If you are stuck in such a situation, here is what to do.

Mr. Rohan Sharma, a resident of Nagpur, recently faced a distressing situation involving his account with the “National Travel & Logistics Corporation” (NTLC), a major online portal for booking train tickets. In early June, he discovered that his registered mobile number and email ID on his NTLC user account had been changed without his knowledge or consent. Understanding the severity of the situation, he immediately contacted NTLC’s customer support. Following their instructions, he filed a formal complaint with the Cyber Crime police and also submitted the complaint details on NTLC’s internal query portal.

To expedite the process, Mr. Sharma also lodged a grievance on the Central Public Grievance Redressal System (CPGRS), requesting the delinking of his National Identity Number (NIN) from the compromised account. Finally, about three weeks later, NTLC confirmed that they had deactivated the hacked user ID. However, Mr. Sharma’s troubles were far from over. When he attempted to create a new account, the system displayed an error message stating that his NIN was already linked to another account. The NTLC customer service team informed him that they were unable to resolve this issue. To his dismay, the grievance on the CPGRS portal was also closed without any meaningful resolution or feedback, leaving him in a lurch and unable to access essential services.

Advice in such cases

• Immediately gather all records of communication with the company and the police. This includes complaint numbers, emails, and screenshots.
• Send a formal Legal Notice to the company through a lawyer. This notice should detail the entire sequence of events, the deficiency in their service, the mental agony caused, and demand the immediate delinking of your NIN and compensation for the harassment.
• If the company fails to respond satisfactorily to the Legal Notice, you can file a complaint before the appropriate Consumer Dispute Redressal Commission for deficiency in service and unfair trade practice.
• Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation of come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think.

Applicable Sections of Law

Several laws are applicable in such a scenario, providing a framework for seeking justice.

• The Information Technology Act, 2000: This is the primary legislation dealing with cybercrime and electronic commerce.
  • Section 43: Provides for penalties and compensation for damage to a computer or computer system, which includes unauthorized access.
  • Section 66: Pertains to computer-related offences, commonly known as hacking.
  • Section 66C: Specifically deals with punishment for identity theft, which is what has occurred when the hacker used your credentials.
• The Bharatiya Nyaya Sanhita, 2023 (BNS): This new penal code has provisions that can be invoked.
  • Section 316 (Cheating by personation): Applicable if the hacker impersonated you to gain access or make changes.
  • Section 318 (Cheating and dishonestly inducing delivery of property): This can be applied as the hacker cheated to gain control of your digital property (the account).
• The Consumer Protection Act, 2019: The company’s failure to resolve the NIN linking issue after deactivating the old account amounts to a “deficiency in service,” for which you can seek relief and compensation.

If you are the complainant

As the person who has been wronged and is pursuing the case, you must be proactive.

• Document Everything: Keep a meticulous record of every action taken. Note down dates, times, names of executives you spoke with, and reference numbers for all complaints.
• Preserve Evidence: Save all emails, screenshots of the account status, error messages, and copies of complaints filed on various portals.
• Follow Up Persistently: Regularly follow up on your cyber crime complaint with the local police station or cyber cell. Similarly, do not let the company off the hook.
• Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation of come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think.

If you are the victim

As a victim of cybercrime, your immediate actions are crucial.

• Act Swiftly: The moment you notice any suspicious activity, report it to the company and the National Cyber Crime Reporting Portal (cybercrime.gov.in) or the nearest police station.
• Secure Other Accounts: If you use similar passwords for other online accounts, change them immediately to prevent further breaches.
• Inform Financial Institutions: If any financial information was linked to the hacked account, inform your bank or credit card company as a precautionary measure.
• Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation of come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think.

How the police behave in such cases

Upon receiving a cybercrime complaint, the police, typically through their specialized Cyber Crime Cell, will register a Zero FIR or a formal complaint. The investigation involves technical analysis. They will issue a notice under the Bharatiya Nagarik Suraksha Sanhita, 2023 (BNSS) to the intermediary (in this case, NTLC) to provide logs, IP addresses, and other details of the compromised account and the alleged perpetrator. However, investigations can be time-consuming due to the technical expertise required, the sheer volume of cases, and the challenge of tracing anonymous digital footprints.

FAQs people normally have

• Can I sue the company for this mess?
  Yes. You can file a case in the Consumer Commission for deficiency in service. The company has a duty of care to its customers, and their inability to resolve the NIN linking issue after the hack can be legally challenged.
• What if the hacker cannot be traced? Can I still get relief?
  Yes. Your relief against the company is separate from the criminal case against the hacker. Your case in the Consumer Commission is against the company for their service failure, regardless of whether the police catch the hacker.
• Will I have to go to court repeatedly?
  For a consumer case, the procedure is relatively simpler than traditional civil courts. With a good lawyer, your personal appearances can be minimized. For the criminal case, your cooperation will be required by the police during the investigation.

What evidence is required?

To build a strong case, you will need the following evidence:

• Proof of account ownership (e.g., old booking tickets, registration confirmation email).
• Screenshots or emails showing the unauthorized changes to your mobile number and email ID.
• A complete record of all communications with the company’s customer support, including ticket/reference numbers.
• A copy of the complaint filed with the Cyber Crime police.
• A copy of the grievance filed on the CPGRS portal and their response (or lack thereof).
• Screenshots of the error message showing your NIN is already linked when you try to create a new account.

How long will the investigation take?

The timeline for both the police investigation and the consumer case can vary significantly. A police investigation into hacking can take several months to over a year, depending on the complexity of tracing the digital trail. A consumer case is generally faster and is mandated to be decided within a specific timeframe, but delays can occur. However, sending a strong Legal Notice often prompts companies to resolve the issue quickly to avoid litigation.

Advocate Sudhir Rao, Supreme Court of India