Identity theft in India today looks like this: a loan you never took appearing on your CIBIL report, a SIM issued on your Aadhaar, a mule bank account opened with your KYC, or your personal data circulating after a breach. Each of these has a legal remedy — but only if the record is corrected formally, not just disputed on the phone.
We handle the full chain: criminal complaint for the identity theft itself, notices to the institutions that failed to verify, and the cleanup — credit bureau corrections, account closures and documentation that protects you from future liability.
Common matters in this practice area
- Fraudulent loans and credit cards taken on stolen PAN/Aadhaar — CIBIL/credit report cleanup
- SIM swap fraud and mobile number takeover
- Bank accounts opened in your name and used as mule accounts
- KYC data misuse by agents, apps or insiders
- Personal data leaks and stalking enabled by leaked data
- Corporate data breach response and employee data theft
The legal framework we use
Identity theft is squarely punishable under Section 66C of the IT Act, with cheating by personation under 66D and forgery provisions of the BNS applying to fabricated documents. The Digital Personal Data Protection Act, 2023 adds duties on companies that mishandle your data. Formal legal notices under this framework move institutions that ignore ordinary complaints.
Identity Theft & Data Privacy — Frequently Asked Questions
A loan I never took is showing on my CIBIL report. What do I do?
Do not just raise a bureau dispute — that alone rarely sticks. File a cyber complaint for identity theft, send a legal notice to the lender demanding the fraud be recorded, and then push the bureau correction with that paper trail. This is the sequence that actually clears reports.
A bank account was opened using my documents and used for fraud. Am I liable?
You could face questions until the record shows you were a victim of identity theft. Acting early — complaint, notice to the bank, KYC audit demand — protects you before any freeze or investigation reaches you.
Can I take action against a company that leaked my data?
Yes. The DPDP Act, 2023 and IT Act provisions create real obligations, and complaints can be pursued against negligent data fiduciaries. Individual criminal action also lies against whoever misused the leaked data.
