Section 66C: When Someone Else's Identity Becomes Your Crime

What is Section 66C? The Law Against Digital Impersonation

Section 66C was introduced in the 2008 Amendment to tackle a crime that didn't have a name when the original IT Act was drafted in 2000: identity theft. The provision reads:

In simpler terms: using someone else's digital credentials without their permission, with the intent to defraud or deceive, is a crime. This isn't about accidental password sharing or authorized use—it's about deliberate impersonation for gain.

The Anatomy of Section 66C: Breaking Down the Elements

For a violation of Section 66C to stick, three critical components must be proven:

1. Use of Another Person's Credentials

The provision specifies three types of digital identifiers:

• Electronic Signature: Defined under Section 2(1)(ta) as authentication data attached to an electronic record. This includes digital signatures used in secure transactions, document signing, and government portals.
• Password: Any alphanumeric or biometric credential used to access systems—bank accounts, email, social media, corporate networks.
• Unique Identification Feature: This is the catch-all. It covers OTPs, fingerprint scans, facial recognition data, Aadhaar authentication, and even session tokens.

2. Fraudulent or Dishonest Intent

The use must be fraudulent (intending to deceive) or dishonest (intending wrongful gain or loss). This is the mens rea element. If you accidentally use someone's saved password believing it was yours, that's not Section 66C. But if you deliberately harvested credentials through phishing? That's the crime.

3. Unauthorized Use

The key word is "fraudulently." If the person gave you permission—explicit or implied—it's not identity theft. For example:

• Not 66C: Your spouse asks you to log into their email to forward a document.
• Is 66C: You access your spouse's email without asking to spy on their conversations.

Real-World Cases: When 66C Strikes

Case Study 1: The Phishing CFO

In 2020, a Chennai-based company lost ₹1.2 crore to a business email compromise (BEC) scam. The attacker sent an email to the accounts team impersonating the CFO, using credentials stolen via a spear-phishing attack. The email requested an "urgent wire transfer" to a vendor. It looked legitimate—same email format, same signature, even the same tone.

Legal Outcome: The perpetrator was charged under Section 66C (identity theft) and Section 66D (cheating by personation). The distinction? 66C covered the act of using the CFO's email credentials, while 66D covered the fraud committed using that identity. Both charges were sustained.

Case Study 2: The Aadhaar Biometric Fraud

A bank official in Uttar Pradesh was arrested for using customers' fingerprints (captured during account opening) to authorize loans without their knowledge. He'd store the biometric data and replay it during authentication. The loans were sanctioned in the customers' names, but the money went to shell accounts.

Legal Issue: Does biometric data constitute a "unique identification feature" under 66C? The court held yes. Biometric authentication, especially in Aadhaar-enabled systems, is explicitly a unique identifier. The official was convicted.

Case Study 3: The Social Media Catfish

A man in Mumbai created a fake Instagram account using a woman's photos and name. He then solicited money from her friends and family, claiming she was in an emergency. He didn't "hack" her account—he created a new one. Does this fall under 66C?

Court's Reasoning: While he didn't use her password, he used her identity (name, photo, personal details) as a unique identification feature to deceive others. Section 66C was upheld alongside IPC Section 416 (Cheating by Personation).

Penalties: The Cost of Digital Theft

Section 66C prescribes:

• Imprisonment: Up to 3 years (either simple or rigorous)
• Fine: Up to ₹1 lakh
• Mandatory: Note the word "shall also be liable to fine"—unlike some sections where fine is optional, here it's mandatory if convicted.

It is a cognizable and bailable offense. However, when combined with other charges (fraud, forgery, money laundering), bail becomes complicated.

Defense Strategies: Challenging a 66C Charge

1. Authorized Use

The strongest defense: prove consent. Evidence includes:

• Written authorization (emails, messages)
• Implied consent (shared family accounts, work protocols)
• Power of attorney or legal guardianship documents

2. Lack of Fraudulent Intent

If the use was accidental or for a legitimate purpose with no dishonest motive, you can argue absence of mens rea. Example: An IT admin accessing an employee's account for troubleshooting (within company policy) isn't 66C.

3. Mistaken Identity

In cases involving IP address tracking, VPNs, and shared devices, challenge the digital forensics. Was the device uniquely traced to you? Were chain-of-custody protocols followed?

Protecting Yourself: Practical Security Measures

Prevention is your best defense against becoming a Section 66C victim:

For Individuals

• Enable Two-Factor Authentication (2FA): Use app-based authenticators (Google Authenticator, Authy), not SMS-based OTPs which can be SIM-swapped.
• Unique Passwords: Never reuse passwords across sites. Use a password manager (Bitwarden, 1Password).
• Monitor Account Activity: Set up alerts for logins from new devices or unusual locations.
• Beware of Phishing: Verify sender email addresses character-by-character. Attackers use look-alike domains (e.g., "paypa1.com" instead of "paypal.com").
• Secure Your Aadhaar: Lock your biometrics on the UIDAI portal when not in active use.

For Businesses

• Implement Zero Trust Architecture: Verify every access request regardless of source.
• Employee Training: Regular phishing simulations and cybersecurity awareness programs.
• Incident Response Plan: Have protocols for immediate action when credentials are compromised.
• Multi-Person Approval: For high-value transactions, require dual authorization.

The Intersection with Other Laws

Section 66C rarely operates in isolation. It's typically charged alongside:

• Section 66D (Cheating by Personation): When identity theft is used to commit fraud.
• IPC Section 468 (Forgery): If the digital signature is used to forge documents.
• IPC Section 420 (Cheating): For the financial fraud enabled by identity theft.
• Prevention of Money Laundering Act (PMLA): If stolen identities are used in money laundering schemes.

What to Do If You're a Victim

If your digital identity has been stolen:

1. Immediate Containment: Change all passwords. Revoke active sessions. Contact banks to freeze accounts.
2. File an FIR: Report to the nearest cybercrime cell or via cybercrime.gov.in. Section 66C crimes are cognizable.
3. Preserve Evidence: Screenshot unauthorized transactions, login alerts, phishing emails. Don't delete anything.
4. Credit Monitoring: Request credit bureau reports. Alert them to potential fraud in your name.
5. Legal Action: Engage a cyber law attorney to navigate both criminal prosecution (of the thief) and civil recovery (of losses).

Conclusion: Your Identity is Your Most Valuable Asset

In the analog world, you could lock your wallet in a safe. In the digital world, your identity is scattered across dozens of databases, cloud servers, and authentication systems. Section 66C recognizes this vulnerability and criminalizes its exploitation.

But the law is only as strong as your vigilance. Two-factor authentication, strong passwords, and healthy skepticism are your first line of defense. Because once your digital identity is stolen, the consequences ripple through every aspect of your life—financial, professional, personal.

Priya, the graphic designer from our opening story, eventually recovered her money. But it took eight months, three court appearances, and sleepless nights. The thief? Served only 18 months because they pleaded guilty and returned the funds.

The lesson is stark: in the digital age, your password is your castle. Guard it like your life depends on it—because increasingly, it does.

Victim of identity theft or facing a Section 66C charge? Our cyber law team specializes in digital forensics-backed defense and victim representation. We understand both the technology and the law. Get Immediate Legal Assistance.

← Back to Legal Analysis