I received a phishing email pretending to be from my bank in Erode asking for my OTP and credentials. Is this a crime?

Detailed Legal Analysis

Yes, receiving a phishing email that impersonates your bank and requests your OTP and credentials constitutes a crime under Indian law.

Phishing is a form of cybercrime where individuals or entities attempt to acquire sensitive information such as usernames, passwords, and credit card details by masquerading as a trustworthy entity in electronic communications. In India, this act falls under various sections of the Information Technology Act, 2000 (IT Act) and the Indian Penal Code (IPC).

• Information Technology Act, 2000:
  • Section 66: This section deals with hacking and provides penalties for anyone who intentionally accesses a computer resource without authorization or exceeds authorized access. Phishing can be categorized under unauthorized access as it involves deceit to gain sensitive information.
  • Section 66C: This section states that identity theft is punishable with imprisonment of up to three years and/or a fine that may extend to ₹1 lakh. Phishing involves stealing someone's identity by pretending to be a bank.
  • Section 66D: This specifically addresses cheating by personation using computer resources, which is applicable in cases of phishing. It prescribes a punishment of up to three years and/or a fine of ₹1 lakh.
• Indian Penal Code, 1860:
  • Section 420: This section deals with cheating and dishonestly inducing delivery of property, applicable if the phishing email leads to financial loss.
  • Section 463: Defines forgery, which can be relevant if the phishing involves creating false documents or impersonating another person.

If you have received such a phishing email, it is crucial to take the following steps:

• Do not respond to the email or provide any personal information.
• Report the phishing attempt to your bank immediately.
• File a complaint with the Cyber Crime Cell of your local police or through the National Cyber Crime Reporting Portal (cybercrime.gov.in).
• Consider informing your email service provider about the phishing email.

Additionally, it is advisable to regularly monitor your bank statements and online accounts for any unauthorized transactions and to use two-factor authentication wherever possible for enhanced security.