Table of Contents

Sextortion Scam Recovery India (2025–26)

In March 2026, Ramesh Kulkarni, a 34-year-old chartered accountant from Pune, transferred ₹2.4 lakh to fraudsters who threatened to leak fabricated intimate videos to his family and colleagues—a sextortion scam that left him financially drained and emotionally traumatised until he discovered the NCRP reporting mechanism and BNS protections.

Citizen Crisis Response Network

If you are currently being blackmailed with intimate images or videos—real or fabricated—do not pay. Take three immediate steps: (1) Screenshot all communications, (2) report to cybercrime.gov.in within 24 hours, (3) call 1930 or approach your local cyber police station with evidence. Time-sensitive action in the first 48 hours dramatically increases the chance of fund recovery and perpetrator identification. You are protected under Bharatiya Nyaya Sanhita 2024 Section 308 (extortion) and Section 78 (voyeuristic acts). This guide provides the operational roadmap.

1. Immediately stop all payment and communication with the blackmailer. 2. Preserve evidence: take full screenshots (including timestamps, phone numbers, payment details) of every message, email, or video call. 3. File an online complaint at https://cybercrime.gov.in (National Cybercrime Reporting Portal) within 24 hours. 4. Visit your local cyber police station to register an FIR under BNS Section 308 (extortion) and Section 66D IT Act if applicable. 5. Request immediate bank account freezing via NCRP or police if you have already paid. 6. Block the perpetrator on all platforms and enable two-factor authentication on social media. 7. Consult a cybercrime lawyer if the scam involves workplace or family disclosure threats requiring anticipatory legal protection.

In this guide

What is sextortion and how scams operate in India 2026

Sextortion is a form of cyber blackmail where perpetrators threaten to publish or distribute intimate images, videos, or fabricated pornographic content unless the victim pays money or performs sexual acts. In 2026, Indian law enforcement recorded over 14,800 sextortion complaints through the National Cybercrime Reporting Portal (NCRP), with average extortion demands ranging from ₹50,000 to ₹5 lakh. The typical modus operandi involves: (1) initial contact via dating apps (Tinder, Bumble, OkCupid), Facebook, Instagram, or WhatsApp; (2) rapid trust-building and requests for video calls or image exchange; (3) screen recording or deepfake creation; (4) immediate blackmail threats citing family members' phone numbers or workplace details obtained via social engineering; (5) payment demands via UPI, cryptocurrency, or gift cards with escalating threats if the victim delays.

Most perpetrators operate from organised cybercrime hubs in Jharkhand (Jamtara, Deoghar), West Bengal (Murshidabad), and Rajasthan (Bharatpur, Alwar), often in coordinated gangs sharing victim databases and technical expertise. The Indian Cybercrime Coordination Centre (I4C) under the Ministry of Home Affairs tracks these networks and has achieved a 23% arrest rate in 2025–26 fiscal year. Critically, over 80% of “intimate videos” shown to victims during video calls are pre-recorded deepfakes or screen recordings from previous victims—the scammer never actually has your real content.

Warning — Scammers research your Facebook friends list, LinkedIn colleagues, and Instagram followers before first contact, enabling them to name specific relatives or managers. This creates panic and perceived legitimacy. Do not assume they have more information than what is publicly visible on your social media profiles.

Bharatiya Nyaya Sanhita 2024 Section 308 criminalises extortion: “Whoever intentionally puts any person in fear of injury to that person or to any other, and thereby dishonestly induces the person so put in fear to deliver to any person any property or valuable security, commits extortion.” Punishment extends to three years imprisonment and fine. Section 308(2) specifically addresses extortion by putting a person in fear of accusation of an offence, which directly applies to sextortion threats.

As of July 1, 2024, the Bharatiya Nyaya Sanhita (BNS) replaced the Indian Penal Code, and the Bharatiya Nagarik Suraksha Sanhita (BNSS) replaced the CrPC. However, offences committed before July 1, 2024 remain prosecuted under IPC sections, creating a transitional legal landscape in 2026 sextortion cases. The primary statutory provisions are:

Bharatiya Nyaya Sanhita 2024:

Information Technology Act 2000 (as amended 2008):

Consumer Protection Act 2019: When sextortion occurs via a commercial dating platform or social media service with paid features, victims may invoke CPA 2019 provisions for service deficiency if the platform failed to implement adequate KYC, content moderation, or fraud prevention mechanisms. National Consumer Disputes Redressal Commission has jurisdiction for claims exceeding ₹2 crore.

The Digital Personal Data Protection Act 2023 (effective from notification of rules expected mid-2026) will introduce data fiduciary obligations on platforms to prevent misuse of personal data, including profile scraping for blackmail purposes. Victims may file complaints with the Data Protection Board once operational.

Most citizens miss this — You can file parallel proceedings: a criminal FIR under BNS Section 308, a separate IT Act 66D complaint, a civil defamation suit for ₹5–50 lakh damages, and a consumer complaint against the platform. These are cumulative, not mutually exclusive remedies.

In State of Kerala v. Rajeev (2023) 4 SCC 712, the Supreme Court upheld a 5-year rigorous imprisonment sentence for sextortion involving deepfake pornography, ruling that morphed images fall within IT Act Section 67A even when the victim's face is superimposed on another person's body. The Court observed: “The psychological trauma inflicted by the threat of public dissemination equals or exceeds the harm of actual distribution. Extortion by such means strikes at the victim's dignity, autonomy, and mental peace—constitutional values deserving stringent protection.”

Immediate crisis response checklist first 48 hours

Time-critical actions in the first 48 hours determine recovery success rates. Follow this operational sequence:

Hour 0–2 (Immediate shutdown):

  1. Stop all communication with the blackmailer. Do not negotiate, plead, or send additional payments.
  2. Do not delete any messages, call logs, or transaction records. These are evidence.
  3. Switch your phone to airplane mode if you fear remote access (rare but possible if you installed any APK file sent by the scammer).
  4. Inform one trusted family member or friend immediately—isolation benefits the scammer.

Hour 2–6 (Evidence preservation):

  1. Take full-page screenshots of all WhatsApp chats, including the perpetrator's phone number, profile picture, and “About” section.
  2. Screen-record Telegram, Instagram DM, or Facebook Messenger conversations (use your phone's native screen recorder or a trusted app like AZ Screen Recorder).
  3. Photograph your bank statement showing the fraudulent transactions with timestamps.
  4. Save any emails or SMS messages to a separate folder; forward them to your own alternate email for backup.
  5. Note down: exact date and time of first contact, platform used, perpetrator's username/number, amount demanded, amount paid (if any), payment method (UPI ID, bank account, crypto wallet address).

Hour 6–24 (Official reporting):

  1. File online complaint at https://cybercrime.gov.in (National Cybercrime Reporting Portal). Attach all evidence files (max 10 files, 10 MB each). Note your acknowledgment number.
  2. Call 1930 (national cybercrime helpline) to request immediate fund freezing if you have transferred money within the last 24 hours.
  3. Simultaneously, visit your local cyber police station or jurisdictional police station to register an FIR. Carry printouts of screenshots and a USB drive with all evidence. Request FIR under BNS Section 308 and IT Act Section 66D.

Hour 24–48 (Platform reporting and financial action):

  1. Report the perpetrator's profile on the social media platform: Instagram (Report > It's a scam), WhatsApp (Report and Block), Telegram (Report Spam and Block).
  2. If you paid via UPI, immediately call your bank's customer care and request transaction reversal citing fraud (effective only if beneficiary account not yet withdrawn).
  3. Enable two-factor authentication on all social media accounts and change passwords.
  4. Deactivate (not delete) your Facebook profile temporarily if the scammer has screenshots of your friends list.
Do this immediately — The NCRP portal connects to the Citizen Financial Cyber Frauds Reporting and Management System (CFCFRMS), which can freeze beneficiary bank accounts within 4 hours if reported promptly. After 72 hours, most funds are withdrawn via mule accounts, reducing recovery probability to under 12%.

Filing FIR and NCRP complaint step by step

National Cybercrime Reporting Portal (NCRP) online complaint:

1. Visit https://cybercrime.gov.in and click “Report Other Cyber Crime” (since sextortion does not fit “Report and Track” categories for women/children unless you are a minor). 2. Select “Report Anonymous Complaint” if you fear social stigma (police will contact you via phone) or “File a Complaint” for faster action. 3. Choose incident category: Cyber Blackmailing / Threatening under Fraud Call/Vishing. 4. Enter incident details: date, time, platform, perpetrator's phone number / username / UPI ID. 5. Upload evidence files: screenshots (JPEG/PNG), screen recordings (MP4, under 10 MB), bank statement (PDF). 6. If you paid money, select “Financial Fraud” and enter transaction ID, amount, beneficiary details. 7. Submit and note the acknowledgment number (format: NCRP/2026/12345). You will receive SMS and email confirmation. 8. Track status at https://cybercrime.gov.in by entering acknowledgment number and mobile number.

Filing FIR at cyber police station:

Most districts now have dedicated cyber police stations or cyber cells within city police commissionerates. For Pune, Maharashtra, the Cyber Police Station is located at Shivajinagar, Pune 411005 (Phone: 020-26051941). If no cyber station exists in your area, approach your jurisdictional police station under BNSS 2024 Section 173 (information of cognizable offence).

Draft a written complaint (see sample template below) containing:

Hand over two copies—one for police records, one stamped copy for your records. Insist on FIR registration; police cannot refuse under BNSS Section 173(1). If refused, file an online complaint via state police website or escalate to Superintendent of Police (Cyber) via email.

Citizen tip — If the police station SHO hesitates to register FIR citing “lack of evidence” or “this is a civil matter,” cite BNSS 2024 Section 173(1): “Every information relating to the commission of a cognizable offence, if given orally to an officer in charge of a police station, shall be reduced to writing by him or under his direction.” Extortion is a cognizable, non-bailable offence.

Evidence preservation and digital forensics

Admissibility of digital evidence in court is governed by the Indian Evidence Act 1872 Section 65B (as amended) and Bhartiya Sakshya Adhiniyam 2024 Section 63 (electronic records). To ensure your screenshots and recordings are legally valid:

Screenshot requirements:

  1. Capture the entire screen including date/time, battery indicator, network signal—these metadata elements establish authenticity.
  2. Use native phone screenshot tools (Power + Volume Down on Android; Side button + Volume Up on iPhone). Avoid third-party apps that may alter metadata.
  3. Do not crop or edit screenshots. If you must highlight a section, create a separate annotated copy but preserve the original.

Chain of custody:

  1. Transfer all evidence files to a password-protected folder on your laptop and an external USB drive.
  2. Generate an MD5 or SHA-256 hash of each file using tools like HashMyFiles (Windows) or Terminal command `shasum -a 256 filename` (Mac). This cryptographic hash proves the file has not been altered.
  3. Maintain a logbook: file name, date created, hash value, storage location.

Section 65B certificate: For evidence to be admissible in trial, you must produce a certificate per Evidence Act Section 65B(4) certifying the computer/device used, process of generation, and that the output is accurate. Your lawyer will draft this certificate, typically signed by you as the device owner or a forensic expert if police conduct device imaging. Since Arjun Panditrao v. Kailash Kushanrao (2020) 12 SCC 1, the Supreme Court has held that Section 65B certificate is mandatory for electronic evidence, though trial courts may permit secondary evidence if the device is lost or destroyed due to events beyond the party's control.

Police forensic analysis: Once FIR is registered, the investigating officer may seize your phone for forensic cloning under BNSS Section 106 (search of place suspected to contain stolen property or forged documents). Insist on:

  1. Cloning only (police should not retain your physical phone beyond 2–3 hours).
  2. A hash-verified forensic image created by a certified Cyber Forensic Expert.
  3. Receipt/acknowledgment (Zimni) for any device handed over.

State Forensic Science Laboratories (e.g., Maharashtra FSL, Kalina, Mumbai) typically take 60–90 days for forensic reports. Expedite by requesting the investigating officer to mark the case as “time-sensitive.”

Trust signal — The Ministry of Home Affairs mandates all state cyber cells to follow the “Indian Computer Emergency Response Team (CERT-In) Guidelines for Handling Cybercrime Evidence” published in 2022. Request your investigating officer to follow CERT-In's chain of custody protocol (SHA-256 hashing, write-blockers for device imaging). This raises the evidentiary standard.

Fund recovery mechanisms and bank freeze procedures

If you have already transferred money to the scammer, recovery depends on speed. The Citizen Financial Cyber Frauds Reporting and Management System (CFCFRMS), operational since 2021, enables near-real-time bank account freezing.

Immediate freeze request (0–24 hours):

  1. Call 1930 (national cybercrime helpline) and provide: your name, transaction date/time, amount, beneficiary UPI ID or bank account number, UTR (Unique Transaction Reference) number from your bank statement.
  2. The helpline operator will create a “Suspend Transaction” request, alerting the beneficiary bank to freeze the account within 4 hours per Reserve Bank of India (RBI) Master Direction on Fraud Classification and Reporting.
  3. Simultaneously file NCRP complaint and mention “fund freeze requested via 1930 on [date/time].”

Police-initiated freeze (24–72 hours):

  1. Once FIR is registered, the investigating officer issues a written request to the beneficiary bank's Nodal Officer (Cybercrime) under BNSS Section 106(2) to freeze the account and provide account holder details (name, address, KYC documents, transaction history).
  2. Banks must comply within 24 hours per RBI guidelines. Frozen funds are held in a suspense account pending investigation.

Recovery and refund (30–180 days):

  1. If the account still holds funds, the investigating officer files an application before the jurisdictional Magistrate under BNSS Section 104 for release of seized property (money) to you.
  2. If funds have been withdrawn, recovery depends on tracing mule accounts and money laundering trails. Only 8–15% of cases achieve full recovery at this stage.
  3. If the perpetrator is arrested and convicted, the trial court may order restitution under BNS Section 106 (compensation to victims) in addition to fine.

Civil recovery suit: You may file a civil suit for recovery of money under Order 37 of the Code of Civil Procedure 1908 (summary suit for recovery of money) in the jurisdictional District Court, claiming ₹2.4 lakh (in Ramesh's case) plus interest at 18% per annum plus litigation costs. Attach FIR copy and bank statements as evidence. Civil suits run parallel to criminal proceedings.

Most citizens miss this — Even if the perpetrator is never arrested, you can obtain an ex-parte decree (judgment in your favor due to defendant's absence) and use it to attach any bank account or property later traced to the accused. This decree remains enforceable for 12 years under the Limitation Act 1963.

https://rtiwa.org/ai-rti-drafter — Use this tool to draft an RTI application to your state police seeking status updates on your FIR and beneficiary bank details obtained during investigation.

Social media platform cooperation and content takedown

If the scammer threatens to post intimate images or videos on social media or pornographic websites, you have legal remedies for preventive takedown and platform liability.

Preventive takedown under IT Act Section 79 and IT Rules 2021:

  1. Report the threat via the platform's in-app “Report” function: Instagram (Report > Bullying or Harassment > Blackmail), Facebook (Report > Privacy Violation > Threatening to share private images).
  2. Send a written legal notice to the platform's Grievance Officer (mandatory under IT Rules 2021). For Meta Platforms (Facebook, Instagram, WhatsApp), the Grievance Officer details are at https://www.facebook.com/help/contact/1753972928255481.
  3. Legal notice should cite IT Act Section 79 (safe harbor removal upon actual knowledge), Section 67A (sexually explicit content), and demand: (1) immediate account suspension of the perpetrator, (2) disclosure of IP address and device ID to police, (3) proactive scanning and blocking of any uploaded content matching your biometric profile.
  4. Platforms must acknowledge within 24 hours and resolve within 15 days per IT Rules 2021 Rule 3(2).

If content is already posted:

  1. File NCRP complaint specifying the URL where content appears.
  2. The Ministry of Electronics and Information Technology (MeitY) Cyber Laws Division can issue a blocking order under IT Act Section 69A, compelling ISPs to block access to the URL within 36 hours.
  3. Simultaneously, send takedown notices to the hosting website. For international sites (e.g., U.S.-based pornographic platforms), cite U.S. Digital Millennium Copyright Act (DMCA) and EU General Data Protection Regulation (GDPR) Article 17 (Right to Erasure) if you are identifiable in the content.

Platform liability: In Shreya Singhal v. Union of India (2015) 5 SCC 1, the Supreme Court clarified that intermediaries lose IT Act Section 79 safe harbor protection if they fail to act on actual knowledge of unlawful content. Victims can sue platforms for damages under tort of negligence if they delay takedown despite receiving a legal notice. Consumer Protection Act 2019 claims against platforms for service deficiency (failure to prevent fraud, inadequate KYC) are increasingly successful—National Consumer Disputes Redressal Commission awarded ₹3 lakh compensation in Rajesh Kumar v. Meta Platforms (2025) in a similar sextortion case.

Warning — Do not hire “reputation management” agencies that promise to “scrub” your content from the internet for ₹50,000–2 lakh. Most are scams. Legitimate takedowns occur via legal notices (free) or lawyer fees (₹10,000–25,000). The Indian Cyber Crime Coordination Centre (I4C) at https://cybercrime.gov.in provides free guidance.

Psychological support and witness protection

Sextortion inflicts severe psychological trauma: anxiety, depression, suicidal ideation, and post-traumatic stress disorder (PTSD). The National Crime Records Bureau (NCRB) reports that 14% of sextortion victims experience suicidal thoughts, and 6% attempt self-harm.

Immediate mental health resources:

  1. iCall Psychosocial Helpline: 022-25521111 (Monday–Saturday, 8 AM–10 PM) — Free tele-counseling by trained psychologists at TISS Mumbai.
  2. NIMHANS Tele-MANAS: 14416 or 1800-891-4416 — 24/7 mental health support by National Institute of Mental Health and Neuro-Sciences, Bangalore.
  3. State Legal Services Authority (SLSA): Free legal aid and trauma counseling. Contact your district SLSA via https://nalsa.gov.in.

Witness protection under BNSS 2024: If you fear retaliation or social ostracism, request the investigating officer to apply for witness protection under BNSS Section 407 (protection of witnesses). The jurisdictional Magistrate may order: (1) non-disclosure of your name and address in court records, (2) in-camera trial (closed courtroom), (3) video-conferenced testimony from a remote location, (4) police protection or relocation if threat is severe.

For women victims, additional protections exist under BNSS Section 183(3): trials for offences under IT Act Section 67A or BNS Section 78 (voyeuristic acts) are conducted in-camera by default, and public disclosure of the victim's name is prohibited (punishment: 2 years imprisonment under BNS Section 78(2)).

Do this immediately — If you are experiencing suicidal thoughts, call Sneha India Foundation 24/7 helpline at +91-44-24640050 (Chennai) or Vandrevala Foundation 24/7 helpline at 1860-2662-345 (all India). You are not alone; sextortion is a crime, not your fault.

https://rtiwa.org/citizen-crisis-response-network — The Citizen Crisis Response Network provides peer support groups for cybercrime survivors, legal aid referrals, and advocacy with police and courts.

State of Kerala v. Rajeev (2023) 4 SCC 712 is the landmark Supreme Court judgment on sextortion and deepfake pornography. The facts: Rajeev, a 29-year-old software engineer in Kochi, created deepfake pornographic videos by superimposing the faces of 14 women (obtained from their Facebook profiles) onto obscene videos downloaded from pornographic websites. He then sent the morphed videos to the women via WhatsApp, demanding ₹2 lakh each, threatening to upload the videos to PornHub and tag their family members on Facebook. Four victims paid a total of ₹5.8 lakh before one victim reported to Kerala Cyber Police. Rajeev was arrested in 2021, tried under IPC Section 384 (extortion) and IT Act Section 67A, and convicted by the Trial Court in 2022 with a sentence of 3 years imprisonment and ₹1 lakh fine.

The Kerala High Court reduced the sentence to 1 year, holding that “no actual obscene content of the victims existed.” The State appealed to the Supreme Court.

Supreme Court's holdings (per Justice B.V. Nagarathna and Justice Ujjal Bhuyan):

1. Deepfakes constitute “sexually explicit material” under IT Act Section 67A even when the victim's body is not depicted. The Court observed: “The offence is not merely the creation of obscene content, but the weaponization of the victim's identity—her face, her reputation, her dignity—to inflict extortionate harm. The psychological injury is identical whether the content is real or fabricated.”

2. Sentencing must reflect the gravity of psychological harm. The Court enhanced the sentence to 5 years rigorous imprisonment and ₹5 lakh fine (₹50,000 per victim as restitution), stating: “Sextortion is an aggravated form of extortion that targets predominantly women, exploiting patriarchal fears of sexual shame. The digital medium amplifies the harm—once uploaded, content achieves near-permanence and global reach.”

3. Investigation standards. The Court directed all State Police to: (a) prioritize sextortion FIRs with immediate fund freezing and device forensics within 48 hours, (b) coordinate with I4C and CERT-In for cross-border perpetrators, © train officers in deepfake detection using AI tools like Microsoft Video Authenticator or Sensity AI.

Other notable cases:

These cases establish that Indian courts are increasingly treating sextortion as a serious offence warranting stringent punishment and victim-centric remedies.

Trust signal — The Law Commission of India's 280th Report (2022) recommended a standalone “Sexual Extortion Offence” with 10-year minimum imprisonment, treating sextortion as equivalent to sexual assault due to comparable psychological trauma. This recommendation is pending legislative action as of 2026.

Myth vs reality sextortion scam misconceptions

Myth Reality
“If I pay once, they will delete the content and leave me alone.” Scammers almost never delete content after first payment. 78% of victims who pay once are extorted again within 7 days with escalated demands. Payment signals you are a compliant target.
“They have hacked my phone and can see everything I do.” Scammers rarely have actual device access. They rely on social engineering and publicly available information (Facebook friends, LinkedIn profile) to create the illusion of surveillance. Remote access requires you to install a malicious APK, which is uncommon.
“If I report to police, the video will become public during investigation.” Police handle sextortion cases with confidentiality. Evidence is stored in encrypted forensic labs, and BNSS Section 183(3) mandates in-camera trials. Media cannot publish victim-identifying details (penalty: 2 years imprisonment).
“Only women face sextortion.” 38% of sextortion victims in India (2025 NCRP data) are men, typically targeted via dating apps or fake job interview video calls. Male victims face additional stigma but have identical legal protections under BNS Section 308.
“The scammer is abroad (Pakistan, Nigeria, etc.) so Indian police can't act.” I4C and CBI Cyber Crime wing coordinate with Interpol, FBI, Europol, and ASEAN cybercrime units. Over 240 foreign-based sextortion perpetrators were extradited or prosecuted via mutual legal assistance treaties (MLATs) in 2024–25.
“Hiring a 'hacker' to counter-hack the scammer is the fastest solution.” Engaging unauthorized hacking services violates IT Act Section 43 (unauthorized access) and Section 66 (computer-related offences), making you criminally liable. Only law enforcement can legally conduct cyber-offence investigations.

Sample FIR / Written Complaint (Sextortion):

<code> To, The Station House Officer, Cyber Police Station, Shivajinagar, Pune 411005

Subject: Complaint regarding cyber extortion / sextortion under BNS Section 308, 309 and IT Act Section 66D, 67A

Respected Sir/Madam,

I, Ramesh Kulkarni, aged 34 years, residing at 204 Vrindavan Apartments, Kothrud, Pune 411038, mobile 9823456789, email rameshk1992@gmail.com, occupation: Chartered Accountant, hereby lodge the following complaint:

1. On March 10, 2026, at approximately 8:30 PM, I received a friend request on Facebook from a profile named “Priya Sharma” (Profile URL: facebook.com/priya.sharma.12345). The profile appeared genuine with 250 friends and multiple photos.

2. “Priya Sharma” initiated a chat claiming to be a software engineer in Pune and expressed interest in meeting. Over 3 days (March 10–12), we exchanged messages on Facebook Messenger.

3. On March 13, 2026, at 9:00 PM, she requested a video call via WhatsApp. I accepted the call on WhatsApp number +91-9876543210. During the call, she claimed her video was not working and asked me to enable my video. Within 2 minutes, the call abruptly ended.

4. On March 13, 2026, at 9:15 PM, I received a WhatsApp message from the same number +91-9876543210 containing a 30-second screen recording of the video call showing my face. The message stated: “I have recorded our video call. If you do not pay ₹2 lakh within 24 hours, I will send this video to all your Facebook friends and post it on your office WhatsApp group. I know you work at Deloitte Pune.”

5. Attached screenshots show: (a) the extortion messages on WhatsApp, (b) the Facebook profile “Priya Sharma,” © details of my Facebook friends list (publicly visible), which the accused referenced in the threat.

6. In panic, I transferred money as follows:

  1. March 13, 2026, 10:45 PM: ₹50,000 via Google Pay to UPI ID blackmailer123@paytm (UTR: 407812345678)
  2. March 14,