Identity Theft: Preventing and Mitigating Online Fraud

Your name, your PAN number, your net banking password, even the answer to your childhood pet’s name – these small pieces of information are worth more to a criminal than the cash in your wallet. That is the uncomfortable truth behind identity theft: it does not need to break into your house, only into your inbox. As India’s digital payments and social media use continue to grow, so does the opportunity for fraudsters to quietly collect these pieces and use them as if they were you.

What identity theft actually means online 🔗

Identity theft is the illegal acquisition of someone’s personal information, followed by its use to commit fraud, usually financial. In the physical world, this meant a stolen wallet or a rifled-through dustbin. Online, it means a cleverly worded email, a fake login page, or a leaked database. The target information is the same in spirit but wider in scope: full name, address, date of birth, Aadhaar or PAN details, bank account numbers, and login credentials for email or UPI apps.

India’s law recognises this explicitly. Under the Information Technology Act, 2000, fraudulently or dishonestly using someone else’s password, electronic signature, or other unique identification feature is a punishable offence, carrying up to three years of imprisonment and a fine. This is not a hypothetical concern for future cybercrime specialists – it is a live legal and financial risk for anyone who banks, shops, or communicates online, which today is nearly everyone.

How cybercriminals actually get your information 🔗

Identity thieves rarely “hack” in the dramatic, movie-style sense. Most of the time, they simply ask – and people, without realising it, answer.

Phishing: the digital fishing net 🔗

Phishing is the most common technique, and it works exactly like its name suggests: cast a wide net, use convincing bait, and wait for someone to bite. A typical phishing message impersonates a bank, a government department, or a delivery service, warning that your account will be blocked or your KYC needs urgent updating. The message links to a fake page designed to look identical to the real one, where you unknowingly type in your login ID and password. The Reserve Bank of India has repeatedly flagged this exact pattern, along with related tricks like vishing (fraud calls pretending to be from a bank) and misuse of the UPI “collect request” feature, where a fraudulent payment request is disguised as money coming to you.

Unsecured websites and public networks 🔗

Any website that does not encrypt the data travelling between your device and its server is a risk. If you type your card details into a site without “https” and a padlock icon in the address bar, that information can potentially be intercepted. The danger multiplies on public Wi-Fi at airports, cafes, or railway stations, where data can be monitored by anyone else on the same network. This is precisely why regulators now caution that UPI transactions should only be carried out over trusted, secure internet connections, not shared public networks.

Data breaches you never hear about 🔗

Sometimes your information is not taken from you directly at all. It is taken from a company you trusted with it – an e-commerce site, an app, a hospital, or an employer – whose database gets breached. That stolen data often ends up sold in bulk on underground forums, later used to craft highly personalised phishing attempts that feel too specific to be fake, because the criminal already has real details about you.

What is really at stake once your identity is compromised 🔗

The consequences of identity theft go well beyond a single unauthorised transaction. Once a criminal has your login credentials, they can:

• Access your bank and UPI accounts and initiate transfers before you even notice the login alert.
• Take over your email account, which often works as a master key to reset passwords on every other service linked to it.
• Open new accounts or loans in your name, leaving you to deal with the credit and legal fallout.
• Impersonate you on social media to scam your contacts, damaging both your finances and your reputation.

The financial scale of this problem in India has grown sharply. Reported digital banking fraud cases jumped from 13,564 in FY23 to 36,075 in FY24, and account takeover frauds now make up around 56 percent of all reported incidents, according to RBI data. Because digital transactions are instant, there is often no window to reverse a fraudulent transfer once it is made – which is exactly why prevention matters far more than damage control after the fact.

Building a practical defence against identity theft 🔗

Fortunately, most identity theft techniques rely on predictable weak points, which means most of the defence is also predictable and learnable.

Use encrypted connections, always 🔗

Before entering any personal or payment information on a website, check for “https://” and the padlock symbol. This confirms that data exchanged between your browser and the site is encrypted, making it far harder to intercept. Avoid entering sensitive information while connected to public Wi-Fi; if you must use it, a trusted VPN adds a layer of protection.

Avoid storing personal information online carelessly 🔗

Many people save card numbers, passwords, or scanned ID documents in browser autofill, email drafts, or cloud notes “for convenience.” Every one of these is a potential leak point if that account is ever compromised. Store sensitive data in a dedicated password manager instead, and avoid emailing yourself scans of your Aadhaar, PAN, or passport.

Keep security software current 🔗

Outdated antivirus and anti-spyware software cannot recognise newer threats. Keeping this software updated, along with your operating system and apps, closes known security gaps that criminals actively look for. Only download apps from official stores rather than third-party links, since fraudulent apps are a growing route for stealing device data.

Learn to recognise fake emails and phishing attempts 🔗

This is the single most effective defence, because most identity theft still begins with a message a person chooses to click.

Enabling two-factor authentication wherever it is offered adds a second checkpoint even if your password is compromised, and it is a step regulators actively encourage. Regularly reviewing your bank statements and transaction alerts also means fraud gets caught in hours, not weeks.

If you do become a victim 🔗

Speed matters enormously once fraud has happened. India’s Ministry of Home Affairs operates the toll-free 1930 cybercrime helpline, available 24×7, specifically to help freeze fraudulent transactions before the money moves further. Alongside this, the National Cyber Crime Reporting Portal lets you formally report incidents such as hacking, data breaches, and identity theft, and track the status of your complaint. India’s national nodal agency for cybersecurity incidents, CERT-In, also monitors emerging threats and issues public advisories, so checking its alerts occasionally can help you recognise active scam patterns before they reach you. The earlier you report identity theft, the better your chances of limiting the damage and helping investigators trace the fraudster.

What do you think? Have you ever received a phishing message convincing enough to make you pause before you recognised it as fake? And do you think most people currently treat their passwords and personal data with the same seriousness as their physical wallet, or far less?

References

1. https://www.unodc.org/cld/en/legislation/ind/the_information_technology_act_2000/chapter_xi/sections_66c66d/sections_66c-66d.html
2. https://www.business-standard.com/amp/article/economy-policy/rbi-asks-people-to-follow-safe-digital-banking-practices-amid-rising-frauds-122012801594_1.html
3. https://www.analyticsinsight.net/amp/story/banking/how-to-stay-safe-from-digital-fraud-rbis-key-tips-explained
4. https://www.ujjivansfb.bank.in/banking-blogs/banking-services/digital-banking-fraud-protection-tips
5. https://www.pib.gov.in/PressReleasePage.aspx?PRID=2085609&reg=48&lang=2
6. https://services.india.gov.in/service/detail/report-financial-fraud-through-the-national-cyber-crime-reporting-portal
7. https://www.pib.gov.in/PressNoteDetails.aspx?NoteId=155384&ModuleId=3&reg=3&lang=2