I received a phishing email pretending to be from my bank in Shillong asking for my OTP and credentials. Is this a crime?

Detailed Legal Analysis

Yes, receiving a phishing email that pretends to be from your bank and requests your OTP and credentials constitutes a crime under Indian law.

Phishing is a form of cybercrime where attackers impersonate legitimate organizations to extract sensitive information from victims. Under Indian law, this act is primarily governed by the Information Technology Act, 2000, and relevant sections of the Indian Penal Code (IPC).

• Information Technology Act, 2000:
  • Section 66: This section deals with computer-related offenses, including hacking and identity theft. Phishing can be classified under these offenses as it involves unauthorized access and misuse of personal information.
  • Section 66D: This section specifically addresses cheating by personation using computer resources. Phishing is a clear case of cheating, as the perpetrator impersonates a legitimate entity (the bank) to deceive you into providing sensitive information.
• Indian Penal Code (IPC):
  • Section 420: This section pertains to cheating and dishonestly inducing delivery of property. If you suffer a loss due to the phishing attempt, the perpetrator can be charged under this section.
  • Section 463: This section covers forgery, which can also apply if the phishing email includes forged documents or impersonates bank communication.

If you have received such a phishing email, it is crucial to take the following steps:

• Do not respond to the email or provide any personal information.
• Report the phishing attempt to your bank immediately. Banks often have dedicated teams to handle such issues and can guide you on protecting your account.
• Forward the phishing email to the Cyber Crime Cell of your local police department as well as to the Indian Computer Emergency Response Team (CERT-In) at cert-in.org.in.
• Consider changing your passwords and enabling two-factor authentication on your banking account for additional security.
• Stay informed about the latest phishing tactics to better recognize and avoid them in the future.

Taking these steps can help mitigate the risks associated with phishing and contribute to the broader fight against cybercrime in India.