Online shopping fraud — your two-track remedy
An e-commerce fraud in India runs on two parallel tracks that the litigant must press together, not in sequence. The criminal track sits in the Information Technology Act, 2000 and the cheating chapter of the Bharatiya Nyaya Sanhita, 2023; the consumer track sits in the Consumer Protection Act, 2019 and the Consumer Protection (E-Commerce) Rules, 2020. This article maps both tracks, the e-commerce-specific rules layered on top, and the doctrinal anchors that organise the field.
The Indian e-commerce dispute has become structurally different from a brick-and-mortar grievance. Where the brick-and-mortar buyer dealt with one seller, the e-commerce buyer deals with at least three legal persons — the marketplace platform, the listed seller and the payment intermediary — and the fraudulent transaction often resolves into a fourth party, the impersonator who used a counterfeit listing, a doctored COD substitution or a card-not-present takeover to extract the value. The Consumer Protection Act, 2019 (replacing the 1986 Act under Section 107) and the Consumer Protection (E-Commerce) Rules, 2020 were drafted against this multi-party architecture; the Information Technology Act, 2000 and the cheating provisions of the Bharatiya Nyaya Sanhita, 2023 supply the offence-side overlay. A complete recovery strategy in an online-shopping fraud presses both tracks at once. This article maps the architecture, the operational levers and the principal doctrinal anchors.
The first doctrinal move — the 1986 Act has been superseded
An older generation of consumer-law commentary, including some of the standard chapter notes, organises the field around the Consumer Protection Act, 1986 — the Act under which the District Forum / State Commission / National Commission hierarchy was first built, and under which the doctrines of "consumer", "deficiency" and "unfair trade practice" were originally developed. That Act has been repealed. Section 107 of the Consumer Protection Act, 2019 repealed the 1986 Act with effect from 20 July 2020, with a savings clause preserving pending proceedings and acquired rights. The 1986 Act remains relevant only for (a) pending matters that were instituted before the savings date and (b) doctrinal continuity — the Supreme Court's 1986-Act jurisprudence on the meaning of "consumer", "service" and "deficiency" continues to be read into the 2019 Act unless the 2019 text departs from it.
Three Supreme Court decisions form the doctrinal backbone that has carried over. Indian Medical Association v V P Shantha, (1995) 6 SCC 651, established the scope of "service" — including paid professional services and excluding only services rendered free of charge or under a contract of personal employment. Lucknow Development Authority v M K Gupta, (1994) 1 SCC 243, established that statutory bodies and public authorities fall within the consumer-fora's deficiency jurisdiction. Spring Meadows Hospital v Harjol Ahluwalia, (1998) 4 SCC 39, extended the "consumer" definition to beneficiaries of services hired by another — the doctrinal predecessor of Section 2(7)(ii) of the 2019 Act's "beneficiary" wording, on which a parent buying online for a child or a spouse for a partner relies.
The 2019 Act adds three structural features the 1986 Act did not have — a Central Consumer Protection Authority with rule-making and class-action powers, an explicit "product liability" chapter, and a specific notice clause for e-commerce. The 1986 doctrines flow forward; the 2019 framework operationalises them for the digital marketplace.
Track one — the criminal map under the IT Act, 2000 and the BNS, 2023
Most online-shopping frauds engage at least three IT Act provisions and two BNS provisions in combination. The combinations matter because the charge-sheet that omits one of them often leaves the bail and investigation incentives misaligned.
Section 43 of the Information Technology Act, 2000 is the civil-penalty foundation — unauthorised access to a computer resource (Section 43(a)), downloading or copying of data (Section 43(b)), introduction of a computer contaminant (Section 43(c)), and the often-overlooked Section 43(h), which catches the act of charging the services availed of by one person to the account of another by tampering with a computer resource. Section 43(h) is the statutory home of the doctored-payment-gateway and the COD-substitution fraud, and it is the civil-track lever for damages recoverable before the Adjudicating Officer under Section 46 of the Act.
Section 66 of the IT Act, 2000, as substituted by the Information Technology (Amendment) Act, 2008, criminalises the Section 43 acts when done dishonestly or fraudulently — imprisonment up to three years and fine up to five lakh rupees. The Supreme Court in Shreya Singhal v Union of India, AIR 2015 SC 1523, while striking down Section 66A as unconstitutionally vague, expressly distinguished Section 66 — at paragraph 70 of the judgment — as a provision whose "dishonestly" and "fraudulently" elements are defined with sufficient specificity (by reference to Sections 24 and 25 of the IPC, now Sections 2(6) and 2(7) BNS) to survive a void-for-vagueness analysis. Section 66 is the workhorse offence in online-shopping-fraud FIRs.
Section 66C of the IT Act punishes identity theft — fraudulent or dishonest use of the electronic signature, password or any other unique identification feature of another person — with imprisonment up to three years and fine up to one lakh rupees. Where the fraud involves compromised card credentials, stolen UPI handles or hijacked merchant accounts, Section 66C is engaged in tandem with Section 66. Section 66D punishes cheating by personation by means of a computer resource or communication device — the offence that catches counterfeit-listing scams, lookalike merchant pages, vishing-induced order placement and impersonation of a legitimate platform's seller-onboarding flow. Both 66C and 66D are punishable up to three years with fine up to one lakh rupees, and both are bailable — a structural weakness the source commentary on Chapter XI of the IT Act candidly records.
Section 75 of the IT Act gives the Act extraterritorial reach — the Act applies to an offence committed outside India by any person if the act or conduct constituting the offence involves a computer, computer system or computer network located in India. Section 75 is the doctrinal hook for an Indian victim defrauded by a seller operating from abroad whose payment debit passed through an Indian banking rail or whose listing appeared on an Indian-resident marketplace. Whether actual recovery follows is a separate question — see the section on cross-border recovery limits below.
The Bharatiya Nyaya Sanhita, 2023 supplies the cheating layer. Section 318 BNS (cheating, the successor to Section 415 IPC defining cheating and Section 420 IPC punishing it where dishonest inducement is involved) is the generic cheating offence; the punishment in Section 318(4) BNS for the aggravated form — imprisonment up to seven years and fine — corresponds to the IPC 420 register. Section 319 BNS (cheating by personation, the successor to Sections 416 and 419 IPC) is engaged where the fraud involves pretending to be another person, an institution or a platform. Section 336 BNS (forgery, the successor to Sections 463 and 464 IPC) is engaged where the fraud involves the creation of a false electronic document — a fabricated invoice, a counterfeit listing page, a doctored payment confirmation. The trio S 318 / S 319 / S 336 BNS routinely sits alongside Sections 66, 66C and 66D IT Act in a properly drafted FIR.
The First Information Report is filed under Section 173 of the Bharatiya Nagarik Suraksha Sanhita, 2023 [Section 154 of the Code of Criminal Procedure, 1973]. The complaint is routed through the National Cybercrime Reporting Portal at cybercrime.gov.in; the financial-fraud helpline at 1930 is the parallel reporting lever where a payment debit has occurred from a bank or UPI rail and the bank's customer-protection obligations under the Reserve Bank of India circular dated 6 July 2017 (DBR.No.Leg.BC.78/09.07.005/2017-18) overlap with the criminal complaint. The 1930-channel report is not a substitute for the FIR; it is the trigger for the bank's three-working-day notification clock and the shadow-reversal mandate under the 2017 circular.
Track two — the consumer map under the CPA, 2019 and the E-Commerce Rules, 2020
The consumer track runs in parallel and answers a different question — not whether the offender goes to prison, but whether the buyer recovers the price, replacement or compensation. The 2019 Act and the 2020 Rules supply the operational text.
Section 2(7) of the Consumer Protection Act, 2019 defines "consumer" — a person who buys goods or hires services for a consideration, including a beneficiary thereof, and including transactions done online by any mode of electronic communication. Section 2(7)(ii) brings the Section 2(11) "deficiency" and the Section 2(47) "unfair trade practice" definitions into play; Section 2(11) defines "deficiency" as any fault, imperfection, shortcoming or inadequacy in the quality, nature and manner of performance which is required to be maintained by or under any law for the time being in force or has been undertaken to be performed by a person in pursuance of a contract; Section 2(47) defines "unfair trade practice" — a non-exhaustive list including false representation about standard, quality or grade, false bargain-price advertisement, and non-compliance with prescribed standards. The online-shopping fraud sits at the intersection of Sections 2(11) and 2(47) — a counterfeit product is both deficient and an unfair trade practice; a non-delivery after payment is deficient simpliciter; a misleading promotional advertisement is an unfair trade practice.
Section 2(46) defines "spurious goods" — goods that are falsely claimed to be genuine; a counterfeit listing falls squarely within this definition and the consumer-fora's spurious-goods jurisdiction. Section 2(17) defines "e-commerce" — the buying or selling of goods or services including digital products over digital or electronic network — and is the operative trigger for the 2020 Rules.
Pecuniary jurisdiction was restructured by the Consumer Protection (Jurisdiction of the District Commission, the State Commission and the National Commission) Rules, 2021, notified on 30 December 2021. The District Commission entertains complaints up to fifty lakh rupees (Section 34 read with the 2021 Rules); the State Commission entertains complaints exceeding fifty lakh rupees and up to two crore rupees (Section 47); the National Commission entertains complaints exceeding two crore rupees (Section 58). Section 34(2) supplies the territorial-jurisdiction rule — the District Commission has territorial jurisdiction where the opposite party resides, where the cause of action arises wholly or in part, or, importantly for online buyers, where the complainant resides or personally works for gain. The last limb of Section 34(2) is the structural reason a Delhi-based buyer can sue an out-of-state e-commerce platform in Delhi.
Section 38 sets out the procedure on receipt of a complaint — admission, notice to the opposite party, opportunity to file response within thirty days (extendable by fifteen days), reference to laboratory analysis where the dispute requires it, and adjudication on the merits. Section 39 sets out the menu of remedies the Commission may direct — removal of the defect, replacement of the goods, return of the price, payment of compensation for loss or injury (including punitive damages), removal of the deficiency, discontinuance of the unfair trade practice, withdrawal of hazardous goods, and adequate costs. Section 65 prescribes a two-year limitation period from the date on which the cause of action arose, with the Commission's power to condone delay on sufficient cause.
The Consumer Protection (E-Commerce) Rules, 2020, notified under Section 101(1)(zg) of the 2019 Act, sit on top of the parent statute. Rule 4 sets out the duties of every e-commerce entity — display of legal name, principal-place-of-business address, customer-care contact information, country of origin labelling, expiration date, total price in single figure, return-and-refund policy, and a grievance officer with name, contact and resolution timeline. Rule 4(5) creates the thirty-day grievance-redressal window; Rule 4(7) prohibits manipulation of price or imposition of unjustified prices. Rule 6 governs marketplace e-commerce entities — those merely connecting independent sellers — and imposes due-diligence obligations including obtaining the seller's undertaking on description accuracy, displaying the seller's contact information, and ensuring no unfair-trade-practice listing remains live after notice. Rule 7 governs inventory e-commerce entities — those that own the inventory — and treats them as the seller for the purposes of liability, including labelling, warranty and after-sales-service obligations. The Rule 6 / Rule 7 distinction is the principal doctrinal lever for the question — central to most platform-versus-seller disputes — of which party is liable for the fraudulent listing.
Statute-comparison — what each text answers
The three principal text-sets do not duplicate each other; each answers a different question.
The IT Act, 2000 and the BNS, 2023 answer the offence question. Sections 43 and 66 of the IT Act, read with Sections 318, 319 and 336 BNS, prescribe the elements of the offence, the punishment, and the cognizability / bailability. They do not, by themselves, return the price to the buyer; the civil-penalty proceeding under Section 46 of the IT Act before the Adjudicating Officer is a separate proceeding to which the offence-side track does not automatically lead.
The Consumer Protection Act, 2019 answers the restitution question. The District / State / National Commission proceeding under Sections 38 and 39 yields refund, replacement, compensation and punitive damages. It does not, by itself, send anyone to prison; the Section 88 / Section 89 penalty provisions for non-compliance with Commission orders are an internal-enforcement lever, not a substitute for the criminal track.
The Consumer Protection (E-Commerce) Rules, 2020 answer the platform-liability question. Rule 6 and Rule 7 are the texts on which the marketplace-versus-inventory characterisation of the platform turns, and on which the platform's escape-via-intermediary-status under Section 79 of the IT Act, 2000 is conditioned. A platform that fails its Rule 4 disclosure and Rule 6 due-diligence obligations cannot, in the consumer-fora's reading, claim Section 79 protection at the same time.
A complete claim pulls on all three text-sets. The buyer files an FIR under Section 173 BNSS with the IT Act and BNS sections; presses the consumer complaint under Section 35 read with Section 38 of the 2019 Act with Rules 4, 6 and 7 of the 2020 Rules; and, where the fraud involves a bank or UPI debit, presses the RBI 6 July 2017 circular against the bank for shadow-reversal and limited-liability allocation in parallel.
The procedural roadmap — the parallel two-track press
The sequence in which the two tracks are pressed is operationally important. The two-track press, properly sequenced, looks like this — but the sequence is a procedural roadmap for the litigant, not a generic Step-1/Step-2 framing for an article about online shopping in general.
Hour zero to twenty-four — the payment-rail lever. Where the fraud involves a card, UPI, internet-banking or wallet debit, the customer notifies the bank within three working days of the bank's communication to invoke the zero-liability bucket under paragraph 6 of the RBI circular of 6 July 2017. The 1930 helpline is the operational channel for this notification; the bank is obliged to acknowledge and to initiate beneficiary-side recovery. The shadow-reversal mandate under paragraph 9 of the circular operates within ten working days regardless of where the liability ultimately falls. This is the only time-critical step in the sequence; missing it pushes the customer from bucket one to bucket two or three of the circular's liability framework.
Day one to seven — the FIR under Section 173 BNSS. The FIR is registered through cybercrime.gov.in or the local jurisdictional cybercrime police station, with charges under Section 318 BNS, Section 319 BNS where personation is involved, Section 336 BNS where a false electronic document was used, Section 66 IT Act, Section 66C IT Act where credentials were misused and Section 66D IT Act where personation was via a computer resource. Lalita Kumari v Govt of UP (the 2014 Supreme Court Constitution Bench ruling) is the doctrinal backstop where the police hesitate to register — the Court mandated automatic FIR registration on disclosure of a cognizable offence, subject to a narrow inquiry exception. The FIR must name the platform and the listed seller separately where the buyer dealt with both.
Day one to thirty — the consumer-track demand notice. Rule 4(5) of the 2020 Rules and the platform's own grievance-redressal mechanism are engaged before the consumer-fora complaint. The thirty-day window is short and is, in most cases, the moment platforms either refund or harden their position. The complaint should be in writing, should specify the order number, the date of the transaction, the price paid, the deficiency or unfair-trade-practice complained of, and should invoke Section 2(11) and Section 2(47) of the 2019 Act expressly.
Day thirty to the two-year limitation under Section 65 — the consumer complaint. Filed before the District Commission under Section 34 read with Section 35 of the 2019 Act, with the territorial-jurisdiction lever in Section 34(2) used where the buyer's residence is more convenient than the platform's. The complaint should plead Rule 6 / Rule 7 characterisation of the platform; should include the Section 39 menu of remedies prayed for; and should specifically claim compensation for mental agony where the fraud has involved harassment, repeated debit attempts or identity misuse — the consumer-fora line, descending from Lucknow Development Authority v M K Gupta, treats mental agony as a recoverable head of damages.
Throughout — the civil-penalty option under Section 46 IT Act. A proceeding before the Adjudicating Officer (the Secretary of the Department of Information Technology in the relevant State, or such other officer as may be designated under Section 46(3)) is available for damages under Section 43 IT Act. The 2008 Amendment removed the earlier one-crore-rupee ceiling on the Adjudicating Officer's compensation jurisdiction; the Adjudicating Officer's order is appellable to the Telecom Disputes Settlement and Appellate Tribunal under Section 57 read with Section 48 of the IT Act. This route is under-used in practice but is doctrinally available alongside the consumer-fora and FIR routes.
The doctrinal anchors — what the consumer-fora and the Supreme Court have settled
Four doctrinal points are settled enough to be relied on without hedging.
First, the "consumer" definition in Section 2(7) of the 2019 Act covers the online buyer, the beneficiary of the online purchase (the spouse, child or other person for whom the goods were bought) and any user of the goods with the buyer's approval — the Spring Meadows doctrine, carried forward expressly into the statutory text. The defence that "you were not the cardholder" or "you were not the listed buyer" fails on this point where the user's approval is shown.
Second, "deficiency" under Section 2(11) and "unfair trade practice" under Section 2(47) cover both non-delivery and counterfeit-delivery; the Indian Medical Association v V P Shantha framework — main / inclusionary / exclusionary parts of the service definition — applies to the platform's services as well, and the consumer-fora have read the platform's delivery-and-after-sales-service obligations into the inclusionary part.
Third, the platform's claim to intermediary immunity under Section 79 of the IT Act is conditional. Shreya Singhal v Union of India, AIR 2015 SC 1523, read down Section 79(3)(b) — the intermediary's immunity is lost only on receipt of actual knowledge from a court order or appropriate government notification, but it is also lost where the intermediary's own conduct (active curation, listing endorsement, payment intermediation) takes it out of the passive-conduit role. The consumer-fora have applied this distinction to push inventory-model platforms out of intermediary protection and into seller-liability.
Fourth, the burden of demonstrating "due diligence" under Rule 6 of the 2020 Rules and the corresponding intermediary-rules notified under Section 79 of the IT Act (the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021) sits on the platform. A bare assertion that the platform's terms of use disclaimed liability does not discharge this burden; the platform must produce contemporaneous due-diligence records — seller-onboarding KYC, listing-content verification, complaint-handling logs.
Cross-border recovery — the structural limit
Where the fraudulent listing was operated from outside India, the doctrinal extraterritoriality of Section 75 IT Act and the consumer-fora's territorial jurisdiction under Section 34 of the 2019 Act do not, by themselves, deliver recovery. The structural limits are three.
First, service of process on a foreign respondent runs through the Hague Service Convention or, where the country is not a signatory, through diplomatic channels — both routes are slow and unreliable for retail-value disputes. The consumer-fora have, in some cases, treated the platform as the proper respondent where the listed seller was beyond effective reach, but this depends on the Rule 6 / Rule 7 characterisation.
Second, enforcement of an Indian Commission's order in a foreign jurisdiction depends on the foreign court's recognition rules. India's reciprocal-enforcement regime under Section 44A of the Code of Civil Procedure, 1908 applies to "reciprocating territories" notified under the Section; many e-commerce-origin jurisdictions are not on that list, and a separate suit on the Indian decree may be necessary abroad.
Third, on the payment side, once the funds have left the regulated Indian banking system to a foreign account, recovery depends on mutual legal assistance and on the foreign jurisdiction's freeze-and-seize cooperation. The RBI's 2017 circular liability framework continues to apply against the Indian bank on the customer side, but the bank's beneficiary-side recovery against the foreign account is limited.
Cross-border recovery is therefore not a theoretical question. For most retail online-shopping frauds with a foreign element, the practical recovery is against the Indian-resident platform (under Rule 6 / Rule 7 of the 2020 Rules and Section 39 of the 2019 Act) or against the Indian bank (under the 2017 circular's liability allocation), not against the foreign seller directly.
Where the framework sits today
The position in 2026 admits of four propositions stated without strain.
One — the two-track architecture is settled and the parallel press is the conventional litigation strategy. The IT Act and the BNS supply the offence-side levers; the 2019 Act and the 2020 Rules supply the restitution levers; the RBI 2017 circular supplies the payment-rail lever. No single text is sufficient.
Two — the marketplace-versus-inventory distinction under Rules 6 and 7 of the 2020 Rules is the principal doctrinal battleground. Platforms have an institutional preference for the Rule 6 marketplace characterisation (under which the listed seller is liable); buyers and the Central Consumer Protection Authority have pressed for the Rule 7 inventory characterisation where the platform's role goes beyond passive conduit. The doctrinal contours are still being settled, and a clarificatory amendment to the 2020 Rules — or a Supreme Court ruling — would consolidate the field.
Three — Section 66D of the IT Act remains a bailable offence, and the source commentary on Chapter XI is candid that this dilutes the criminal-track deterrent. The 2008 Amendment's punishment ceilings (three years and one lakh rupees for 66C and 66D) have not been revisited despite the scale of e-commerce fraud the period has produced. A doctrinal upgrade to non-bailable cognizance for repeat-offender personation is a recurrent reform proposal.
Four — cross-border recovery is the residual unsolved problem. The Section 75 IT Act extraterritoriality and the consumer-fora's territorial jurisdiction reach only as far as the available enforcement levers do; for fraud routed through foreign sellers and foreign accounts, the practical recovery is partial.
For the buyer who notifies the bank within three working days, files the FIR within the same week, presses the platform on its Rule 4(5) grievance window, and follows up with a District Commission complaint within the two-year limitation, the two-track framework is genuinely effective. For the buyer who delays, who relies on the consumer track alone, or whose fraud has crossed a border, the framework is partial — but the partial recovery is structured by the same three text-sets that organise the complete one.