Legal information notice: this article provides general information and isn't a substitute for advice from a qualified lawyer.
Someone has used your Aadhaar, PAN, bank details, or other personal information to open a fraudulent account, take out a loan in your name, or impersonate you online — and you’ve likely only discovered it through a surprise credit inquiry, a collections call, or a bank statement that doesn’t add up. Here’s exactly what the law provides and how to act quickly to limit the damage.
Change passwords on any potentially compromised accounts, enable two-factor authentication, and if a specific bank account or card is involved, call your bank’s fraud helpline to freeze it right away — speed matters more than anything else at this stage.
Call 1930 or file at cybercrime.gov.in, citing Sections 66C and 66D of the IT Act along with any applicable BNS provisions — this creates an official record and can trigger a freeze on fraudulently-opened accounts.
Contact CIBIL, Experian, Equifax, and CRIF Highmark to flag the fraud, dispute any fraudulent entries, and request a freeze or fraud alert on your credit profile — this prevents further loans/cards being opened in your name while the matter is investigated.
If your Aadhaar was misused, lock your biometric authentication via the UIDAI portal or app. If your PAN was used fraudulently (e.g., for a fake loan or GST registration), file a grievance directly with the Income Tax Department.
Send a written complaint (email works) to each bank, lender, or institution where fraudulent activity occurred, referencing your cybercrime complaint number — this documentation matters if you need to formally dispute liability later.
Speed genuinely determines outcomes here more than almost any other type of cyber complaint. A fraudulent loan or credit card opened in your name can be reported to the lender and disputed most easily in the first days after discovery — the longer it sits, the more it can affect your credit history and the more the fraudster has had time to move any funds drawn against your identity. If you discover identity theft, treat the first 24-48 hours as the most consequential window, even if the full investigation takes much longer.
Many victims don’t realize identity theft until well after the fact — sometimes only when applying for a loan themselves and discovering an unexplained negative mark on their credit report. If this is your situation, don’t skip the credit bureau dispute step even though the fraud may be old: bureaus are required to investigate disputed entries and can remove them from your report once verified as fraudulent, regardless of how much time has passed.
Keep every communication — emails, complaint acknowledgment numbers, bank correspondence — in one place from the start. Identity theft cases often require you to prove the same facts to multiple institutions (your bank, a credit bureau, the cybercrime cell, possibly a court), and having a single organized record saves significant time and frustration later.
| Action | Purpose |
|---|---|
| Freeze accounts, alert your bank | Stop ongoing/further financial damage immediately |
| File at cybercrime.gov.in / 1930 | Formal legal record, investigation, potential recovery |
| Credit bureau dispute | Correct your credit history, prevent further fraudulent credit |
| UIDAI/PAN grievance | Address misuse of your core identity documents specifically |
Cybercrime complaints go through cybercrime.gov.in or your local cyber cell. Credit bureau disputes go directly through each bureau’s own grievance/dispute portal. Aadhaar issues go through UIDAI; PAN issues go through the Income Tax Department’s e-filing grievance section.
Filing a cybercrime complaint, disputing entries with credit bureaus, and UIDAI/PAN grievances are all completely free.
Yes — every step above is designed for direct victim use without a lawyer. Professional help becomes useful if a bank refuses to reverse fraudulent transactions despite you following the correct process, or if you need to pursue civil recovery for losses.
Need professional legal help with this?
Find a Lawyer on VidyodayIf the identity theft happened through a specific fraudulent transaction (a fake loan app, a phishing link, or a hacked account), our guides on your bank account being hacked and filing a cyber fraud complaint cover those specific processes in more detail.
Common signs include unexplained loan/credit inquiries on your credit report, collection calls for debts you didn’t take, bank alerts for transactions you didn’t make, or your Aadhaar/PAN being flagged as already used for a service you never applied for.
Not if you can demonstrate the fraud and report it promptly — banks and RBI’s guidelines are designed to protect victims of genuine identity theft, though you’ll need to actively dispute and document the fraud rather than assume it resolves itself.
Yes — UIDAI allows you to lock your biometric authentication, which prevents it from being used for verification without you first unlocking it, adding a meaningful layer of protection.
Report it regardless of the delay — credit bureau disputes and cybercrime complaints can still be filed and investigated for older fraud, though acting sooner always improves your chances of a clean resolution.
No — once a fraudulent entry is verified as such through the dispute process, credit bureaus are required to correct your report, and the erroneous negative mark should be removed.
Legitimate banks require additional verification (in-person KYC or video KYC), but fraud does happen through compromised systems or complicit insiders — this is exactly why immediate reporting and monitoring matters.
The online complaint is legally valid and gets forwarded to the relevant cyber cell automatically, but for serious or high-value cases, following up with an in-person FIR at your local cyber police station can help ensure faster action.
Set up transaction alerts on all your accounts, periodically check your credit report (available free from bureaus periodically), and be cautious about sharing Aadhaar/PAN copies without redacting sensitive details or noting the purpose on the document itself.
This article is for general information only and does not constitute legal advice. Consult a cyber lawyer or call 1930 for guidance specific to your situation.
