If a scammer is threatening to leak morphed photos or harassing your contacts, here is how you use the BNSS and Cyber Crime portal to fight back.
You’re scrolling through your phone when a WhatsApp message drops from an unknown +92 or +1 number. It’s a screenshot of your contact list and a morphed, explicit photo of your face on someone else’s body. The threat is simple: "Pay ₹50,000 in 30 minutes or we blast this to your father, your college professor, and your HR." Maybe it started with a "Small Cash" app you downloaded during a broke week, or a random link you clicked. Your heart drops. You feel like you can’t tell your parents, and you’re tempted to pay just to make it go away.
Stop. Paying is like feeding a tiger and hoping it won't eat you later; they will just come back for more. This isn't just a "bad situation"—it is a series of cognizable offences under the Bharatiya Nyaya Sanhita (BNS), 2023. You aren't a victim; you're a complainant in waiting. Whether it is a fake loan app or a random extortionist, the law has very specific teeth to bite back. This guide is your playbook to move from panic to police action.
In India, digital extortion and harassment are covered by a combination of the Bharatiya Nyaya Sanhita (BNS), 2023 (which replaced the IPC), the Bharatiya Nagarik Suraksha Sanhita (BNSS), 2023 (which replaced the CrPC), and the Information Technology (IT) Act, 2000.
Under Section 308 of the BNS, 2023, extortion is defined as intentionally putting a person in fear of injury and inducing them to deliver property or valuable security. If they are threatening to release morphed photos to get money, they are committing extortion. Additionally, Section 351 of the BNS covers criminal intimidation—threatening someone with injury to their person, reputation, or property to make them do something they aren't legally bound to do.
If the harasser has used morphed images, they are violating Section 66E of the IT Act, 2000, which punishes the violation of privacy (capturing or publishing images of private body parts without consent). If the images are sexually explicit, Section 67 or 67A of the IT Act applies, carrying a jail term of up to five years and a fine of up to ₹10 lakh for a second conviction. For women specifically, Section 79 of the BNS (formerly Section 509 IPC) punishes any gesture or act intended to insult the modesty of a woman.
Under Section 173 of the BNSS, 2023, the police are legally bound to register an FIR if the information disclosed constitutes a "cognizable offence" (serious crimes where police can arrest without a warrant). The Supreme Court in Lalita Kumari vs. Govt. of U.P. (2014) made it clear: the police cannot conduct a "preliminary inquiry" to decide whether to file an FIR if the complaint clearly shows a cognizable crime has occurred. If you are in a different city than where the crime originated, you can file a Zero FIR under Section 173(1) of the BNSS at any police station, and they must transfer it to the relevant jurisdiction later.
If the harassment is from a loan app, remember the RBI Digital Lending Guidelines (2022). Only Regulated Entities (REs) like Banks or NBFCs can lend. They are strictly prohibited from accessing your contacts, media, or gallery. Any recovery agent who calls your family or uses foul language is violating the RBI’s Fair Practices Code. You can verify if an app is linked to an NBFC on the RBI website.
Do not delete the chat. Do not block the number immediately until you have the evidence.
Before going to a physical station, get it on the national record.
While the portal is good, a physical FIR under Section 173 of the BNSS is what forces local police to investigate.
If the harasser claims to be from a loan app:
If the stress is getting too much, do not hesitate to reach out to Mental health helplines (iCall, Vandrevala, NIMHANS). You are being targeted by professional criminals; it is not your fault.
For more ways to protect your digital rights, Browse all civic-action guides.
Even with the law on your side, the "system" can feel like a glitchy app. Here is where things usually go south and how you can bypass the lag:
The Problem: You go to your local thana, and the officer tells you, "This is a cyber matter, go to the District Cyber Cell." You go to the Cyber Cell, and they say, "We only handle cases above ₹2 lakh; go back to your local station." The Workaround: Carry a physical copy of your complaint. If they refuse to register an FIR, cite Section 173 of the BNSS, 2023. If they still budge, don't argue. Use Section 173(3) of the BNSS—send your complaint via Registered Post AD to the Superintendent of Police (SP). They are legally required to either investigate it themselves or direct an officer to do so.
The Problem: An officer or a bank official might imply you shouldn't have downloaded the app or shared photos. This is "victim-blaming" and it’s unprofessional. The Workaround: Stay clinical. Don't over-explain your "mistake." Use the phrase: "I am reporting a cognizable offence under Section 308 of the BNS and Section 66E of the IT Act. Please provide me with acknowledgment of my complaint." If they are rude, note down their name/buckle number and mention it in your escalation to the SP.
The Problem: You filed a complaint on cybercrime.gov.in, but the status hasn't moved in two weeks.
The Workaround: The portal is a reporting tool, not a magic wand. Take the "Acknowledgment Number" from the portal, print the PDF, and take it to the local police station. It proves you've already started the process and makes it harder for them to ignore you.
The Problem: You tell your bank you were scammed into a UPI transfer, and they say they can't reverse it.
The Workaround: Under RBI guidelines on "Limiting Liability of Customers," if you report an unauthorized or fraudulent transaction within 3 days, your liability can be zero or limited. If the bank doesn't respond within 30 days, file a complaint with the RBI Ombudsman at cms.rbi.org.in.
If a recovery agent or extortionist calls, do not plead. Use this exact script, then hang up:
"This call is being recorded. You are violating RBI Digital Lending Guidelines and Section 308 of the BNS. I have already filed a complaint on the National Cyber Crime Reporting Portal (Acknowledgment No: [Your Number]). Any further contact with me or my contacts will be added to the FIR. Speak to my lawyer or the police now."
Copy, edit the bracketed parts, and print.
To, The Officer-in-Charge, [Name of Police Station/Cyber Cell, City]
Date: April 30, 2026 Subject: Complaint regarding digital extortion, criminal intimidation, and violation of privacy.
Respected Sir/Madam,
I, [Your Name], aged [Age], resident of [Your Address], wish to report the following offences:
I request you to register an FIR under Section 173 of the BNSS and take immediate action to block the accused's numbers and associated bank accounts.
Sincerely, [Your Signature] [Your Phone Number]
1. Can I file a complaint if I am under 18? Yes. You don't need to be an adult to report a crime. However, the police might ask your parents or a legal guardian to join the process as a "natural guardian." If the harassment involve sexual content and you are a minor, the case might also fall under the POCSO Act, which has even stricter protection and privacy rules for you.
2. Will the police tell my parents about the morphed photos? The police need to contact a guardian if you are a minor. If you are an adult (18+), you can request the Cyber Cell to keep the matter confidential during the preliminary probe. However, if an FIR is filed, your name will be on it. Note: It is much better for your parents to hear it from you (with a police complaint in hand) than from a scammer.
3. What if the scammer is calling from a +92 (Pakistan) or +1 (USA) number? Many scammers use Virtual Private Networks (VPNs) and VoIP numbers to hide their location. Even if the police cannot arrest someone in another country immediately, filing the complaint allows them to coordinate with the Ministry of Home Affairs to block those specific IDs/accounts and prevents the scammer from using Indian payment gateways to withdraw money.
4. How do I know if a loan app is "legal" or "fake"? A legal loan app must be linked to a Regulated Entity (RE) like a Bank or an NBFC. Before downloading, check the app’s website for the name of their NBFC partner. Cross-reference this name on the RBI’s list of registered NBFCs. If they don't list a partner or ask for access to your "Gallery" and "Contacts," it is almost certainly a scam.
5. I already paid ₹5,000. Can I get it back?
It is difficult but not impossible. Your best chance is the "Golden Hour"—reporting the transaction to 1930 or the portal within 2 hours. The police can sometimes "freeze" the money in the scammer's bank account or UPI wallet before they withdraw it. Once the money is moved to a "mule account" and withdrawn as cash, recovery is very low.
6. Do I need a lawyer to file an FIR? No. Filing an FIR is free and does not require a lawyer. You only need a lawyer if you want to file a "Private Complaint" before a Magistrate under Section 175(3) of the BNSS because the police refused to act. For initial reporting, your own detailed statement and evidence are enough.
7. Can the scammer actually "leak" my photos to everyone? Technically, if they have your contact list, they can. However, most scammers are "volume players"—they want quick money. Once they realize you have involved the police (and sent them the complaint copy), you become a "high-risk" target. They usually move on to someone who hasn't fought back. Blocking them and warning your inner circle is the best defense.
Yes. You don't need to be an adult to report a crime. However, the police might ask your parents or a legal guardian to join the process as a "natural guardian." If the harassment involve sexual content and you are a minor, the case might also fall under the POCSO Act, which has even stricter protection and privacy rules for you.
The police need to contact a guardian if you are a minor. If you are an adult (18+), you can request the Cyber Cell to keep the matter confidential during the preliminary probe. However, if an FIR is filed, your name will be on it. Note: It is much better for your parents to hear it from you (with a police complaint in hand) than from a scammer.
Many scammers use Virtual Private Networks (VPNs) and VoIP numbers to hide their location. Even if the police cannot arrest someone in another country immediately, filing the complaint allows them to coordinate with the Ministry of Home Affairs to block those specific IDs/accounts and prevents the scammer from using Indian payment gateways to withdraw money.
A legal loan app must be linked to a Regulated Entity (RE) like a Bank or an NBFC. Before downloading, check the app’s website for the name of their NBFC partner. Cross-reference this name on the **RBI’s list of registered NBFCs**. If they don't list a partner or ask for access to your "Gallery" and "Contacts," it is almost certainly a scam.
It is difficult but not impossible. Your best chance is the "Golden Hour"—reporting the transaction to `1930` or the portal within 2 hours. The police can sometimes "freeze" the money in the scammer's bank account or UPI wallet before they withdraw it. Once the money is moved to a "mule account" and withdrawn as cash, recovery is very low.
No. Filing an FIR is free and does not require a lawyer. You only need a lawyer if you want to file a "Private Complaint" before a Magistrate under Section 175(3) of the BNSS because the police refused to act. For initial reporting, your own detailed statement and evidence are enough.
RTI templates, FIR scripts, real escalation ladders — the same kind of thing you just read. Sundays only. No spam.
We don't share your email. Unsubscribe any time.
Get ₹50,000 for your technical education. Learn how to apply for AICTE's Pragati, Saksham, and Swanath scholarship schemes for the 2026-27 academic year on the NSP portal.
Check if your college is legal. Learn how to download the AICTE APH 2024-27 and verify mandatory norms for faculty, labs, and student grievances.
Found a broken link or outdated data on a government portal? Learn how to find and message the Web Information Manager (WIM) to get it fixed fast.
Ever wonder how new state laws actually affect you? Learn how to find, read, and decode State Legislative Briefs to track bills before they become law.