If you are stuck in such a situation, here is what to do.

Mr. Alok Sharma, a resident of Bhopal, was going about his day when he received a perplexing text message. It appeared to be from a well-known private bank, let’s call it ‘Prestige Bank’. The message read: “Attention! To assist you in easily repaying your Prestige Bank Credit Card A/c ending in ‘XXXX’, our Vendor Partner, ‘Apex Digital Recovery’, will contact you. For details, click [a suspicious link]. To pay now, click [another suspicious link] – Prestige Bank.” Mr. Sharma was immediately concerned because he only held one credit card from a different entity, ‘Prime Shopping Bank’, and had never applied for or owned a card from Prestige Bank. He was worried this could be a scam, a case of mistaken identity, or worse, identity theft where a card had been opened in his name without his knowledge.

Advice in such cases

Receiving such a message can be alarming. It’s crucial to act calmly and methodically to protect yourself from potential financial fraud or identity theft.

• Do Not Click Any Links: The links provided in the SMS are likely phishing attempts designed to steal your personal and financial information. Clicking them could install malware on your device or lead you to a fake website.
• Do Not Reply or Call Back: Do not respond to the message or call any number provided in the SMS. Scammers use these tactics to confirm that your phone number is active.
• Verify Independently: If you want to check if the message is legitimate, contact the bank mentioned (Prestige Bank in this case) using their official, publicly listed customer care number from their official website or the back of an official bank document. Do not use the contact details from the suspicious SMS.
• Check Your Credit Report: Immediately obtain your credit report from an authorized credit bureau (like CIBIL, Experian, etc.). This report will list all credit accounts and loans in your name. Check for any accounts or cards you do not recognize.
• Inform Your Own Bank: It is a good practice to inform your own bank about the suspicious message, especially if you have an account with the bank mentioned in the SMS.
• Preserve Evidence: Take a clear screenshot of the text message, including the sender’s ID and the full content. This will be crucial evidence if you need to file a complaint.

Applicable Sections of Law

Such incidents may fall under various provisions of Indian law, particularly concerning cheating, fraud, and cybercrime. With the implementation of the new criminal laws, the following sections are relevant:

• Section 318 of the Bharatiya Nyaya Sanhita, 2023 (BNS): This section deals with “Cheating.” If the message is a scam to dishonestly induce you into paying money or parting with property, it constitutes cheating.
• Section 319 of the Bharatiya Nyaya Sanhita, 2023 (BNS): This section covers “Cheating by personation.” If someone has opened a credit card in your name, they are impersonating you to cheat the bank, and you are a victim of identity theft. The sender of the SMS is also impersonating the bank.
• Information Technology Act, 2000: Sections 66C (punishment for identity theft) and 66D (punishment for cheating by personation by using computer resource) are directly applicable to such cybercrimes.

If you are the complainant

If you, like Mr. Sharma, have received such a message and want to take legal action, you are the complainant. Here are the steps to follow:

• File a Complaint on the National Cyber Crime Reporting Portal: The first step is to file a formal complaint online at www.cybercrime.gov.in. Provide all the details, including the screenshot of the message.
• File a Police Complaint: You can also approach the Cyber Crime Cell of the police in your city and file a written complaint. Provide them with all the evidence you have collected.
• Notify the Bank in Writing: Send a formal letter or email to the concerned bank (Prestige Bank) and the bank that issued the fake message’s sender ID, informing them of the fraudulent message and stating that you do not hold any such card. This creates an official record.
• Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation of come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think.

If you are the victim

If your credit report shows that a card was indeed opened in your name, you are a victim of identity theft and fraud. Your course of action should be immediate and decisive.

• Report Fraud to the Bank: Immediately contact the bank that issued the card (using their official number) and report the fraud. Ask them to block the card and initiate a fraud investigation.
• File a Cyber Crime Complaint: As mentioned above, file a complaint on the cybercrime portal and with the local police. This is crucial for legal proceedings.
• Dispute the Account with Credit Bureaus: Contact the credit bureaus (CIBIL, etc.) to formally dispute the fraudulent account on your credit report. Provide them with a copy of the police complaint.
• Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation of come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think.

How the police behave in such cases

Initially, if there is no financial loss, the police might treat it as a non-cognizable offense and just make a record. However, with the rise of cybercrime, they are becoming more proactive. The Cyber Crime Cell is specially equipped to handle such cases. They will likely register an FIR if your credit report confirms fraud. Their investigation, under the Bharatiya Nagarik Suraksha Sanhita, 2023 (BNSS), will involve tracing the IP address of the links, the origin of the SMS, and coordinating with the bank and telecom service providers to identify the perpetrators.

FAQs people normally have

What if I accidentally clicked the link but didn’t enter any information?

You should immediately disconnect your device from the internet, run a full antivirus/antimalware scan, and consider resetting your important passwords (like banking, email) from a different, secure device.

Can the bank hold me liable for a card I never applied for?

No. If you can prove you are a victim of identity theft and did not apply for or use the card, you cannot be held liable for the dues. A police complaint is essential proof.

Is it possible the bank just made a mistake?

While rare, it’s possible. A typo in a phone number during data entry could lead to you receiving a message intended for someone else. However, given the nature of the message with suspicious links, it is more likely a scam.

What evidence is required?

To build a strong case, you will need the following evidence:

• A clear screenshot of the fraudulent SMS, showing the sender ID/number and the full text.
• Your call data records (if you were contacted by phone).
• A copy of your credit report showing the unauthorized account (if applicable).
• Copies of all written communication with the bank(s) and the police.
• A copy of the FIR or the complaint filed on the National Cyber Crime Reporting Portal.

How long will the investigation take?

Cybercrime investigations can be complex and time-consuming. It involves coordination between multiple agencies, including police, telecom operators, and banks. Tracing digital footprints across different jurisdictions can take several months. However, reporting the incident promptly helps in taking immediate action like blocking the card and preventing financial loss, which is the primary concern.

Advocate Sudhir Rao, Supreme Court of India