How to report online harassment and cyber-stalking under BNS and IT Act

The GOAT wars and the law

You posted a simple "Ronaldo > Messi" or "Messi is the reason I failed my boards" meme. Within ten minutes, your DMs are a toxic waste dump. It starts with "Messi is the reason" spam and moves quickly to "I know where you live" or graphic threats. In Indian fan communities, "trolling" is often used as a shield for actual criminal behaviour. Whether it is a football rivalry, a movie star’s fan club, or a heated political debate, the law doesn't care about your fandom—it cares about your safety. If you are being harassed, doxxed, or stalked online, you don't have to "just log off." You have the right to push back using the Bharatiya Nyaya Sanhita (BNS) and the IT Act.

What the law actually says

Since July 1, 2024, India has transitioned from the old Indian Penal Code (IPC) to the Bharatiya Nyaya Sanhita (BNS), 2023. The procedural aspects—how the police handle your case—are now governed by the Bharatiya Nagarik Suraksha Sanhita (BNSS), 2023. When a fan war turns into a criminal threat, several sections come into play.

1. Cyber Stalking (Section 78 of the BNS)

If someone monitors your internet, email, or any other form of electronic communication despite your clear indication of disinterest, they are committing the crime of stalking. Under Section 78 of the BNS (formerly Section 354D of the IPC), a first conviction can lead to up to 3 years in jail and a fine. If they repeat the offence, the penalty goes up to 5 years. This applies directly to "fan accounts" that follow you across platforms to harass or intimidate you.

2. Insulting Modesty (Section 79 of the BNS)

If the harassment involves words, gestures, or images intended to insult the modesty of a woman, it falls under Section 79. This is a common occurrence in toxic fan wars where derogatory slurs or sexualised "memes" are aimed at a specific person to shame them. This is a cognisable offence, meaning the police can arrest the accused without a warrant.

3. Violation of Privacy (Section 66E of the IT Act, 2000)

If a harasser "doxxes" you—meaning they capture, publish, or transmit images or details of your private life without your consent—they are violating Section 66E of the Information Technology Act. This is punishable with up to 3 years in prison or a fine of up to ₹2 lakh, or both. In the context of fan wars, this includes sharing your phone number, home address, or private photos.

4. Obscenity and Morphing (Section 67 of the IT Act)

Many fan wars involve the sharing of morphed or obscene photos of fans or celebrities. Section 67 of the IT Act covers the publication or transmission of obscene material in electronic form. First-time offenders can face 3 years in jail and a fine of up to ₹5 lakh. If the material involves sexually explicit acts, Section 67A applies, carrying even harsher penalties.

5. The Right to an FIR (Section 173 of the BNSS)

Under the new laws, you have a right to file an FIR for these offences. If the crime happened online, you can even file a Zero FIR at any police station, regardless of where you live or where the harasser is located. For more on the mechanics of this, see our guide on How to file an FIR (and what to do if police refuse).

Step-by-step playbook

Dealing with a digital mob is overwhelming. Follow this sequence to move from "victim" to "complainant" without losing your mind.

Step 1: Preserve the evidence (Immediately)

Do not delete the messages or deactivate your account yet. Courts and the Cyber Cell require a "chain of custody" and verifiable data.

• Screenshots: Take full-page screenshots. Ensure the date, time, and the harasser’s handle/username are clearly visible.
• URLs: Copy the direct link to the profile, the specific post, and the comments. Handles can be changed; URLs (especially profile IDs) are permanent and harder to hide.
• Screen Recording: If the harassment is happening via disappearing messages (like Instagram Vanish Mode or Snapchat), use another phone to record the screen while scrolling through the chat.
• Metadata: If you received a threatening email, save the "Email Header" (found in the 'More' or 'View Original' settings of the email), which contains the IP address of the sender.

Step 2: Lockdown and Report to the Platform

Before the harasser deletes their trail, use the platform's internal tools to flag the behaviour.

• Report: Use the "Harassment" or "Hate Speech" reporting flow on X, Instagram, or Reddit. This creates an internal log that the police can later subpoena as evidence.
• Block: Once screenshots are taken, block the accounts to prevent further mental distress.
• Privacy Settings: Switch your profile to "Private" for at least 48 hours to break the "dogpiling" effect where multiple accounts attack at once.

Step 3: File a report on the National Cyber Crime Portal

Go to cybercrime.gov.in. This is the official Ministry of Home Affairs (MHA) portal for all cyber-related offences in India.

• Category: Select "Report Women/Child Related Crime" if applicable, otherwise select "Report Other Cyber Crime."
• Details: Upload the screenshots you saved in Step 1. Provide a clear, chronological narrative: "On 2026-05-04, at 14:00 IST, the user @handle began sending threats under my post..."
• Acknowledgement: You will receive an acknowledgement number. Save this. It is a legal record that you have reported the incident. You can track the status on the same portal. For a deeper dive, check our Cyber Crime reporting portal guide.

Step 4: Visit the Local Cyber Cell

If the harassment involves death threats, doxxing of your physical location, or morphed images, a portal report may not be fast enough. You need to visit the nearest Cyber Cell or Police Station.

• What to bring: Printouts of the screenshots, a copy of your Aadhaar/ID, and the acknowledgement from the cybercrime portal.
• The Complaint: Write a formal letter addressed to the "Station House Officer (SHO)." Mention the specific sections: Section 78 BNS for stalking and Section 67 IT Act for obscenity.
• The FIR: Under Section 173 of the BNSS, the police are required to register an FIR if a cognizable offence is disclosed. If they refuse, mention the Lalita Kumari vs. Govt. of UP (2014) Supreme Court judgment, which makes FIR registration mandatory in such cases.

Step 5: Protect your mental health

Cyber-bullying is designed to make you feel isolated. The "Messi is the reason" crowd thrives on your reaction.

• Disconnect: Take a 24-hour digital detox. The world won't end if you don't see the notifications.
• Seek Support: If the anxiety is peaking or you feel unsafe, reach out to professional helplines. You can find verified contacts in our guide on Mental health helplines (iCall, Vandrevala, NIMHANS).

Step 6: Follow up and escalate

Cyber investigations take time because police often have to request data from companies like Meta or Google. Use your acknowledgement number to check the status every 7 days. If there is no progress after 15 days, you can file an RTI to ask about the status of your complaint. Learn how to File an RTI online to hold the department accountable.

For more ways to navigate Indian systems and protect your rights, you can Browse all civic-action guides.

Where it usually breaks

The system isn't perfect, and you’ll likely hit one of these three walls. Here is how to climb over them:

1. The "It’s just a joke" brush-off: When you go to a local police station, an officer might tell you to "just block them" or "beta, ignore karo." They may refuse to file an FIR, claiming it’s not a "serious" crime.

   • The Fix: Remind them that under Section 173 of the BNSS, they are legally internalising the report. If they still refuse, cite the Supreme Court judgment in Lalita Kumari v. Govt. of U.P. (2014), which makes it mandatory for police to register an FIR if the complaint discloses a cognisable offence (like stalking under Section 78 or insulting modesty under Section 79 of the BNS).

2. The Platform Dead-end: You report a post on Instagram or X (formerly Twitter), and get an automated reply saying "this doesn't violate our community standards," even if it’s clear harassment.

   • The Fix: Every major platform operating in India is legally required under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 to have a resident Grievance Officer. Don't just "report" the post; find the Grievance Officer’s email in the platform’s "India Contact" section and send a formal notice. They must acknowledge your complaint within 24 hours.

3. The Vanishing Evidence: The harasser deletes their account or comments before the police look at them.

   • The Fix: Police often say they "can't find the profile." This is why Step 1 (Preservation) is vital. Use tools like the Wayback Machine or simply take a screen recording of you clicking on their profile to show the unique URL ID (e.g., instagram.com/user_id_123). Screenshots alone are sometimes dismissed as "morphed," but screen recordings are harder to dispute.

Templates / script

A. Script for the Police Station (If they refuse your FIR)

"Officer, I am here to report a cognisable offence under Section 78 and Section 79 of the Bharatiya Nyaya Sanhita (BNS). As per the Supreme Court’s directions in the Lalita Kumari case and Section 173 of the BNSS, you are required to register this FIR. If you cannot do so, please give me a written statement citing the reasons for refusal, as I will be escalating this to the Superintendent of Police (SP) under Section 173(4) of the BNSS."

B. Email Template for Platform Grievance Officer

Subject: Formal Complaint under IT Rules 2021 – [Your Username/Account]

Body: To the Grievance Officer,

I am writing to formally report harassment/stalking occurring on your platform as per the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.

• Harasser’s Profile URL: [Link]
• Offending Content URL(s): [Links]
• Nature of Offence: [e.g., Non-consensual sharing of private info / Sexual harassment / Stalking]

This content violates Section 66E/67 of the IT Act and Sections 78/79 of the BNS. I request you to acknowledge this complaint within 24 hours and take down the content within the statutory 72-hour window.

Regards, [Your Name]

C. Text for Cybercrime.gov.in Description

"I am being persistently stalked and harassed by the user [Username] on [Platform]. On [Date], the user posted [specific description of threat/slur] at [URL]. Despite asking them to stop, they have [continued/doxxed me]. I have attached screenshots and the metadata/URLs as evidence. This is a violation of Section 78 of the BNS and Section 66E of the IT Act."

FAQs

1. Can I file a complaint if I don't know the harasser's real name? Yes. You only need their handle or profile URL. The Cyber Cell has the authority to issue a notice to the platform (like Meta or Google) to share the IP address, registration email, and phone number associated with that "anonymous" account.

2. Is there a fee for filing a cybercrime complaint or an FIR? No. Filing a complaint on the National Cyber Crime Reporting Portal (cybercrime.gov.in) or registering an FIR at a police station is absolutely free. If anyone asks for a "processing fee," they are asking for a bribe.

3. What is a "Zero FIR" and can I use it for online stalking? If you are travelling or living away from home, you can file a Zero FIR at any police station in India, regardless of where the crime happened. Under Section 173 of the BNSS, the police must register it and then transfer it to the relevant station. This is very useful if the harasser is in another state.

4. I am under 18. Do I need my parents to file a complaint? While you can report on the portal yourself, the police will generally require a legal guardian to sign the physical FIR. If the harassment is sexual in nature, it may also attract the POCSO Act, which triggers a much stricter response from the authorities. You can also contact Childline at 1098 for support.

5. How long does the police take to act? For "emergency" cases (like non-consensual private images), platforms are supposed to act within 24–36 hours of a legal notice. For general stalking cases, the investigation (tracing IPs) can take 2–4 weeks depending on how quickly the platform responds to the police's "Section 94 BNSS" notice (formerly Section 91 CrPC).

6. Will the harasser find out I reported them? If the police move to an FIR and arrest/questioning, the accused will eventually know who the complainant is. However, for the initial report on the portal, you can choose to remain anonymous for certain categories of crimes (mostly those involving child pomography or sexually explicit content).