How does the IT Act, 2000 address the issue of phishing, and what legal recourse do victims have?

The Information Technology Act, 2000 (IT Act) is the principal legislation in India that addresses cybercrimes, including phishing. Phishing refers to fraudulent attempts to acquire sensitive information, such as usernames, passwords, or credit card details, by masquerading as a trustworthy entity in electronic communications. Under the IT Act, several provisions can be invoked to address and mitigate the impact of phishing attacks.

Firstly, Section 66 of the IT Act explicitly deals with hacking and the misuse of computer systems. While it may not directly define phishing, phishing activities often involve unauthorized access to personal information, which can fall under this section. The act prescribes a punishment of up to three years of imprisonment or a fine that may extend to ₹5 lakh or both. Additionally, Section 66D of the IT Act specifically criminalizes cheating by personation using a computer resource or communication device, which is directly applicable to phishing scams. It also provides for similar penalties as Section 66.

Victims of phishing can pursue several legal avenues. They can file a complaint with the Cyber Crime Cell of their local police station or directly approach the nearest cybercrime portal, which allows for online reporting of cybercrimes. According to the IT Act, victims should collect all relevant evidence, such as screenshots, emails, and any communication related to the phishing attempt, as this will support their case. After lodging a complaint, the police are obliged to register an FIR if the complaint falls within the ambit of cognizable offenses.

Moreover, victims are also encouraged to report the incident to their banks or financial institutions if financial loss is involved. Banks have internal mechanisms to deal with such situations, including the possibility of blocking compromised accounts and helping recover lost funds. It is also advisable for victims to monitor their financial statements closely and change passwords for compromised accounts immediately to mitigate further risks. In extreme cases, if the victim suffers substantial loss, they may also explore civil remedies by filing a suit for damages against the perpetrator, provided that the identity of the perpetrator can be established.