I received a phishing email pretending to be from my bank in Bengaluru asking for my OTP and credentials. Is this a crime?

Detailed Legal Analysis

Yes, receiving a phishing email pretending to be from your bank is indeed a crime under Indian law.

Phishing is a type of cybercrime where attackers impersonate legitimate entities to deceive individuals into providing sensitive information such as passwords, credit card numbers, and other personal details. In India, this act is punishable under various sections of the Information Technology Act, 2000, and the Indian Penal Code, 1860.

• Information Technology Act, 2000:
  • Section 66: Deals with computer-related offenses and criminalizes hacking, which includes accessing a computer resource without authorization.
  • Section 66D: Specifically addresses cheating by impersonation using computer resources, making phishing a punishable offense with a maximum imprisonment of three years and/or a fine.
• Indian Penal Code, 1860:
  • Section 420: Relates to cheating and dishonestly inducing delivery of property, which can be applied to phishing scams.
  • Section 463: Covers forgery, which may be relevant if the phishing involves creating fake documents or identities.

If you receive such an email, it is essential to take immediate action:

• Do not respond: Avoid providing any personal information, OTPs, or credentials.
• Report the incident:
  • Notify your bank immediately to inform them about the phishing attempt.
  • File a complaint with the Cyber Crime Cell in Bengaluru. You can also report the phishing email to the Indian Cyber Crime Coordination Centre (I4C).
• Collect evidence: Save the email, take screenshots, and note down any relevant details to assist law enforcement.

Additionally, consider enhancing your cybersecurity measures, such as updating passwords regularly and enabling two-factor authentication on your banking accounts to mitigate future risks.