of the Case
- The interview was conducted via video call for a mid-level manager role at TechVista Solutions, Pune.
- The HR used a personal WhatsApp number, not a company-issued communication channel.
- No offer letter or appointment letter was issued before the document request.
- The company's registered office was a virtual address with a co-working space in Baner.
- The HR claimed documents were needed for "manager approval" — a process that typically requires an offer letter first.
- Advocate Sudhir Rao's office identified the company's domain was registered only 45 days prior to the interview.
- The client avoided sharing any documents, preventing potential misuse of identity.
The Direct Legal Answer
Under Indian law, specifically the Digital Personal Data Protection Act, 2023, personal data like Aadhaar and PAN cannot be collected without a clear, lawful purpose. As a job applicant, you have the right to know why such data is needed and how it will be used. The company must also have a privacy policy in place.
Is it safe to share Aadhaar and PAN via WhatsApp?
No. WhatsApp is not a secure channel for sensitive identity documents. Unauthorised access or interception can lead to identity theft, financial fraud, or misuse for opening bank accounts or availing loans.
Can a company ask for these documents before offering a job?
Generally, no. Pre-offer document collection is unusual and often unnecessary. Legitimate employers request these only after a formal offer is accepted and employment is confirmed. The HR's demand for "manager approval" without an offer letter is a serious warning sign.
What should you do if asked?
Politely decline. Ask for a formal offer letter first. Verify the company's registered address, GST number, and director details on the Ministry of Corporate Affairs (MCA) portal. If it's a genuine company, they will comply.
Advice in Such Cases
First, trust your gut. If something feels off, it probably is. The Co-working space setup isn't automatically a scam — many startups operate from them — but combined with the WhatsApp request and no offer, it's suspicious.
Consult with Lawyer: The very basic and important step to start is talk to lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation to come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think.
Next, send a formal email to the company's official HR address (not personal) asking for a written confirmation of selection and the purpose of document collection. If they refuse or evade, you are dealing with a potential fraud. This type of matter — employment fraud and data misuse — requires advocates with domain-specific experience in cyber law and employment disputes. A general practitioner may overlook critical procedural steps like filing a complaint with the cyber cell or approaching the data protection authority.
Applicable Sections of Law
Under the Digital Personal Data Protection Act, 2023, consent must be "free, specific, informed, unconditional, and unambiguous" for processing personal data. The Information Technology Act, 2000, under Section 43 and 66, penalises unauthorised access to computer systems and data theft. For identity fraud, the Bharatiya Nyaya Sanhita (BNS), 2023, applies: Section 318 (cheating) and Section 319 (cheating by personation) are directly relevant. Section 66B of the IT Act also covers dishonestly receiving stolen computer resources. These laws collectively criminalise the collection and misuse of your identity documents without a lawful purpose.
Punishment and Penalties
For cheating under Section 318 BNS, punishment can extend to imprisonment of up to 7 years and fine, depending on the gravity. Cheating by personation under Section 319 BNS carries a similar penalty — imprisonment up to 3 years or fine or both. Under Section 43 of the IT Act, compensation up to ₹5 crore can be claimed for unauthorised data access. The Digital Personal Data Protection Act, 2023, imposes penalties up to ₹250 crore for significant data breaches. These offences are cognisable and non-bailable in many cases, meaning the police can arrest without warrant and bail is not automatic.
Jurisdiction — Where to File the Case
For cyber fraud related to identity document misuse, you can file a complaint at the nearest cyber crime police station or the local police station where you received the WhatsApp message. Under Section 175(3) of the Bharatiya Nagarik Suraksha Sanhita (BNSS), 2023, if the police refuse to register an FIR, you can approach the Magistrate directly. For civil remedies, the District Court or High Court in your city has jurisdiction based on where the fraud occurred or where you reside. Jurisdiction matters because filing in the wrong court wastes time and money — a domain-specific advocate can guide you correctly.
What if Police Refuse to File FIR?
If the local police station refuses to register your complaint:
- Approach the Superintendent of Police (SP) under Section 173(4) BNSS for a direction to register FIR.
- File a private complaint before the Magistrate under Section 175(3) BNSS, who can order the police to investigate.
- As a last resort, file a writ petition in the High Court under Article 226 of the Constitution for a direction to the police to act.
- Keep all evidence — screenshots, call recordings, emails, and WhatsApp chats — ready to prove the HR's demand.
Rights of the Accused
If you are accused of fraud in such a situation (unlikely, but possible in cross-complaints), remember:
- You have the right to remain silent under Article 20(3) of the Constitution — you cannot be compelled to be a witness against yourself.
- Right to legal representation under Article 22 — you can demand a lawyer before any questioning.
- Right to be produced before a Magistrate within 24 hours of arrest under BNSS.
- Right to a copy of the FIR and to know the grounds of arrest promptly.
- Right to apply for bail and to not be detained unnecessarily.
Bail Provisions
For offences under Section 318 BNS (cheating), the offence is generally bailable unless the amount involved is significant or it is part of organised fraud. Anticipatory bail under Section 482 BNSS can be sought if you anticipate arrest and have a legitimate defence. Regular bail under Section 480 or 483 BNSS can be applied before the Magistrate or Sessions Court. Bail conditions often include furnishing a surety, surrendering passport, and appearing before the investigating officer as required. Strategy matters: applying for anticipatory bail early can prevent arrest and reduce harassment.
Quashing of FIR / Case
If an FIR is filed falsely against you (e.g., if the company retaliates), you can move the High Court under Section 528 BNSS (inherent powers) to quash the FIR. Grounds include: no prima facie offence, the FIR is an abuse of process of law, or the matter has been settled. For example, if the document request was made after an offer letter, the case may lack criminal intent. Quashing is a viable strategy when the allegations are purely contractual or lack dishonest intent.
If You Are the Victim
- Do not share any documents until you have a written offer letter and employment contract.
- File a complaint with the cyber crime portal (cybercrime.gov.in) or your local police station.
- Block and report the WhatsApp number as spam.
- Monitor your credit report and bank accounts for unauthorised activity.
- Inform your current employer if you suspect data compromise.
Documents You Must Keep Ready
- Copy of the interview call or email communication.
- Screenshots of WhatsApp chats showing the HR's request.
- Company's name, website URL, and any registration number you can find.
- Your own identity proof (Aadhaar, PAN) — but don't share them unless necessary.
- Any salary slips or bank statements you were asked to provide.
- Email correspondence with the company's official domain.
- Details of the co-working space or address provided.
What Evidence Is Required?
- Primary evidence: WhatsApp messages, call recordings (with consent where required by law), and emails showing the demand for documents.
- Secondary evidence: Screenshots of the company's website and social media profiles.
- Documentation of the company's MCA registration status (use the MCA portal to check directors and address).
- Bank statement or credit report showing any suspicious activity after the incident.
- A complaint diary entry from the police station if you approached them.
How the Police Behave in Such Cases
Police often treat pre-employment fraud as a civil matter initially — they may ask you to try settling with the company first. But if identity theft or financial fraud is evident, they will register an FIR under the IT Act and BNS. The attitude varies: some cyber cells are proactive, others need a push from the Magistrate or higher court. Having a lawyer's representation at the time of filing speeds things up significantly. The police may also refer you to the cyber crime portal for online complaints.
Timeline of Legal Process
- Complaint Filing: 1-2 days for cyber portal or 1-2 weeks for police FIR if resistance occurs.
- Investigation: 30-60 days for basic enquiries; longer if forensic analysis of devices is needed.
- Chargesheet Filing: 60-90 days from FIR registration if evidence is clear.
- Cognizance and Framing of Charges: 2-4 months after chargesheet.
- Trial: 6-12 months in Magistrate court for simpler cases; can extend if multiple accused.
- Judgment: Usually within 12-18 months from filing of chargesheet.
- Appeal: 6-12 months in Sessions Court or High Court.
How Long Will the Investigation Take?
Investigation in cyber fraud cases typically takes 30 to 60 days if the accused is identified. The police will verify the WhatsApp number, trace the IP address, and check the company's registration. Delay occurs if the accused uses fake identities or operates from outside India. A chargesheet must be filed within 60 days if the accused is in custody, or 90 days otherwise, failing which the accused can claim default bail.
Understanding the Costs
The total cost of a matter like this varies significantly from one case to the next — it depends on the complexity of the dispute, the forum involved, the number of hearings, and the specific facts of your situation. There is no single fixed figure that applies to everyone.
A professional advocate can give you an accurate estimate only after reviewing all your facts and documents in a consultation.
Can the Matter Be Settled Out of Court?
Yes, in many pre-employment fraud cases, settlement is possible — but only if no actual identity theft or financial loss occurred. If the HR merely asked for documents but no misuse happened, a formal apology or cautionary notice from a lawyer's office may suffice. Criminal cases for cheating (Section 318 BNS) are compoundable only with the court's permission. Mediation or Lok Adalat can be used to resolve disputes without a full trial. Settlement is advisable if you want to avoid lengthy court proceedings and the accused is willing to retract. However, if documents were misused, pursue the full legal route.
Common Mistakes People Make
- Sharing sensitive documents without a written offer letter or employment contract.
- Believing that a legitimate-looking website and social media guarantee the company's authenticity.
- Ignoring red flags like personal WhatsApp communication instead of official email.
- Engaging a general practitioner without domain-specific experience in cyber law or employment fraud — these cases involve nuanced procedural and evidentiary strategies that a non-specialist may mishandle, delaying resolution.
- Not checking the company's registration on the MCA portal before sharing documents.
- Posting about the experience on social media before taking legal advice, which can prejudice investigations.
FAQs People Normally Have
Can I report the HR for harassment?
Yes, if the HR persists after you decline, it can be reported as harassment. File a complaint with the cyber crime portal and mention the repeated demands.
What if the company is real but the HR is a fake?
That is a common scam. The company's name and reputation are used by fraudsters. Verify the HR's identity through the company's official contact number or email.
Will sharing my Aadhaar with them allow loan fraud?
Yes, Aadhaar and PAN together can be used to apply for instant loans or open bank accounts. That is why you must never share them without a formal employment relationship.
Can I sue the company if my data is misused?
Absolutely. You can file a civil suit for damages under the Digital Personal Data Protection Act, 2023, and a criminal complaint for cheating and identity theft.
How long do I have to act if I already shared the documents?
Act immediately. Freeze your credit report with all credit bureaus (CIBIL, Experian, Equifax, CRIF). File a police complaint and monitor your bank accounts. Every day counts.
This article is general legal information, not legal advice. Consult a qualified advocate about your specific situation.
Advocate Sudhir Rao, Supreme Court of India
Facing a similar matter? Speak to a Delhi criminal defence lawyer — Advocate Sudhir Rao appears in bail, trial and appellate matters before the Delhi District Courts, the Delhi High Court and the Supreme Court of India.