1. Meaning and Concept

(A) Identity Theft

Identity theft occurs when someone fraudulently obtains and uses another person’s personal data such as:

• Aadhaar number
• PAN card details
• Bank credentials
• Passwords or OTPs
• Email or social media login information

The intent is usually:

• Financial fraud
• Accessing services illegally
• Creating fake profiles
• Committing other crimes in someone else’s name

(B) Impersonation

Impersonation means falsely representing oneself as another person to deceive others.

Example:

• Creating a fake Facebook profile using someone else’s photos
• Pretending to be a bank officer and calling victims
• Using another person’s identity for loans or transactions

2. Legal Provisions in India

(A) Indian Penal Code, 1860 (IPC)

• Section 416 – Cheating by personation
• Section 419 – Punishment for cheating by impersonation
• Section 420 – Cheating and dishonestly inducing delivery of property
• Section 468 – Forgery for purpose of cheating
• Section 471 – Using forged documents as genuine

(B) Information Technology Act, 2000

• Section 43 – Unauthorized access and data theft
• Section 66C – Identity theft (punishment for using another person’s password, signature, or biometric)
• Section 66D – Cheating by personation using computer resources

3. Nature of Offence

Identity theft and impersonation are:

• Cognizable offences (police can arrest without warrant)
• Non-bailable in serious fraud cases
• Often investigated by cybercrime cells or CBI (in major frauds)

4. Important Case Laws (India)

Below are key Indian judgments shaping the law on identity theft, impersonation, and cyber fraud:

1. State of Tamil Nadu v. Suhas Katti (2004)

Court: Chennai Cyber Crime Court

Facts:

• Accused posted defamatory and obscene messages about a woman in a Yahoo group using a fake identity.

Held:

• First successful conviction under the IT Act, 2000.
• Court recognized misuse of electronic communication for impersonation and harassment.

Principle:

• Cyber impersonation and misuse of identity online is punishable under IT law even without physical presence.

2. NASSCOM v. Ajay Sood & Others (2005)

Court: Delhi High Court

Facts:

• Defendants sent emails pretending to represent NASSCOM, misleading foreign companies (phishing scam).

Held:

• Court recognized “phishing” as passing off and identity impersonation.
• Declared it a form of cyber fraud and identity theft.

Principle:

• Impersonation via email and digital communication is actionable even if no physical fraud occurs.

3. Avnish Bajaj v. State (2008) (Bazee.com case)

Court: Delhi High Court

Facts:

• Pornographic content was listed on an online marketplace (Bazee.com) under a fake listing.

Held:

• Clarified intermediary liability and due diligence obligations.
• Though not direct identity theft, it involved misuse of online identity platforms.

Principle:

• Online platforms can be held responsible if they knowingly facilitate impersonation or illegal listings.

4. CBI v. Arif Azim (Sony Sambandh Case) (2006)

Court: Delhi High Court

Facts:

• Accused used stolen credit card details online to purchase Sony products and deliver them to fake addresses.

Held:

• First cybercrime conviction involving credit card fraud in India.

Principle:

• Use of another person’s financial identity online constitutes identity theft under IT Act and IPC.

5. Sharat Babu Digumarti v. Government of NCT of Delhi (2017)

Court: Supreme Court of India

Facts:

• Case involved online sale of obscene content through an e-commerce platform.

Held:

• When IT Act specifically covers an offence, IPC provisions cannot be simultaneously applied.

Principle:

• Cyber offences including identity misuse must primarily be prosecuted under IT Act provisions (like Section 66C/66D).

6. Mohd. Ibrahim v. State of Bihar (2009)

Court: Supreme Court of India

Facts:

• Accused executed fake documents and sold property belonging to others by impersonation.

Held:

• Forging documents and pretending to be rightful owner amounts to cheating and impersonation.

Principle:

• Physical impersonation using forged documents falls under IPC Sections 419 and 420.

7. Shreya Singhal v. Union of India (2015)

Court: Supreme Court of India

Facts:

• Challenged Section 66A of IT Act (related to online communication misuse).

Held:

• Section 66A struck down for being unconstitutional.

Principle:

• While not directly about identity theft, the judgment clarified boundaries of cyber law enforcement and protected lawful online expression.

5. Key Observations from Case Laws

From the above judgments, Indian courts have consistently held that:

• Identity theft can occur digitally without physical interaction
• Fake online profiles and phishing are punishable offences
• Both IPC and IT Act can apply, but IT Act takes precedence in cyber cases
• Financial fraud using stolen data is treated as serious criminal offence
• Intermediaries (websites/platforms) may also have liability in some cases

6. Conclusion

Identity theft and impersonation in India are evolving crimes driven by technology. Indian law addresses them through a combination of IPC provisions (traditional cheating and forgery laws) and IT Act provisions (cyber-specific offences like Sections 66C and 66D). Courts have played a crucial role in expanding interpretation to cover modern digital fraud, phishing, and fake identity creation.