I received a phishing email pretending to be from my bank in Aligarh asking for my OTP and credentials. Is this a crime?

Detailed Legal Analysis

Yes, receiving a phishing email that pretends to be from your bank and solicits your One-Time Password (OTP) and credentials is indeed a crime under Indian law.

Phishing is a form of cybercrime that involves deceitful attempts to acquire sensitive information by masquerading as a trustworthy entity. In India, the legal framework governing such cybercrimes includes the Information Technology Act, 2000 (IT Act) and the Indian Penal Code (IPC).

Key aspects of phishing and related legal provisions include:

• Information Technology Act, 2000:
  • Section 66: This section addresses computer-related offenses, including hacking and data theft, which can encompass phishing activities.
  • Section 66D: Specifically deals with cheating by impersonation using computer resources, making phishing a punishable offense.
• Indian Penal Code, 1860:
  • Section 420: Pertains to cheating and can be applied if someone deceives you into providing your bank details.
  • Section 506: Addresses criminal intimidation, which may apply if the phishing attempt includes threats or coercion.

If you receive such an email, here are steps you should take:

• Do Not Respond: Avoid replying to the email or providing any information.
• Report the Incident: Notify your bank immediately about the phishing attempt. Most banks have dedicated fraud departments.
• File a Complaint: You can lodge a complaint with the Cyber Crime Cell or the local police. Provide all necessary details such as the email address, content of the email, and any other relevant information.
• Report to CERT-In: The Indian Computer Emergency Response Team (CERT-In) can be informed about cyber threats. You can report phishing incidents at their official website.
• Secure Your Accounts: Change your passwords and monitor your bank statements for any unauthorized transactions.

Phishing is a serious offense, and it is crucial to take preventive measures and report such incidents to protect yourself and others from cyber fraud.