Online Extortion by Pimp – Cyber Blackmail Over WhatsApp: What to Do When a Stranger Gets Your Family's Number

One of my clients recently had a case which I am explaining below and if you are stuck in such similar situation, here is what to do.

Note: Due to attorney-client privilege, I cannot disclose complete case details or identify the actual parties involved. However, I am sharing the essential facts and legal approach so that if you find yourself in a similar situation, you can understand the available solutions and legal remedies.

Rohan Gupta, a 26-year-old software professional from Gomti Nagar, Lucknow, was having a rough week in mid-February 2025. Out of curiosity and a moment of poor judgment, he browsed an adult services listing online and sent two WhatsApp messages to a number he found there. He didn't share his name. He didn't send any money at first. But within a day, the person on the other end had somehow obtained his father's mobile number and threatened to expose Rohan unless he paid up. Frightened, Rohan immediately transferred ₹500 via Paytm to make it stop. It didn't stop. The demands escalated.

Rohan had cleared his browser history and deleted the WhatsApp chats, thinking that would help. It didn't. He tried reaching out to a local general practitioner advocate, who suggested waiting it out. That approach cost him two more weeks and considerable mental distress before a colleague referred him to Advocate Sudhir Rao.

The matter required a carefully coordinated approach: a cyber complaint filed with the Lucknow Cyber Crime Police Station under the applicable BNS provisions, a formal request to the National Cyber Crime Reporting Portal (cybercrime.gov.in), and a preservation notice sent to the telecom provider to retain call data records before they cycled out. Because this type of case has very specific evidentiary windows and digital forensic requirements, the specialised handling made a material difference. The extortion calls stopped within three weeks of the complaint being registered, and the extortionist's number was traced and actioned by law enforcement.

Advice in Such Cases

Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation to come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think.

Do not pay any further amount: Stop all payments immediately. Every transfer you make is recorded digitally and, while it confirms the extortion, it also signals to the perpetrator that you'll comply. Paying once almost always leads to repeated demands. Don't.

Preserve all digital evidence right now: Take screenshots of every WhatsApp message, the website URL if still accessible, any payment receipts, and the unknown caller's number. Do this before anything else. Digital evidence degrades or gets deleted quickly, and courts in India have consistently held in cases like Shafhi Mohammad v. State of Himachal Pradesh (2018) that electronic records properly preserved carry significant evidentiary weight.

File on the National Cyber Crime Reporting Portal: Go to cybercrime.gov.in and report the matter immediately. This creates a timestamped record that strengthens any subsequent FIR.

Now, before you act, understand this: this category of matter, sitting at the intersection of cyber law, criminal extortion, and digital evidence procedure, involves nuances that a general practitioner may not be fully familiar with. Advocates who regularly handle cyber crime and extortion matters know which preservation steps to take within the first 48 hours and how to approach the cyber cell for the fastest possible response.

Applicable Sections of Law

This is a criminal matter. The following provisions of the Bharatiya Nyaya Sanhita, 2023 (BNS) and allied statutes apply:

• Section 308 BNS – Extortion: whoever intentionally puts a person in fear of injury and thereby dishonestly induces that person to deliver property. Sending threatening messages to obtain money squarely falls here.
• Section 351 BNS – Criminal intimidation: threatening a person or their family member with injury to compel them to do an act against their will.
• Section 66A read with Section 67 of the Information Technology Act, 2000 – Transmitting obscene or threatening content electronically and using communication devices to cause annoyance, inconvenience, or to extort.
• Section 318(4) BNS – Cheating by impersonation or deception: applicable where the perpetrator posed as a legitimate service provider to obtain the initial payment.

Punishment and Penalties

Frankly, the punishments here are serious. People don't realize that until they're on the wrong end of an arrest.

• Section 308 BNS (Extortion): Imprisonment up to three years, or fine, or both. If extortion is committed by putting a person in fear of death or grievous hurt, imprisonment may extend to ten years with fine.
• Section 351 BNS (Criminal Intimidation): Imprisonment up to two years, or fine, or both. If threat relates to causing death or grievous hurt, up to seven years.
• Section 67 IT Act: First conviction — imprisonment up to three years and fine up to ₹5 lakh; subsequent conviction — imprisonment up to five years and fine up to ₹10 lakh.
• Cognizance: Cognizable and non-bailable under Section 308 BNS. Police can arrest without warrant.
• Compoundable: Not compoundable without court permission.

Jurisdiction — Where to File the Case

For cyber extortion cases, jurisdiction is determined by where the victim received the threatening communication, making the local police station in the victim's city the primary forum. In practice, the Cyber Crime Police Station of the respective district or state handles these matters most effectively. The complaint must also be filed online at cybercrime.gov.in, which routes it to the appropriate state nodal officer. For trial, the competent court is the Chief Judicial Magistrate or Judicial Magistrate First Class having territorial jurisdiction over the area where the offence was received or where the accused is located. And here's the thing — jurisdiction matters enormously, because a complaint filed in the wrong forum can be transferred or delayed, losing critical investigative time.

What if Police Refuse to File FIR?

Refusal to register an FIR in a cognizable offence is itself illegal. The Supreme Court confirmed this in Lalita Kumari v. Government of UP (2014), mandating registration of FIRs in cognizable cases without exception. If the local police decline:

• Submit a written complaint to the Superintendent of Police under Section 173(4) BNSS, requesting direction to register the FIR.
• File a private complaint directly before the Chief Judicial Magistrate under Section 175(3) BNSS, attaching all screenshots and payment proof.
• File a complaint on cybercrime.gov.in simultaneously — this creates a national-level paper trail and often prompts local police action.
• As a last resort, approach the High Court under Article 226 of the Constitution for a writ of mandamus directing the police to register the FIR.

Rights of the Accused

Even if you're summoned or questioned as part of an investigation arising from your own complaint — say, if police take interest in your initial activity — you have rights. Don't forget them.

• Right against self-incrimination under Article 20(3) of the Constitution — you cannot be compelled to be a witness against yourself.
• Right to legal representation under Article 22(1) — you're entitled to consult and be defended by a lawyer of your choice from the moment of arrest.
• Right to be produced before a Magistrate within 24 hours of arrest under Article 22(2) BNSS.
• Right to a copy of the FIR and to be informed of the grounds of arrest before any interrogation commences.
• Right to remain silent during police questioning — statements made to police are not admissible as substantive evidence against the maker.

Bail Provisions

Section 308 BNS (extortion in basic form) is cognizable and non-bailable, meaning the accused can't claim bail as a right at the police station level. Regular bail must be sought before the Magistrate under Section 480 BNSS, or the Sessions Court under Section 483 BNSS. If there's an apprehension of arrest before an FIR is even registered, anticipatory bail under Section 482 BNSS may be obtained from the Sessions Court or High Court. Typical bail conditions in cyber extortion matters include surrendering the device used, not contacting the victim, and reporting periodically to the investigating officer. Bail strategy in these cases should be planned early, ideally before arrest.

Quashing of FIR / Case

If the accused reaches a genuine settlement with the victim, or if the FIR has been filed on incorrect or insufficient facts, the High Court holds inherent powers under Section 528 BNSS to quash the FIR and all consequent proceedings. Grounds for quashing include: the allegations, even if taken at face value, don't constitute a cognizable offence; the FIR is an abuse of process; or in cases where the offence is otherwise compoundable, both parties have reached a settlement. But extortion under Section 308 BNS is not freely compoundable, so quashing via compromise route requires the court's specific satisfaction that it serves the ends of justice — as laid down in State of Madhya Pradesh v. Laxmi Narayan (2019).

If You Are the Victim

Stop. Breathe. Then do these things, in this order.

• Stop responding to the extortionist on WhatsApp or any other platform immediately — any further conversation can be used to manipulate you further.
• Screenshot everything right now: the threatening messages, the phone number, any payment confirmation, and the website or platform where you first found the contact.
• File a report on cybercrime.gov.in without waiting — this is free, available 24/7, and creates an official record with a complaint number.
• Inform your family proactively if the extortionist has their numbers — being transparent removes the extortionist's primary leverage over you.
• Engage an advocate experienced in cyber crime matters before making any further decisions, including whether or not to approach the local police station directly.

Documents You Must Keep Ready

• Aadhaar card and PAN card (identity proof for complaint registration)
• Screenshots of all threatening WhatsApp messages with timestamps visible
• Screenshot or printout of Paytm / UPI transaction showing the payment made to the extortionist
• The mobile number or WhatsApp contact details of the accused
• Any website URL or cached page from where the contact was found (use Google Cache or Wayback Machine if the original is deleted)
• Your own mobile number and telecom provider details (for call data record requests)
• Written timeline of events prepared by you, noting dates and sequence of communications
• Cybercrime.gov.in complaint acknowledgment number, once filed

What Evidence Is Required?

Make no mistake — the strength of your case depends almost entirely on what you preserve in the first 48 hours. Courts won't conjure evidence that you've let disappear.

• WhatsApp chat screenshots: Primary digital evidence. Must show the phone number, message content, and timestamps. Back up to Google Drive or email immediately.
• Payment receipt: Paytm, PhonePe, or bank statement showing the transfer — this is direct proof of extortion having been successful at least once.
• Call records: Your telecom provider's call data records (CDR) showing incoming calls from the accused's number. Your advocate can formally request these through the investigating officer.
• Device forensics: The phone itself can be examined by the Cyber Forensic Lab to recover deleted chats if needed — courts have accepted such evidence in cases like Anvar P.V. v. P.K. Basheer (2014).
• IP address logs: If the contact was via a website, server logs can trace the IP address of the accused.
• Witness statement: If you informed a trusted person contemporaneously, their statement can corroborate the timeline.

How the Police Behave in Such Cases

Make no mistake — cyber crime police stations have improved significantly in major Indian cities, but attitude and efficiency vary. In extortion cases involving adult content platforms, some officers initially treat the victim as partially culpable and may delay registration. The cyber cell is generally more professional than the local police station for these matters. Officers will typically ask for your device for forensic imaging, seek call records from the telecom provider, and may issue a notice to the payment platform (Paytm, PhonePe) for KYC details linked to the recipient account. Following up persistently every 7 to 10 days through your advocate usually keeps the investigation moving.

Timeline of Legal Process

• Day 1-3: File complaint on cybercrime.gov.in and approach the Cyber Crime Police Station with a written complaint and all evidence.
• Week 1-2: FIR registration (if police comply promptly); forensic preservation notice sent to telecom and payment platforms.
• Week 2-8: Police investigation — device seizure, IP tracing, account KYC verification from payment provider.
• Week 8-16: Arrest of accused if traced; remand proceedings before Magistrate.
• Within 60-90 days of arrest: Chargesheet filed before the Magistrate under Section 193 BNSS.
• 3-6 months: Cognizance taken by court; charges framed.

Advocate Sudhir Rao, Supreme Court of India

Facing a similar matter? Speak to a criminal advocate in Delhi — Advocate Sudhir Rao appears in bail, trial and appellate matters before the Delhi District Courts, the Delhi High Court and the Supreme Court of India.