Section 66D: The Art of Digital Deception—Cheating by Personation
Published on January 3, 2026 • 14 min read
April 2022. The CFO of a Pune manufacturing company receives an email from the CEO at 11 PM. "Urgent acquisition underway. Need ₹45 lakh wire transfer to our Singapore consultant by tomorrow morning. Confidential—don't discuss with anyone." The email address looks right: ceo@companyname.com. The signature matches. Even the tone is familiar.
The CFO initiates the transfer. By the time the CEO walks into the office the next day and asks, "What ₹45 lakh transfer?" it's too late. The money is gone. The email was a perfect fake—sent from ceo@companyname.co (note the ".co" instead of ".com"). The scammer had studied months of leaked emails to mimic the CEO's writing style.
This is Section 66D of the Information Technology Act in action: cheating by personation using computer resources. The digital age's most profitable con.
What is Section 66D? The Legal Framework
Section 66D was introduced in 2008 to address the growing menace of online impersonation fraud. The provision states:
Breaking this down: you commit an offense under 66D when you cheat someone by pretending to be someone else using digital means. All three elements must be present.
The Anatomy of Section 66D: Three Essential Elements
1. Personation (Impersonation)
"Personation" under IPC Section 416 means intentionally pretending to be another person, or representing yourself as someone you're not. In the digital context, this includes:
- Creating fake social media profiles using someone else's name and photos
- Sending emails from spoofed addresses that appear to be from a real person
- Using deepfake technology to impersonate someone's voice or appearance
- Operating fake websites that mimic legitimate businesses
- Impersonating government officials, bank employees, or law enforcement online
2. Cheating
Under IPC Section 415, "cheating" means deceiving someone to:
- Deliver property: Money, assets, goods
- Consent to keeping property: Not demanding return of something
- Do or omit an act: Taking action (or not taking action) that benefits the cheater
The deception must result in wrongful gain to the perpetrator or wrongful loss to the victim.
3. Use of Communication Device/Computer Resource
The impersonation must occur through digital means:
- Emails, instant messages, SMS
- Social media platforms (Facebook, Instagram, LinkedIn)
- Dating apps, professional networking sites
- Video calls using deepfakes or manipulated identities
- Fake websites or phishing pages
Real-World Applications: The Many Faces of 66D
Case Study 1: The Fake Job Recruiter
A scammer created a LinkedIn profile impersonating an HR manager at Google. They posted job openings, conducted fake video interviews (using stolen interview footage), and asked selected "candidates" to pay ₹50,000 for "visa processing and onboarding." Twenty-three people fell for it before someone verified with Google directly.
Legal Analysis: Clear Section 66D violation—personation (fake HR identity), cheating (fraudulent fee extraction), digital means (LinkedIn, email). The perpetrator was convicted and sentenced to 2 years.
Case Study 2: The Romance Scam Catfish
A man created a fake Tinder profile using photos of a Bollywood actor. Over six months, he developed an online relationship with a woman in Hyderabad, eventually claiming he was "stuck in Dubai" and needed ₹3 lakh for emergency medical treatment. She sent the money. He vanished.
Court's Finding: Personation was established (fake identity completely fabricated). Cheating occurred (fraudulent extraction of money through emotional manipulation). Medium: dating app and WhatsApp. Conviction under 66D plus IPC 420.
Case Study 3: The KYC Update Scam
Scammers sent mass SMS messages impersonating banks: "Your account will be blocked. Update KYC immediately: [link]." The link led to a fake banking portal that harvested credentials. Thousands lost money before banks issued warnings.
Legal Framework: Personation (fake bank identity), cheating (credential theft leading to monetary loss), digital means (SMS + phishing site). Multiple arrests under Section 66D.
Penalties: What's at Risk?
- Imprisonment: Up to 3 years
- Fine: Up to ₹1 lakh (mandatory, not optional)
- Cognizable: Police can arrest without warrant
- Bailable: Though bail conditions can be stringent
Importantly, if the fraud involves amounts exceeding certain thresholds or targets senior citizens, additional IPC sections (420, 419) can be invoked, escalating penalties significantly.
Defense Strategies Against 66D Allegations
1. No Personation Occurred
Argue that you didn't impersonate anyone—you used your own identity. If there was a misunderstanding about who you were, that's different from deliberate impersonation.
2. No Intent to Cheat
Prove that there was no fraudulent intent. Perhaps there was a genuine business disagreement, but no deception occurred.
3. Victim Consented/Had Knowledge
If the "victim" knew the transaction was with you (not the person you allegedly impersonated), there's no deception.
4. Challenge Digital Evidence
Question the authenticity of IP logs, email headers, or device identification. Was chain of custody maintained? Were forensic protocols followed?
Protection Strategies: Don't Become a Victim
For Individuals
- Verify Independently: If someone asks for money via email, call them on a known number to confirm.
- Check URLs Carefully: Hover over links. Look for typos in domains (amaz0n.com, paypa1.com).
- Reverse Image Search: On dating apps or social media, verify profile photos using Google Reverse Image Search.
- Too Good to Be True: Jobs offering ₹2 lakh/month to fresh graduates, lottery wins you didn't enter—red flags.
- Never Share OTPs: No legitimate organization will ever ask for your OTP over call or message.
For Businesses
- Email Authentication: Implement DMARC, SPF, and DKIM to prevent email spoofing.
- Dual Authorization: High-value transactions require confirmation via a second channel (phone call, in-person).
- Employee Training: Regular simulations of BEC (Business Email Compromise) attacks.
- Code Words: Establish internal code words for emergency requests—if the CEO emails asking for urgent transfer but doesn't use the code word, it's fake.
Section 66D vs. Section 66C: What's the Difference?
These sections often overlap, causing confusion:
- Section 66C (Identity Theft): Fraudulent use of someone's password, digital signature, or unique identifier. Focus: stealing credentials.
- Section 66D (Cheating by Personation): Deceiving someone by pretending to be another person. Focus: impersonating identity for fraud.
Example Distinguishing the Two:
- 66C: Hacking into someone's email and using their account to send messages.
- 66D: Creating a new email address that looks like someone else's and sending fake messages.
Prosecutors often charge both to cover all bases.
Conclusion: In the Age of Deepfakes, Trust Nothing
Section 66D was drafted in 2008 when "personation" meant fake emails and stolen profile pictures. In 2026, we have AI-generated voices, deepfake videos, and synthetic identities so convincing that even experts struggle to detect them.
The law remains relevant, but enforcement is a cat-and-mouse game. Scammers operate from encrypted channels, use cryptocurrency for payments, and route attacks through VPNs spanning multiple jurisdictions. By the time a victim realizes they've been duped, the perpetrator is long gone.
The solution isn't just legal—it's cultural. We must adopt a "verify first, trust later" mindset. That late-night email from your boss? Call to confirm. That too-good-to-be-true job offer? Research the company. That romantic interest who won't video call? Walk away.
Because in the digital world, seeing is no longer believing. And your trust is the most valuable currency a scammer can steal.
Victim of online impersonation fraud or facing Section 66D charges? Our cyber law practice handles both victim representation and defense, combining digital forensics with legal strategy. Contact Us for Immediate Consultation.