One of my clients recently had a case which I am explaining below and if you are stuck in such similar situation, here is what to do.
Note: Due to attorney-client privilege, I cannot disclose complete case details or identify the actual parties involved. However, I am sharing the essential facts and legal approach so that if you find yourself in a similar situation, you can understand the available solutions and legal remedies.
Around 18 March 2025, a young professional from Indore named Rohan Gupta received a deeply disturbing WhatsApp message from an unknown international number. The message was formatted like an advertisement offering illegal sexual services, but what made it far worse was that it used the name of his close friend, Kavita Reddy, a software engineer at Infosys's Pune campus. The message also listed her personal mobile number, the contact numbers of two of her family members, and several of her friends. To top it all, the message included a line reading "loan amount = Rs. 4,500," a clear attempt to suggest a debt-based coercion angle and damage her reputation entirely.
Kavita had no idea this was happening. Rohan immediately tried reporting the number through WhatsApp's in-app tools and sent a complaint to the local Indore cyber cell on his own. For nearly ten days, he received no substantive response. That's when both Rohan and Kavita approached Advocate Sudhir Rao. The matter was recognised immediately as a criminal cybercrime offence involving identity misuse, defamation, and possible extortion. A structured complaint was filed before the cybercrime portal and simultaneously before the jurisdictional police, backed by preserved screenshots, device metadata, and a formal legal notice to the platform. Kavita was also counselled to alert her contacts proactively to prevent further spread. The coordinated approach led to the message being flagged and the number reported for cross-border investigation through proper channels. The situation was contained, and Kavita's reputation among her professional and personal circle remained protected.
Advice in Such Cases
Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation to come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think.
Preserve Everything Immediately: Don't delete the message. Take screenshots of the full conversation, note the sender's number, and save any associated media. This is your primary evidence and losing it early can seriously weaken the case.
Warn the People Named in the Message: Contact the person whose name and number appear in the message right away. They need to be aware so they can protect themselves from further harassment or calls from strangers who may have received the same content.
File a Cybercrime Complaint Without Delay: Report the matter at cybercrime.gov.in under the "Report Cyber Crime" portal. This is the prescribed national mechanism and creates a formal record. A written complaint to the local police cyber cell should follow.
And here's the thing — cases involving misuse of personal identity through digital platforms carry specific procedural requirements, evidentiary timelines, and platform-coordination steps that general practitioners may not be fully familiar with. Engaging an advocate who regularly handles cybercrime and online defamation matters tends to produce faster and more effective results. Don't assume any lawyer will do.
Applicable Sections of Law
- Section 356 BNS (Defamation): Publishing or circulating content that harms the reputation of a named individual, including through digital means, is punishable under this provision.
- Section 308 BNS (Extortion): Where the message implies coercion linked to a "loan amount," there is a clear extortion angle that this section addresses.
- Section 67 of the Information Technology Act, 2000: Publishing or transmitting obscene material in electronic form is an offence with serious consequences.
- Section 66C and 66D of the Information Technology Act, 2000: Identity theft and cheating by personation using computer resources are directly applicable where a real person's name and contact details are misused in digital communications.
Punishment and Penalties
- Section 356 BNS (Defamation): Simple imprisonment up to two years, or fine, or both. Non-cognizable and bailable.
- Section 308 BNS (Extortion): Imprisonment up to three years, or fine, or both. Cognizable and non-bailable.
- Section 67 IT Act: First conviction — imprisonment up to three years and fine up to Rs. 5 lakh. Subsequent conviction — imprisonment up to five years and fine up to Rs. 10 lakh. Cognizable.
- Section 66C IT Act (Identity Theft): Imprisonment up to three years and fine up to Rs. 1 lakh. Cognizable and non-bailable.
- Section 66D IT Act (Cheating by Personation): Imprisonment up to three years and fine up to Rs. 1 lakh. Cognizable.
Jurisdiction — Where to File the Case
Jurisdiction trips people up more than it should. Cybercrime complaints can be filed at any cybercrime police station in India regardless of where the victim resides, as provided under Section 175 BNSS and the IT Act framework. Territorial jurisdiction ordinarily lies with the police station in the area where the victim received the message or where the harm occurred. So if the victim is in Pune, the Pune Cyber Crime Cell has jurisdiction. For Section 356 BNS (defamation), a Judicial Magistrate of the First Class in the victim's city has competence to take cognizance. Frankly, filing in the wrong forum can lead to delays and procedural objections from the other side — something that's entirely avoidable with proper legal guidance upfront.
What if Police Refuse to File FIR?
- Submit a written complaint to the Superintendent of Police of the district under Section 173(4) BNSS, requesting that the FIR be registered.
- File a private complaint directly before the Judicial Magistrate under Section 175(3) BNSS. The Magistrate can direct the police to investigate and register the FIR.
- Approach the High Court by filing a writ petition under Article 226 of the Constitution if neither of the above produces a result. Courts have consistently directed registration of FIRs in cybercrime cases, as held in Lalita Kumari v. Government of UP, 2014.
- Keep copies of all complaint receipts, acknowledgements, and correspondence with the police — these become critical if you escalate to higher authorities or the court.
Rights of the Accused
- Right Against Self-Incrimination: Under Article 20(3) of the Constitution, no person accused of an offence can be compelled to be a witness against themselves.
- Right to Legal Representation: Article 22 of the Constitution guarantees the right to consult and be defended by a legal practitioner of one's choice.
- Right to be Produced Before a Magistrate Within 24 Hours: Under Section 57 BNSS, any person arrested must be produced before the nearest Magistrate within 24 hours of arrest.
- Right to Know Grounds of Arrest: Section 47 BNSS mandates that the arresting officer communicate the grounds of arrest to the accused.
- Right to a Copy of the FIR: The accused is entitled to receive a free copy of the FIR, as affirmed in Youth Bar Association of India v. Union of India, 2016.
Bail Provisions
Bail here isn't straightforward. The bailable or non-bailable nature of the offence varies by section. Section 66C of the IT Act is non-bailable, making bail a matter of court discretion. For non-bailable offences, the accused may apply for anticipatory bail under Section 482 BNSS if arrest is apprehended, or regular bail under Section 480 BNSS after arrest. Section 483 BNSS governs bail in cases triable by Magistrates. Bail conditions typically include surrender of passport, periodic reporting to the police station, and a prohibition on contacting the complainant. Where the offence is purely under Section 356 BNS, it is bailable and the accused can claim bail as a matter of right.
Quashing of FIR / Case
A person against whom an FIR is registered may approach the High Court under Section 528 BNSS, which preserves inherent powers to quash proceedings. Grounds typically include absence of prima facie case, abuse of legal process, or a genuine settlement between parties for compoundable offences. In cybercrime cases involving defamation under Section 356 BNS (which is compoundable with the permission of the court), a compromise between the victim and the accused can support a quashing petition. But quashing is not automatic. Make no mistake, the Supreme Court in State of Haryana v. Bhajan Lal, 1992 laid down the categories where quashing is appropriate, and courts apply those tests carefully in cybercrime matters.
If You Are the Victim
- Screenshot the full message immediately, including the sender's number and timestamp. Do not delete the chat thread.
- Report the number on WhatsApp using the in-app "Report" function, but do not rely on this alone as a legal remedy.
- File a complaint at cybercrime.gov.in under "Report Other Cyber Crimes" and obtain an acknowledgement number.
- Personally inform the individual whose name and contact details appear in the message so they can take protective steps and gather their own evidence.
- Approach an advocate experienced in cybercrime matters to file a formal complaint before the police cyber cell and, if necessary, before the Magistrate's court.
Documents You Must Keep Ready
- Aadhaar card and PAN card of the complainant for identity verification
- Full screenshots of the WhatsApp message, including the sender's number and profile details
- Screenshot of the time, date, and platform of receipt
- List of persons whose names and contact details appear in the message, with their written statements if possible
- Any prior communications from the same number, if any exist
- Proof of complaint submission to the cybercrime portal (acknowledgement or reference number)
- Any forwarded copies of the message received by other contacts, which demonstrate the spread of the content
- Device details (mobile make, model, and phone number on which the message was received)
What Evidence Is Required?
- Primary Digital Evidence: The original WhatsApp message with metadata intact — do not forward it to multiple people, as this may alter the chain of custody.
- Certified copy / printout: A printout of the message certified under Section 63 of the Indian Evidence Act (now Section 61 of the Bharatiya Sakshya Adhiniyam, 2023) for admissibility in court.
- Witness statements: Statements of persons who received the same message, confirming its spread and content.
- Telecom or platform records: Call detail records or WhatsApp delivery logs obtained through legal process can prove circulation.
- Expert report: A forensic expert's analysis of the message source may be required to trace the originating device or number.
- Affidavit of the victim: A sworn statement from the person named in the message, detailing the harm to reputation and personal distress caused.
How the Police Behave in Such Cases
Cybercrime units in major cities like Pune or Bengaluru are better equipped than smaller district cyber cells, but response times vary considerably. Police often ask for a written complaint first before registering an FIR, particularly where the accused is overseas or the number is international. Now, before you act, be prepared for this: don't be surprised if the initial officer suggests "just blocking the number." That is not an adequate response. Persistent follow-up, combined with a formal legal complaint drafted by a lawyer, tends to shift the tone. International number tracing requires coordination with CERT-In and sometimes Interpol, which adds procedural layers that police may not initiate without pressure.
Timeline of Legal Process
- Week 1-2: Filing complaint on the cybercrime portal and at the local cyber cell. Preserving evidence and issuing a legal notice to the platform.
- Week 2-4: Police registers FIR (if satisfied with material) or private complaint filed before Magistrate.
- Month 1-3: Investigation begins. Cyber cell may seek call records, platform data, and device forensics through formal requests.
- Month 3-6: Chargesheet filed before Magistrate's court if accused is traced and sufficient evidence gathered.
- Month 6-12: Court takes cognizance, summons issued, framing of charges.
- Year 1-3: Trial proceedings, examination of witnesses, arguments.
- Year 2-4: Judgment delivered, followed by appeal if required.
How Long Will the Investigation Take?
Where the accused is within India, a chargesheet is typically expected within 60 to 90 days of arrest under BNSS timelines. Where the number is international, as is common in such scam messages, investigation can extend to six months or longer due to cross-border coordination requirements. Regular follow-up with the investigating officer is necessary to keep the matter moving. Platform data requests can take four to twelve weeks depending on the platform's cooperation policy.
Understanding the Costs
The total cost of a matter like this varies significantly from one case to the next — it depends on the complexity of the dispute, the forum involved, the number of hearings, and the specific facts of your situation. There is no single fixed figure that applies to everyone.
A professional advocate can give you an accurate estimate only after reviewing all your facts and documents in a consultation.