IT Act Section 66 Offences: 66 to 66F Explained
Six offences, one struck-down section, and the pair candidates always swap: 66C and 66D.
Section 66 of the Information Technology Act, 2000 turns the civil wrongs listed in section 43 into crimes. If a person does any act listed in section 43 (unauthorised access, copying data, planting a virus, disrupting a system and so on) dishonestly or fraudulently, it is an offence punishable with imprisonment up to three years, a fine up to ₹5 lakh, or both.
Sections 66B to 66F, added by the 2008 amendment, name specific cyber offences. Between them they cover most of what a bank's fraud desk sees: a SIM-swap fraudster using a customer's password, a caller posing as a bank official, a mule receiving a stolen phone. Section 66A, the one people still quote, is not law.
You save ₹300
- Full 120-question mocks
- Cyber law coverage
- Module-wise practice
One payment, no subscription · Valid for 2 months
The Section 66 Offences at a Glance
Maximum punishments as they stand in the Act today. "Either description" means simple or rigorous imprisonment.
66
Offence
Any act in section 43 done dishonestly or fraudulently
Maximum punishment
3 years, or fine up to ₹5 lakh, or both
66B
Offence
Dishonestly receiving or keeping a stolen computer resource or communication device
Maximum punishment
3 years, or fine up to ₹1 lakh, or both
66C
Offence
Identity theft: fraudulent use of another person's electronic signature, password or other unique identification feature
Maximum punishment
3 years and fine up to ₹1 lakh
66D
Offence
Cheating by personation using a communication device or computer resource
Maximum punishment
3 years and fine up to ₹1 lakh
66E
Offence
Capturing, publishing or transmitting images of a person's private area without consent
Maximum punishment
3 years, or fine up to ₹2 lakh, or both
66F
Offence
Cyber terrorism
Maximum punishment
Imprisonment which may extend to life
| Section | Offence | Maximum punishment |
|---|---|---|
| 66 | Any act in section 43 done dishonestly or fraudulently | 3 years, or fine up to ₹5 lakh, or both |
| 66B | Dishonestly receiving or keeping a stolen computer resource or communication device | 3 years, or fine up to ₹1 lakh, or both |
| 66C | Identity theft: fraudulent use of another person's electronic signature, password or other unique identification feature | 3 years and fine up to ₹1 lakh |
| 66D | Cheating by personation using a communication device or computer resource | 3 years and fine up to ₹1 lakh |
| 66E | Capturing, publishing or transmitting images of a person's private area without consent | 3 years, or fine up to ₹2 lakh, or both |
| 66F | Cyber terrorism | Imprisonment which may extend to life |
What Each Offence Looks Like in a Bank
- 66C, identity theft
- A fraudster who obtained a customer's net banking password and OTP through a fake KYC link logs in as the customer. Using someone else's password or unique identification feature is the offence itself.
- 66D, cheating by personation
- A caller claims to be from the bank's card division and talks a customer into reading out the card details. Pretending to be someone else over a phone or computer to cheat is the core of the offence.
- 66B, stolen device
- A person who knowingly keeps a stolen phone that still has the victim's UPI app on it. Receiving or retaining it with knowledge or reason to believe it was stolen is enough.
- 66, computer related offence
- An employee who copies a branch's customer database onto a pen drive to sell it. The act is listed in section 43(b); doing it dishonestly makes it a section 66 offence.
- 66F, cyber terrorism
- Attacking a computer resource with intent to threaten India's unity, integrity, security or sovereignty, or to strike terror, where the act causes or is likely to cause harm, or disrupts essential services or critical information infrastructure.
Section 66A Was Struck Down in 2015
Section 66A punished 'grossly offensive' or 'menacing' messages sent by computer or phone. On 24 March 2015 the Supreme Court struck it down in Shreya Singhal v. Union of India. Nobody can be charged under it. It still appears in older books and in printed copies of the Act with a note, so expect it as a distractor.
Quick practice on banking operations. No signup.
Procedure: Bailable, Cognizable, Compoundable
- check_circleSection 77B: an offence punishable with three years' imprisonment is bailable, and an offence punishable with three years or more is cognizable. So 66, 66B, 66C, 66D and 66E are cognizable and bailable. Cyber terrorism under 66F, punishable up to life, is cognizable but falls outside the bailable rule.
- check_circleSection 77A: a court may compound offences other than those punishable with life imprisonment or more than three years, but not where the offence affects the country's socio-economic conditions or was committed against a child or a woman.
- check_circleSection 78: a police officer not below the rank of Inspector investigates offences under the Act.
- check_circleSection 70(3): accessing a notified protected system without authorisation carries up to ten years, a separate and heavier offence. Several banks' systems have been notified as protected systems since 2022.
Overlap with the Bharatiya Nyaya Sanhita
The same facts often fit both laws. A fake bank-official call that empties an account is 66D under the IT Act and also cheating by personation (BNS section 319, formerly IPC section 419) and cheating (BNS section 318, formerly IPC section 420). Police commonly register both. The IIBF exam will usually ask for the IT Act section.
How the IIBF Exam Tests This
- check_circleMatching a section to its name: 66C is identity theft, 66D is cheating by personation, 66F is cyber terrorism. Candidates swap 66C and 66D more than any other pair.
- check_circlePunishment questions: most of the family tops out at three years; 66F is the outlier at life imprisonment.
- check_circleStatus questions: 66A is struck down, not merely amended.
- check_circleLink to section 43: the question may describe a section 43 act and ask what makes it criminal. The answer is dishonest or fraudulent intent.
FAQs
What is the punishment for hacking under the IT Act?expand_more
The Act does not use the word hacking. Unauthorised access and the related acts in section 43, done dishonestly or fraudulently, are punishable under section 66 with up to three years' imprisonment, a fine up to ₹5 lakh, or both.
What is section 66C of the IT Act?expand_more
Identity theft: fraudulently or dishonestly using another person's electronic signature, password or other unique identification feature. The maximum is three years' imprisonment plus a fine up to ₹1 lakh.
Is section 66A of the IT Act still valid?expand_more
No. The Supreme Court struck it down on 24 March 2015 in Shreya Singhal v. Union of India. It cannot be used to prosecute anyone.
Are IT Act section 66 offences bailable?expand_more
Section 66, and 66B to 66E, carry a maximum of three years, so under section 77B they are bailable and cognizable. Cyber terrorism under 66F, punishable up to life, falls outside that bailable rule.
Next steps
- Section 43 & 43Aarrow_forward
- BNS Offencesarrow_forward
- Identity Theftarrow_forward
- IT Act 2000arrow_forward
120 questions, 2 hours, scored instantly.