Identity Theft is Not a Joke, Jim!

Ramesh (name changed), a resident of Punjab, received a phone call from one of the largest banks of India regarding a two-wheeler loan. He was shocked, because he availed no such loan, and he was told to visit the branch. Upon further inquiry, he came to know six loans have been availed in his name.

As per the Norton Cyber Safety Insights Report, more than 2 in 5 Indian consumers (approximately 45 per cent) have experienced identity theft.

Identity theft is a pervasive and insidious form of cybercrime that poses a significant threat to individuals and organizations alike. It involves the unauthorized acquisition and use of someone’s personal information for fraudulent purposes. Perpetrators of identity theft, often referred to as identity thieves, exploit various modes to obtain sensitive data, wreaking havoc on victims’ lives and causing substantial financial losses.

One common mode of identity theft is phishing. In phishing attacks, scammers use deceptive emails, messages, or websites to trick individuals into revealing their personal information, such as login credentials, credit card details, or social security numbers. These fraudulent communications often appear to be from legitimate sources, making it challenging for unsuspecting victims to discern the scam.

Another mode is data breaches. In this scenario, cybercriminals infiltrate databases or systems containing vast amounts of personal information. The stolen data can include names, addresses, dates of birth, and even financial information. These breaches can be caused by security vulnerabilities or weak practices employed by organizations, putting millions of people at risk of identity theft.

Additionally, identity thieves may employ social engineering tactics. Through phone calls or in-person interactions, they manipulate individuals into divulging sensitive information. By exploiting trust or impersonating someone in authority, these criminals can obtain critical data that enables them to conduct fraudulent activities under the victim’s name.

Mail theft is another traditional method used by identity thieves. They steal personal information directly from people’s mailboxes, intercepting credit card statements, pre-approved credit offers, and other sensitive documents. Subsequently, they use the acquired information to open fraudulent accounts or make unauthorized purchases.

Furthermore, with the rise of technology, online identity theft has become increasingly prevalent. Cybercriminals use malware, keyloggers, and spyware to gain unauthorized access to victims’ computers or mobile devices, capturing login credentials and other private data.

What Can Organizations Do?

Organizations can take several proactive steps to enhance their preparedness against identity theft and safeguard sensitive data. Firstly, they should implement robust security measures such as multi-factor authentication and encryption to protect user accounts and sensitive information from unauthorized access. Regular security audits and vulnerability assessments can help identify and address potential weaknesses in the organization’s infrastructure.

Furthermore, employee training and awareness programs are crucial to educate staff about the risks of identity theft and the importance of data protection. Employees should be trained to recognize phishing attempts, social engineering tactics, and other common forms of cyberattacks.

In addition, organizations should have a well-defined incident response plan in place to swiftly and effectively handle any security breaches or data leaks. This plan should include clear protocols for reporting incidents, containing the breach, and notifying affected parties as required by law.

What to do as Individuals?

To protect against identity theft, individuals must remain vigilant. This includes using strong and unique passwords, refraining from sharing personal information over unsolicited communications, regularly monitoring financial statements, and implementing security software on devices.

If you believe you have been a victim of identity theft, you should inform the concerned authorities and also the police. Under Section 66C of the Information Technology Act, 2000 (IT Act), the crime of identity theft entails imprisonment up to 3 and also a fine of Rs. 1 lac. Section 66D of this Act prescribes a punishment of imprisonment for a maximum period of three years, a fine not exceeding one lakh rupees, or both, for using a computer resource to impersonate someone in order to cheat. An FIR can also be registered under various sections of the Indian Penal Code, 1860 (IPC). Section 419 of the IPC addresses the offense of “cheating by personation.” According to this section, whoever cheats by pretending to be another person, either in person, or by using any electronic communication device or computer resource, shall be punished with imprisonment for a term that may extend to three years, or with a fine, or both.

Section 420 of the IPC pertains to the act of defrauding someone and dishonestly inducing them to deliver property. This section prescribes a penalty that includes both a fine and imprisonment, with the maximum imprisonment term being seven years.

The IPC also contains provisions for dealing with situations involving document forgery, where a fabricated document is passed off as genuine. The penalties for such offenses are specified within the relevant sections of the IPC.

The Bharatiya Nyaya Sanhita (which is aimed at replacing the IPC) will also penalise identity theft) and Section 15 of the Digital Personal Data Protection Act, 2023 also places duties on the Data Principals, one of which is to not impersonate others while providing their data. A penalty of an amount upto Rs. 10 thousand can be imposed on Data Principals for breaching their duties.