Definition
A type of social engineering attack where criminals send deceptive communications (emails, SMS, fake websites) impersonating legitimate institutions to trick victims into revealing passwords, OTPs, credit card details, or other sensitive information.
Phishing is not separately codified in the IT Act — it falls under the general provisions of the IT Act and the BNS: Section 66D IT Act (cheating by personation using communication devices), Section 66C IT Act (identity theft — using the credentials obtained through phishing), and BNS Section 318 (cheating) and Section 319 (cheating by personation). Phishing attacks targeting banks ('Vishing' — voice phishing by phone) are the most common form in India. The Reserve Bank of India (RBI) has issued advisories and guidelines for banks to combat phishing. Section 75 IT Act extends liability for offences committed outside India if they involve computers, computer systems, or networks located in India.
Statutory Definition
Section 66D, Information Technology Act, 2000: 'Whoever, by means of any communication device or computer resource cheats by personation, shall be punished with imprisonment of either description for a term which may extend to three years and shall also be liable to fine which may extend to one lakh rupees.' Phishing is typically prosecuted as cheating by personation (impersonating a bank, government, or other institution) under Section 66D combined with identity theft (Section 66C) and ordinary cheating (BNS Section 318).
Etymology & Origin
From 'phishing' — a deliberate misspelling of 'fishing' (as in 'fishing' for information). The 'ph' spelling is a hacker convention from the 1980s-90s ('phone phreaking' — exploiting telephone systems). Phishing is 'fishing' for victims — using bait (fake emails, fake websites) to 'hook' people into revealing sensitive information.
Full Legal Analysis
Phishing: The Digital Lure
Phishing exploits trust — the victim trusts that the email from 'SBI' is really from SBI, that the website that looks like their bank's site is their bank's site, that the call from 'the tax department' is genuine. Criminals design these deceptions meticulously. The consequences: bank accounts emptied, credit cards maxed, personal data stolen, identities compromised. Phishing is the most common gateway to financial cyber crime in India.
Types of Phishing
(a) Email phishing: Mass emails purporting to be from banks, RBI, IRCTC, government — directing victims to fake login pages. (b) Vishing (voice phishing): Phone calls from 'bank officials' or 'police officers' claiming the victim's account has been compromised — asking for OTPs, card details. India's most common form. (c) Smishing (SMS phishing): Fraudulent SMS with links to fake websites — 'click here to verify your KYC.' (d) Spear phishing: Targeted attacks on specific individuals or organisations — using personalised information to make the deception more convincing. (e) QR code phishing: Malicious QR codes that direct to fake payment pages when scanned.
RBI Guidelines and Bank Liability
The RBI's Master Circular on Frauds (and subsequent circulars) establishes that in cases of phishing where the customer was genuinely deceived (not negligent), the bank may have to reimburse the customer — particularly if the fraud occurred due to security lapses on the bank's side (e.g., weak authentication, failure to detect unusual transaction patterns). Customers who share OTPs are generally considered negligent and bear the loss — the '1930' helpline exists to enable quick freezing of fraudulently transferred funds.
“Phishing is fraud dressed in trust’s clothing. The criminal does not break into your account — they get you to open the door. Every fake email, every fake bank call, every fake government website is an attempt to make you a participant in your own victimisation. Awareness is the best defence — and legal consequences are the best deterrent.”
This Term in Indian Statutes
Information Technology Act, 2000, 2000
"Whoever, by means of any communication device or computer resource cheats by personation, shall be punished with imprisonment of either description for a term which may extend to three years and shall also be liable to fine which may extend to one lakh rupees."
Phishing prosecuted as cheating by personation (Section 66D) + identity theft (Section 66C) + cheating (BNS Section 318); RBI guidelines on bank liability
