Identity Theft in Banking
Stealing the identity is step one. The fraud that follows is what lands on the bank's desk.
Identity theft is using another person's identifying details to pass as them: their password, OTP, card details, electronic signature, Aadhaar or PAN, or even their face in a video KYC. The theft is only the first step. What follows is the fraud: money moved out of their account, a loan taken in their name, a SIM issued against their number.
Banks meet identity theft from both sides. A customer's identity gets stolen and used against their own account; or a stolen or fabricated identity is presented to the bank to open an account, often a mule account that will receive other victims' money.
You save ₹300
- Full 120-question mocks
- Cyber law coverage
- Module-wise practice
One payment, no subscription · Valid for 2 months
Common Forms in Banking
- Account takeover
- The fraudster gets the customer's login credentials and OTPs, changes the registered contact details, and empties the account.
- SIM swap
- The fraudster gets a duplicate SIM for the victim's mobile number, often with forged documents, and starts receiving the victim's OTPs. A sudden loss of mobile signal is the warning sign.
- Loan or card in the victim's name
- Stolen KYC documents used to take a loan or credit card the victim never applied for. Often discovered only when a recovery call or credit report shows it.
- Synthetic identity
- A made-up identity built from a mix of real and fake details, such as a genuine PAN with someone else's photograph. Used to open mule accounts or build credit before defaulting.
- Child or deceased identity
- Details of people unlikely to check their records, used because the fraud goes unnoticed for longer.
The Law That Applies
Police usually combine IT Act and BNS sections in one FIR.
IT Act section 66C (identity theft)
What it covers
Fraudulently or dishonestly using another person's electronic signature, password or any other unique identification feature
Maximum punishment
3 years' imprisonment, and fine up to ₹1 lakh
IT Act section 66D
What it covers
Cheating by personation using a communication device or computer resource
Maximum punishment
3 years' imprisonment, and fine up to ₹1 lakh
BNS section 319 (formerly IPC 416 and 419)
What it covers
Cheating by pretending to be another person, real or imaginary
Maximum punishment
5 years, or fine, or both
BNS section 336 (formerly IPC 463, 465 and 468)
What it covers
Forgery, including making a false electronic record
Maximum punishment
Up to 7 years and fine where the forgery is meant for cheating
| Provision | What it covers | Maximum punishment |
|---|---|---|
| IT Act section 66C (identity theft) | Fraudulently or dishonestly using another person's electronic signature, password or any other unique identification feature | 3 years' imprisonment, and fine up to ₹1 lakh |
| IT Act section 66D | Cheating by personation using a communication device or computer resource | 3 years' imprisonment, and fine up to ₹1 lakh |
| BNS section 319 (formerly IPC 416 and 419) | Cheating by pretending to be another person, real or imaginary | 5 years, or fine, or both |
| BNS section 336 (formerly IPC 463, 465 and 468) | Forgery, including making a false electronic record | Up to 7 years and fine where the forgery is meant for cheating |
Red Flags a Branch Should Catch
- checkA request to change the registered mobile number or email, followed soon after by large or unusual transfers
- checkA customer reporting their phone suddenly lost network for hours
- checkKYC documents where the photograph, signature or address details don't match each other or the applicant
- checkSeveral new accounts sharing the same mobile number, email or device
- checkA new account that receives many small credits from unrelated people and immediately transfers them out (a likely mule)
- checkA customer disputing a loan or card they say they never applied for
Quick practice on banking operations. No signup.
When a Customer's Identity Has Been Stolen
- 1
Freeze the exposure
Block cards, net banking and UPI, and reset credentials through a verified channel.
- 2
Report quickly
The customer reports to 1930 or cybercrime.gov.in; the bank records the time the customer informed it.
- 3
Check for other products
Search for loans, cards or accounts opened with the same KYC details.
- 4
Escalate and preserve
Route through the bank's fraud process with all evidence. Identity theft and spoofing are among the incident types the bank must report to CERT-In within 6 hours under the 2022 Directions.
How the IIBF Exam Tests This
The section-number question is the classic one: identity theft is 66C, personation is 66D, privacy violation is 66E, cyber terrorism is 66F. Candidates mix these up under time pressure. Also expect a scenario where the right answer is a KYC or verification control, such as re-verifying a customer before changing the registered mobile number, rather than a technical control.
FAQs
What is the punishment for identity theft under the IT Act?expand_more
Section 66C: imprisonment up to 3 years and a fine up to ₹1 lakh, for fraudulently or dishonestly using another person's electronic signature, password or other unique identification feature.
What is the difference between section 66C and 66D of the IT Act?expand_more
66C punishes misusing someone's identifying credential, such as a password or OTP. 66D punishes cheating by pretending to be someone else using a phone or computer. Both carry up to 3 years and a fine up to ₹1 lakh.
What should I do if someone takes a loan in my name?expand_more
Report it to the lender in writing, file a complaint on 1930 or cybercrime.gov.in, and check your credit report for other accounts you don't recognise.
What is a SIM swap fraud?expand_more
A fraudster gets a duplicate SIM for your mobile number and receives your OTPs. If your phone suddenly loses network without reason, contact your mobile operator and your bank at once.
Next steps
- Phishing, Vishing, Smishingarrow_forward
- Section 66 Offencesarrow_forward
- UPI Fraudarrow_forward
- DPDP Act 2023arrow_forward
120 questions, 2 hours, scored instantly.