A cyber crime in India can be reported on the National Cyber Crime Reporting Portal (cybercrime.gov.in), through the toll-free National Cyber Crime Helpline 1930, or at any police station, which must register an FIR if a cognizable offence is disclosed. For money lost to online fraud, the helpline or the portal's financial fraud reporting should come first and fast, because the system is designed to alert banks and payment intermediaries so that the money can be held before it moves on. Behind every complaint sits a mix of statutes: the Information Technology Act, 2000 for offences specific to computers, the Bharatiya Nyaya Sanhita, 2023 for cheating, extortion, stalking and the like, and the BNSS for how the police receive and investigate the case.
Where can you report a cyber crime in India?
You can report through three channels, and they work together rather than as alternatives. The Ministry of Home Affairs set up the Indian Cyber Crime Coordination Centre (I4C) as an attached office, and the National Cyber Crime Reporting Portal was launched under it to let the public report all types of cyber crime, with special focus on crimes against women and children. According to the Ministry, complaints reported on the portal, their conversion into FIRs and further action are handled by the police of the State or Union Territory concerned.
| Channel | Best for | What happens next |
|---|---|---|
| Helpline 1930 | Online financial fraud, immediately after it happens | Complaint logged and passed to banks and intermediaries for action on the funds; complaint details recorded for the State police |
| National Cyber Crime Reporting Portal | All cyber crime, including harassment, impersonation, sextortion, and crimes against women and children | Routed to the State or UT police, who examine it and register FIRs where needed |
| Police station or cyber police station | Any cyber offence, especially where you want an FIR registered at once | FIR under section 173 BNSS; investigation by an officer of the rank the IT Act requires |
The Ministry has described 1930 as a toll-free helpline that operates round the clock and guides victims on reporting cyber crimes such as online harassment, identity theft and financial fraud. Note the number and the portal name somewhere you will find them under stress; most victims lose time searching for them.
Why does speed matter so much in online financial fraud?
Money taken in an online fraud usually moves through several accounts within hours, and every hop makes recovery harder. The Citizen Financial Cyber Fraud Reporting and Management System, launched under I4C in 2021, exists for immediate reporting of financial frauds and to stop fraudsters siphoning off funds. A report through 1930 or the portal can lead to the amount being put on hold in the receiving accounts while the police act.
Suppose a retired teacher receives a call from someone posing as a courier company, is told a parcel in her name contains drugs, and is then "transferred" to a fake police officer on a video call who demands a "verification deposit". She transfers two lakh rupees. If she calls 1930 within the hour, with the transaction reference and the receiving account details, there is a realistic chance part of the money is frozen. If she waits until the next week, the chance falls sharply.
That example also carries a lesson the Ministry has publicised through its awareness campaigns on the "digital arrest" scam: such arrests are fake. No provision of the BNSS lets the police arrest a person over a video call, and no officer can lawfully demand money to close an investigation.
How do you report a cyber crime, step by step?
Report quickly, keep the evidence intact, and make sure your complaint becomes an FIR where an offence is disclosed. A sensible sequence is:
- If money is involved, call 1930 at once or use the financial fraud option on the portal. Have ready the bank or wallet name, transaction ID, date, time and amount, and the receiving account or UPI ID.
- Inform your bank through its official channel and ask it to block the card or account if credentials were compromised.
- Preserve the evidence before doing anything else with the device (see the next section).
- File a complaint on the portal, or go to the nearest police station or cyber police station. Describe what happened in date order and attach screenshots and documents.
- Note the acknowledgement number and use it to follow up.
- Ask for an FIR where the facts disclose a cognizable offence. Under section 173 of the BNSS, information can be given by electronic communication, and an FIR can be registered irrespective of the area where the offence was committed, which matters for online crimes whose authors may be anywhere.
- Report the account or content to the platform through its grievance mechanism, so that the profile, post or listing can be taken down.
The Legal Firms guide on how to report cyber crime in India walks a non-lawyer through the same steps in plain language.
What evidence should you preserve?
Preserve the original electronic records and make copies that show where they came from; do not edit, crop or delete anything. Useful material includes:
- screenshots of messages, profiles and posts, showing the URL, username or phone number and the date and time;
- the full URL of the fake website, profile or listing;
- transaction IDs, bank SMS alerts and account statements;
- email headers, not just the message text, where the fraud came by email;
- call logs showing the numbers that called you.
Keep the phone or computer as it is if possible. If the case goes to trial, electronic records are proved under the Bharatiya Sakshya Adhiniyam, 2023, and section 63 of the BSA (formerly section 65B of the Evidence Act) requires a certificate in the specified form when secondary electronic evidence is produced. A victim who keeps the original device and the original files makes that certificate much easier for the prosecution.
Which laws apply to common cyber crimes?
Most cyber crimes are charged under both the IT Act and the BNS, and the right combination depends on what was done. The table lists the provisions most often used.
| Conduct | IT Act | BNS |
|---|---|---|
| Fraud using a fake identity online, such as a fake officer or customer care | Section 66D, cheating by personation using a computer resource | Section 319, cheating by personation (formerly s. 419 IPC); section 318, cheating (formerly s. 420 IPC) |
| Using someone's password, OTP or electronic signature | Section 66C, identity theft | Section 318, where property is obtained |
| Hacking or unauthorised access done dishonestly or fraudulently | Section 66 read with section 43 | |
| Capturing or sharing private images without consent | Section 66E, violation of privacy; sections 67 and 67A for obscene or sexually explicit material | Section 77, voyeurism (formerly s. 354C IPC) |
| Monitoring a woman's internet or email use, repeated unwanted contact | Section 78, stalking (formerly s. 354D IPC) | |
| Threats to publish material unless paid | Section 308, extortion (formerly s. 383 IPC); section 351, criminal intimidation | |
| Sexual material involving children | Section 67B | Read with the POCSO Act, 2012 |
Section 66D punishes whoever, by means of any communication device or computer resource, cheats by personating, with imprisonment up to three years and fine up to one lakh rupees. Section 66C punishes fraudulent or dishonest use of another person's electronic signature, password or other unique identification feature. Section 318 of the BNS is the general cheating provision and carries heavier punishment for aggravated forms, which is one reason it is usually added.
Who investigates, and what can you do if nothing happens?
Offences under the IT Act must be investigated by a police officer not below the rank of Inspector. That is the effect of section 78, which overrides the general procedure code. Under section 77B, offences under the Act punishable with imprisonment of three years and above are cognizable, and offences punishable with three years are bailable.
If the police do not register an FIR on a complaint that discloses a cognizable offence, the remedies are those available for any offence: send the substance of the information in writing by post to the Superintendent of Police under section 173(4) BNSS, and then apply to the Magistrate under section 175(3) with an affidavit.
There is also a civil route for compensation. Under section 43, a person who accesses a computer system without permission, downloads data, introduces a virus or causes damage is liable to pay compensation. Under section 46, an adjudicating officer appointed by the Government decides such claims where the damage claimed does not exceed five crore rupees; larger claims go to the competent court. Few victims know of this route, and it can run alongside the criminal case.
General information only; consult a lawyer for advice on a specific case. For a quick view from an advocate on your own facts, the cyber law section of Ask a Lawyer is one option.
Why does section 66A still come up?
Section 66A of the IT Act, which punished sending "offensive" messages through communication services, was struck down as unconstitutional in Shreya Singhal v. Union of India in 2015, for violating Article 19(1)(a) and not being saved by Article 19(2). For years after the judgment FIRs continued to be registered under it. Parliament formally omitted the section through the Jan Vishwas (Amendment of Provisions) Act, 2023, with effect from 30 November 2023, though older printed copies of the Act still carry the text.
For a victim, the point is practical: an FIR for online abuse should be under provisions that exist in law, such as section 78 or section 79 BNS, section 351 BNS or section 67 of the IT Act, depending on the facts. For a person accused under section 66A, the judgment is a complete answer. For an exam candidate, Shreya Singhal is also the leading case on intermediary liability, since it read down section 79 so that an intermediary must act on actual knowledge received through a court order or a government notification.
How is cyber law asked in exams?
Cyber law appears in judiciary papers as part of criminal law, in AIBE as a separate subject, and in law officer exams. Questions usually test section numbers (66C, 66D, 66E, 67, 67A, 67B), the rank of the investigating officer under section 78, the adjudicating officer's pecuniary limit under section 46, Shreya Singhal, and the electronic evidence certificate.
Common slips:
- Citing section 66A as a live offence.
- Writing section 420 IPC without the BNS equivalent, section 318.
- Forgetting that IT Act offences must be investigated by an officer not below the rank of Inspector.
- Treating the national portal as the investigating agency. It receives complaints; State police investigate.
Key points to remember
- Report online financial fraud immediately through 1930 or the portal so that funds can be put on hold.
- Portal complaints are handled, and converted into FIRs, by the State or UT police.
- Section 173 BNSS allows information by electronic communication and FIR registration irrespective of where the offence occurred.
- Common charges are section 66C, 66D, 66E and 67 of the IT Act with section 318, 319, 77, 78 and 308 of the BNS.
- IT Act offences must be investigated by an officer not below the rank of Inspector under section 78.
- Section 43 compensation claims up to five crore rupees go to the adjudicating officer under section 46.
- Section 66A was struck down in Shreya Singhal (2015) and cannot be the basis of any prosecution.
Where to go next
Read the offences chapter of the Information Technology Act, 2000 with the BNS sections in the table beside it, then practise in the special criminal laws mock tests.