A friend of mine found out someone had made an Instagram account using her photos, her name, even her college details, and was messaging guys on her behalf. She didn’t know for three weeks. Found out because one of them showed up outside her hostel gate asking why she “cancelled the plan.”
That’s the kind of thing this article is actually about.
Quick correction before we go further, because half the internet gets this wrong: Section 66D of the IT Act does not cover “cyberbullying” in general. It’s narrower than that. It’s about cheating by personation, someone pretending to be another person online to trick or deceive people. If the harassment you’re dealing with involves a fake profile, someone posing as you (or as someone else, like a bank official or a recruiter) to con people, that’s 66D territory. If it’s just abusive messages, morphed photos, or someone tracking your every move online, you need different sections, and I’ll get into those too, because in real cases they usually overlap anyway.
What you’re actually dealing with
There isn’t one single “cyberbullying law” in India. It’s more like a patchwork, and knowing which piece of the patchwork applies to your situation matters when you’re writing a complaint.
Fake profile pretending to be you? That’s Section 66D, IT Act.
Someone got into your actual account, your real Instagram, your real email? Different thing entirely, that’s Section 66C, identity theft.
Someone messaging you nonstop after you’ve made it obvious you want nothing to do with them, or watching your online activity like a hawk? Section 78 of the Bharatiya Nyaya Sanhita covers that now. This used to be Section 354D under the old IPC before the law changed in July 2024, so if you’re reading older articles online, don’t be confused when they cite 354D. Same idea, new number.
Threats, “I’ll post your photos,” “I’ll make sure everyone knows”? That’s criminal intimidation under Section 351 BNS. And if it’s coming from some anonymous handle with no real name attached, there’s a specific version of this, Section 351(4), built exactly for that.
Lies being spread about you, fake screenshots, made up stories meant to damage your name? Defamation, Section 356 BNS.
Morphed pictures, leaked private images, anything sexual shared without consent? This is where things get genuinely serious and you should not sit on it. Section 66E of the IT Act (privacy violation), Section 67 (obscene material online), Section 67A if it’s sexually explicit. If the person involved is under 18, POCSO applies immediately and the whole thing moves with a different urgency.
Most real situations aren’t clean cut. A fake account spreading rumors while also threatening you could pull in three or four sections at once. Don’t limit your complaint to just one.
Stop replying. Start saving everything.
I know the urge to respond is strong. To correct the record, to argue back, to send one angry message just to feel like you did something. Don’t. Every reply becomes something a lawyer eventually has to untangle, and it almost never cools things down anyway.
What actually helps is treating this like evidence collection from day one.
Screenshot everything, and I mean everything, the message, the profile, the URL bar, the timestamp, all in the same frame if you can manage it. Don’t crop tightly just to capture the “bad part,” because a stripped down screenshot without context is easy to dismiss later. If something is likely to disappear, an Instagram story, a Snapchat post, screen record it instead of just screenshotting, since those things vanish in 24 hours and you won’t get a second shot at it.
Keep a running note of dates too. Not because you’ll need to be precise to the minute, but because your memory of “when did this start” gets fuzzy fast once you’re stressed, and a written timeline saves you later.
One thing people mess up constantly: they edit or crop their screenshots to make them look neater before sending them anywhere official. Don’t. Keep them raw. If it ever needs to hold up as evidence, authenticity matters more than presentation.
Report it on the platform, but don’t stop there
Yes, report the account on Instagram or wherever this is happening. Under India’s IT Rules 2021, platforms are supposed to act fairly quickly on this stuff, especially anything involving impersonation or intimate images, where there’s a 24 hour takedown expectation.
But be clear eyed about what this does and doesn’t do. It gets the content off the internet. It does nothing to the person who posted it. Think of it as one step, not the whole solution.
File a complaint on cybercrime.gov.in
This is the government’s official cyber crime portal and honestly it’s the fastest formal step available to you right now.
Pick “Report Other Cyber Crimes” if it’s general harassment or a fake profile situation. If it involves sexual content or you’re a woman dealing with stalking, there’s a dedicated “Women/Child Related Crime” category that tends to move faster and handles your identity with more care during the process.
Upload whatever you’ve collected. You’ll get a complaint number at the end, write it down somewhere other than just your phone, because you’ll be quoting it again later.
If money got involved anywhere, or things feel urgent, call 1930. That’s the dedicated cybercrime helpline and it exists for exactly this kind of time pressure situation.
Actually filing an FIR
You don’t need a lawyer for this part. Walk into any police station, and because of the Zero FIR rule, you can technically file at any station regardless of where the harassment actually happened, they’re required to forward it to the right jurisdiction from there.
Be specific about the sections. This matters more than people think. A vague complaint gets a vague response from an already overloaded system. If your situation involves a fake profile plus threats, name both:
Section 66D, IT Act, for the impersonation. Section 351, BNS, if there were threats. Section 356, BNS, if false claims were damaging your reputation. Section 66E, IT Act, if private images were shared without your okay.
Bring printed screenshots, your cybercrime.gov.in complaint number, and a written timeline. Officers handling these cases are usually stretched thin across dozens of complaints, so walking in organized genuinely changes how fast things move.
If they’re dragging their feet or refusing to register your FIR, you’re not stuck. You can write directly to the Superintendent of Police, who’s obligated to act, or go straight to a magistrate under Section 156(3) of the BNSS if the police keep sitting on it.
Don’t skip your college
Legal processes take time, sometimes a lot of it. Your college’s own systems can move faster and there’s no reason not to run both tracks at once.
Most universities are bound by the UGC’s Anti Ragging Regulations from 2009, which cover psychological harassment and have been read to include online harassment between students. File with your Anti-Ragging Committee if the person harassing you is also a student.
If there’s any sexual element and you’re a woman, your Internal Complaints Committee, usually set up under the POSH framework even though POSH is technically a workplace law, often has jurisdiction over student cases too depending on your college’s own policy. Check the student handbook, or just ask the Dean’s office directly.
Speaking of which, your Dean of Student Affairs or Grievance Cell can hand out disciplinary action that sometimes lands faster and harder than a court case, particularly if the person harassing you is genuinely afraid of getting suspended.
What actually happens once you file
The case goes to the cyber cell. They pull IP logs, device records, whatever the platform hands over when police make an official request, and slowly work toward identifying whoever’s behind the account, even the anonymous ones. It’s not instant. Weeks, sometimes longer, especially if VPNs or foreign servers are involved.
If they identify the person and there’s enough to go on, charges get filed under whatever sections you cited. Section 66D carries up to three years plus a fine that can go up to a lakh. Stalking under Section 78 BNS goes up to three years for a first offence, five for repeat. These numbers matter, colleges and employers do background checks, and a record like this follows someone.
Where students go wrong
Deleting the harassment because it’s embarrassing to look at. I get the instinct, but it’s the single worst thing you can do to your own case.
Confronting the person yourself, or letting friends “handle it.” This tends to blow up rather than defuse, and can hand the harasser a claim that you’re the one being aggressive.
Sitting on it for weeks before reporting. Evidence disappears, accounts get deleted, and if a minor is involved, time actually matters for how the investigation unfolds.
Assuming anonymous means untraceable. It doesn’t, not really. IP addresses, device fingerprints, payment trails if money was involved somewhere, cyber cells have gotten noticeably better at tracing this stuff over the last few years.
Going through it completely alone. Tell someone. A friend, a parent, your college counselor. The legal process can be slow and honestly a bit numbing, and there’s no reason to carry that by yourself while it plays out.
Questions people actually ask
Does 66D cover general bullying or just impersonation? Just impersonation. Cheating someone by pretending to be another person through a device or computer resource, that’s the whole scope of it. Regular bullying without any fake identity involved needs other sections, like 351 or 356 BNS.
What if I don’t even know who’s behind the account? Doesn’t matter, you can still file. FIRs against unknown persons happen all the time, and the cyber cell’s job is precisely to figure out who’s on the other end using IP logs and platform data.
Is 66D bailable? Yes, it’s bailable and cognizable, meaning police can register the FIR and start investigating right away, but the accused can also get bail without too much trouble. This is part of why pairing it with something heavier, like criminal intimidation, matters if you want real consequences.
The account seems to be based outside India, does that change anything? You can still file here. It gets slower and more complicated because of jurisdiction issues, but Indian cyber cells do work with international platforms and sometimes foreign law enforcement when needed. Keep documenting either way, since platform takedowns work regardless of where the account is based.
Will my college find out if I go to the police? Not automatically, no. The FIR is between you and the police unless you bring your college into it yourself, or the accused ends up facing college disciplinary action alongside the criminal case.
Can I get the content removed without filing a police complaint first? Yes. Platform reporting and the cybercrime.gov.in complaint don’t require an FIR beforehand. A lot of people start there just to get the harmful stuff off the internet quickly, then decide separately whether to pursue the police route.
I’m not even sure this counts as serious enough, am I overreacting? Probably not. If something online is scaring you, humiliating you, or making you feel unsafe, that’s reason enough to document and report it. Let the cyber cell decide what’s serious, that’s their job, not yours. Nobody has ever regretted saving too much evidence.
Do I need a lawyer for any of this? Not for the FIR or the online complaint, you can do both yourself. A lawyer becomes worth it once things move toward prosecution, or if the police aren’t budging and you need to push a Section 156(3) application in front of a magistrate.
If you’re dealing with this right now, here’s the short version. Stop engaging. Start screenshotting. File on cybercrime.gov.in today. Walk into a station with everything printed out. The system is genuinely built to help you here, it just needs you to hand it something to work with first.
