Yes, hacking a bank account can constitute a criminal offence in India. Unauthorized access to online banking, misuse of passwords or other authentication credentials, fraudulent electronic transactions, and theft of money through digital means can attract provisions of the Information Technology Act, 2000, the Bharatiya Nyaya Sanhita, 2023 (BNS), and other applicable laws. The exact offences depend on how the account was accessed, what information was misused, whether money was transferred, and the conduct and intention of the accused.
Bank account hacking is therefore not merely a banking dispute. It can involve both cybercrime and financial fraud.
What Does Bank Account Hacking Mean?
Bank account hacking generally refers to gaining unauthorized access to a person’s online banking account or banking credentials.
It may involve:
- Stealing internet-banking passwords
- Obtaining UPI credentials through deception
- Misusing login credentials
- Taking control of a banking application
- Using stolen authentication information
- Accessing an account without authorization
- Making unauthorized transfers after obtaining access
A person does not necessarily need to “break” a bank’s computer system for criminal liability to arise. Unauthorized access combined with fraudulent conduct can be sufficient to trigger applicable legal provisions.
What Does the Information Technology Act Say?
The Information Technology Act, 2000 contains provisions dealing with unauthorized access and computer-related offences.
Section 43 covers various acts involving unauthorized access to or damage of computer resources and provides for civil liability in specified circumstances. When a person performs an act covered by Section 43 dishonestly or fraudulently, Section 66 makes it a criminal offence. Section 66 provides for imprisonment of up to three years, or a fine of up to ₹5 lakh, or both.
This framework can become relevant when unauthorized access to computer resources is used in connection with banking fraud.
What If Someone Steals a Banking Password?
The Information Technology Act also specifically addresses identity theft.
Under Section 66C, dishonestly or fraudulently using another person’s electronic signature, password or other unique identification feature can constitute an offence. The provision provides for imprisonment of up to three years and a fine that may extend to ₹1 lakh.
For example, if a person obtains another customer’s banking password and uses it dishonestly to access or operate an account, Section 66C may become relevant depending on the facts.
What If Money Is Transferred From the Hacked Account?
The situation can become more serious when unauthorized access is followed by the transfer or withdrawal of money.
Depending on the circumstances, provisions of the Bharatiya Nyaya Sanhita, 2023 may also apply. For example, fraudulent conduct involving deception and dishonest delivery of property can potentially fall within the law relating to cheating.
If forged electronic records or documents are created or used as part of the fraud, the BNS provisions concerning false documents, electronic records and forgery may also become relevant. Section 336, for example, addresses forgery and provides different punishments depending on its purpose and circumstances.
The specific offences should therefore be determined from the actual method used by the perpetrator.
Is Unauthorized UPI or Online Banking Access Also Hacking?
Unauthorized digital transactions may constitute cyber fraud even where the perpetrator did not directly “hack” the bank’s internal computer systems.
For example, a fraudster may deceive a customer into revealing an OTP or installing malicious software and then use the obtained credentials to transfer funds.
From the customer’s perspective, the transaction may still be unauthorized. The criminal investigation can focus on how the credentials were obtained and how the money was transferred.
What Is the Bank’s Responsibility?
The RBI has established a framework for customer liability relating to unauthorized electronic banking transactions. Customers are advised to notify their bank immediately after discovering an unauthorized transaction.
Where the customer has not been negligent and reports the unauthorized transaction within three working days, the RBI framework provides for zero customer liability in specified circumstances. Reporting after longer periods can lead to different liability depending on the circumstances and applicable bank policy.
Therefore, promptly informing the bank is extremely important.
What Should a Victim Do After Bank Account Hacking?
A person who discovers unauthorized access or transactions should act quickly.
Important steps include:
- Contact the bank immediately through its official fraud-reporting channel.
- Block cards or banking access where necessary.
- Change passwords and security credentials.
- Preserve transaction alerts, screenshots and bank statements.
- Obtain a complaint acknowledgement or reference number from the bank.
- Report suspected cybercrime to the appropriate authorities.
- Preserve suspicious messages, phone numbers, emails and links connected with the incident.
The RBI specifically advises customers to notify their bank immediately when an unauthorized electronic banking transaction occurs.
What Evidence Is Useful?
Evidence can be crucial in a cybercrime investigation.
A victim should preserve:
- Bank statements
- Transaction IDs
- UPI transaction details
- SMS and email alerts
- Screenshots
- Login notifications
- Suspicious messages
- Emails and phone numbers
- Device information, where relevant
- Bank complaint records
- Police or cybercrime complaint details
The original digital evidence should be preserved rather than deleted.
Does Sharing an OTP Affect Liability?
It can.
RBI’s framework distinguishes between transactions caused by customer negligence and those occurring without customer negligence. Sharing passwords, PINs or other security credentials can affect the customer’s liability until the bank is informed.
However, even where the customer may have made a mistake, the incident should still be reported immediately. Reporting allows the bank to take steps to prevent further unauthorized transactions and investigate the incident.
Can the Victim Take Criminal Action?
Yes. Where the facts indicate hacking, identity theft, cheating, unauthorized access or other cyber offences, the victim can report the matter to the appropriate law-enforcement or cybercrime authorities.
The applicable criminal provisions depend on the evidence and the method used by the accused. A banking complaint and a criminal complaint serve different purposes and may proceed alongside each other where legally appropriate.
Conclusion
Bank account hacking can be a criminal offence in India. Unauthorized access, fraudulent use of passwords or other identification features, and computer-related acts carried out dishonestly or fraudulently can attract provisions of the Information Technology Act, 2000.
Where the hacking is used to steal money, deceive a victim, or create forged electronic records, additional provisions of the Bharatiya Nyaya Sanhita, 2023 may also apply.
For victims, speed is critical. The bank should be informed immediately, digital evidence should be preserved, and suspected cyber fraud should be reported to the appropriate authorities. RBI’s customer-liability framework makes timely reporting particularly important for unauthorized electronic transactions.
The exact legal consequences depend on the method of hacking, the nature of the unauthorized transaction, customer conduct, available evidence and the provisions applicable to the particular case.
