Sextortion — the right complaint route
Sextortion is not a named offence in Indian criminal law. It sits at the intersection of Section 308 of the Bharatiya Nyaya Sanhita, 2023 [Section 384 IPC] (extortion), Section 351 BNS [Sections 503 and 506 IPC] (criminal intimidation), Sections 66E, 67, 67A and 67C of the Information Technology Act, 2000, and — where the victim is a minor — Section 67B IT Act read with Sections 13 to 15 of the Protection of Children from Sexual Offences Act, 2012. This piece sets out the correct complaint route after Justice K S Puttaswamy and Shreya Singhal.
"Sextortion" is the working name for a recognisable pattern of online crime — an offender obtains or fabricates a sexual image or video of the victim, threatens its publication, and demands money, further imagery, or sexual conduct as the price of suppression. The Indian Penal Code, 1860 never named the offence; nor does the Bharatiya Nyaya Sanhita, 2023 that replaced it. The conduct is, instead, the composite of four statutory limbs that operate together — extortion under Section 308 of the Bharatiya Nyaya Sanhita, 2023 [Section 384 of the Indian Penal Code, 1860], criminal intimidation under Section 351 BNS [Sections 503 and 506 IPC], the IT-Act privacy and obscenity offences under Sections 66E, 67, 67A, 67B and 67C of the Information Technology Act, 2000, and — where the victim is a minor — the child-sexual-abuse-material regime of Section 67B IT Act read with Sections 13 to 15 of the Protection of Children from Sexual Offences Act, 2012. The constitutional gloss is supplied by Justice K S Puttaswamy (Retd) v Union of India, (2017) 10 SCC 1 on informational privacy, and the intermediary-side architecture by Shreya Singhal v Union of India, (2015) 5 SCC 1. The complainant who works the architecture correctly — preservation first, FIR second, takedown third — has a serious prospect of identification, blocking and prosecution. The complainant who relies on the wrong route, or who delays preservation, often does not.
The statutory composite — what sextortion actually is
The first thing to settle is the legal characterisation. Sextortion is a composite of four ingredients, each of which is a distinct offence and each of which adds a distinct element to the charge sheet.
The first limb is extortion. Section 308(1) of the Bharatiya Nyaya Sanhita, 2023 [Section 383 IPC] defines extortion: whoever intentionally puts any person in fear of any injury to that person or to any other, and thereby dishonestly induces the person so put in fear to deliver to any person any property, or valuable security, or anything signed or sealed which may be converted into a valuable security, commits extortion. Section 308(2) BNS [Section 384 IPC] provides the punishment — imprisonment of either description for a term which may extend to seven years, or fine, or both. The sub-section also retains the Section 385 IPC offence of putting a person in fear of injury in order to commit extortion. The "injury" element is satisfied by the threatened publication of sexual imagery — the harm to reputation is well-settled in Indian law as injury within the meaning of the extortion provisions.
The second limb is criminal intimidation. Section 351 of the Bharatiya Nyaya Sanhita, 2023 [Sections 503 and 506 IPC] defines criminal intimidation as the threat of injury to person, reputation or property of another, or to the person or reputation of anyone in whom that person is interested, with intent to cause alarm or to cause that person to do any act which she is not legally bound to do, or to omit to do any act which she is legally entitled to do, as the means of avoiding the execution of the threat. The punishment is imprisonment up to two years or fine or both, with the aggravated form (threat to cause death or grievous hurt, or to cause destruction of property by fire, or imputing unchastity to a woman) punishable with imprisonment up to seven years. Sextortion almost always involves the aggravated form — the threatened publication of sexual imagery is, by its nature, an imputation of unchastity within the meaning of the section.
The third limb is the IT-Act privacy and obscenity regime. Section 66E of the IT Act, 2000 punishes the intentional or knowing capture, publication or transmission of the image of the private area of any person without consent, under circumstances violating the privacy of that person. The Explanation to the section defines "private area" narrowly ("naked or undergarment clad genitals, pubic area, buttocks or female breast") and "circumstances violating privacy" by reference to the reasonable expectation that the private area would not be visible to the public, whether the person is in a public or private place. The punishment is imprisonment up to three years or fine up to two lakh rupees. Section 67 IT Act punishes the publication or transmission of obscene material in electronic form — material that is lascivious, appeals to the prurient interest, or has a tendency to deprave and corrupt — with first-conviction imprisonment up to three years and fine up to five lakh rupees, and aggravated punishment for repeat conviction. Section 67A IT Act handles sexually explicit material with a thicker punishment (first conviction, imprisonment up to five years and fine up to ten lakh rupees), and the section is non-bailable.
The fourth limb operates only where the victim is a minor. Section 67B of the IT Act, 2000 punishes the publication, transmission, browsing, creation or recording of child sexual abuse material in electronic form with imprisonment up to five years on first conviction and seven years on subsequent conviction. Sections 13, 14 and 15 of the Protection of Children from Sexual Offences Act, 2012 punish the use of a child for pornographic purposes (Section 14, ten years imprisonment and fine), the storage of pornographic material involving a child (Section 15), and the use of children in pornographic media (Section 13). Section 19 POCSO supplies the mandatory-reporting framework — any person who has apprehension that an offence under the Act is likely to be committed, or who has knowledge that such an offence has been committed, is required to provide information to the Special Juvenile Police Unit or to the local police; failure to report is itself an offence under Section 21 POCSO. The POCSO route is mandatory for the minor-victim sextortion case; it is not optional and it is not displaceable by the wishes of the family.
The constitutional gloss is supplied by Justice K S Puttaswamy (Retd) v Union of India, (2017) 10 SCC 1. The nine-judge Bench held that informational privacy is a fundamental right under Article 21 of the Constitution and that the state has both a negative duty not to intrude and a positive obligation to protect the privacy of individuals against non-state actors. The post-Puttaswamy framework supplies the doctrinal floor on which Section 66E IT Act and the broader privacy-protective interpretation of the criminal-law regime now rests.
The cognizability and bailability map
Sextortion as a composite engages a mix of cognizable and non-cognizable offences. The Section 308 BNS extortion is cognizable and non-bailable. The Section 351 BNS criminal intimidation in its aggravated form is cognizable; in its simpler form, the cognizability turns on the punishment range. Section 66E IT Act is cognizable and bailable. Section 67 IT Act is cognizable and bailable on first conviction. Section 67A IT Act is cognizable and non-bailable. Section 67B IT Act is cognizable and non-bailable. The POCSO offences are cognizable and non-bailable.
The practical effect is that any sextortion FIR contains at least one cognizable, non-bailable offence — and almost always more than one. The FIR route under Section 173 of the Bharatiya Nagarik Suraksha Sanhita, 2023 [Section 154 CrPC] is therefore the operative procedural opening. The investigation must be done by an officer of the rank of Inspector or above per Section 78 of the IT Act, 2000 for the IT-Act offences. For the POCSO limb, the Special Juvenile Police Unit and the Child Welfare Committee framework operates alongside the cybercrime cell.
The first twenty-four hours — evidence preservation
The single most decisive variable in the sextortion case is the evidence captured before the offender deletes the account, withdraws the threat, or escalates. The evidentiary architecture is built on the Bharatiya Sakshya Adhiniyam, 2023, which carries forward in Section 63 [Section 65B of the Indian Evidence Act, 1872] the certification regime for electronic records — a copy of an electronic record is admissible only on a certificate from a person occupying a responsible official position in the device producing the record, and the Supreme Court has held in Anvar P V v P K Basheer, (2014) 10 SCC 473 that the Section 65B certificate is a mandatory pre-condition for admissibility, with the position re-affirmed in Arjun Panditrao Khotkar v Kailash Kushanrao Gorantyal, (2020) 7 SCC 1.
The complainant should preserve, in dated and verifiable form, the entire communication thread — screenshots of every message with timestamps and sender identifiers visible, screen recordings of the conversation flow, the URLs and handles of the impugned accounts on every platform involved, any payment instrument identifiers if a transfer has been made (UPI transaction ID, bank-account number, wallet identifier, cryptocurrency address), and any forwarded or threatened publication links. Where the threat involves a deepfake or morphed image, the original content should also be preserved with associated metadata. The preservation should be done before the platform is notified or the police are approached; once notification triggers the offender's awareness of detection, the digital trail is usually broken within hours.
Section 67C of the IT Act, 2000 supplies a parallel preservation channel at the intermediary side. The provision requires every intermediary to preserve and retain such information as may be specified, for such duration and in such manner and format as the Central Government may prescribe; failure to comply with the preservation obligation is itself a punishable offence under Section 67C(2) with imprisonment up to three years and fine. The 2011 Rules notified under Section 67C, read together with the IT Rules 2021, supply the operational standard for intermediary preservation. The complainant — directly, through her counsel, or through the investigating officer — should serve a Section 67C preservation notice on the platform on which the impugned content sits, in addition to the platform's standard grievance route. The preservation notice freezes the intermediary's deletion clock and ensures that the contemporaneous record is available when the investigating agency requests it under Section 91 of the BNSS [Section 91 CrPC].
The complaint route — cybercrime.gov.in and the cyber cell FIR
The two parallel registration tracks for the sextortion complaint are the National Cybercrime Reporting Portal at cybercrime.gov.in and the FIR under Section 173 BNSS at the local cyber-cell or the police station having territorial jurisdiction. The two tracks reinforce each other; the cybercrime.gov.in registration produces a complaint reference number that the State cyber cell receives within minutes, and the FIR is the procedural anchor for the investigation under the BNSS.
The 1930 cybercrime financial-fraud helpline is the operational route where the sextortion has already produced a financial transfer — payment by UPI, bank transfer, wallet, or card. The helpline is a fund-recovery channel, not a substitute for the FIR; it produces a near-real-time interception request to the receiving bank's nodal officer under the National Cybercrime Reporting Portal's financial-fraud module. The window for chargeback or hold is typically the first few hours after the transfer; beyond that the recovery rate drops sharply. The helpline call must be followed by the cybercrime.gov.in registration and the FIR for the complaint to ripen procedurally.
The FIR is registered at the cyber cell of the State police or at the police station having territorial jurisdiction. The sections to be invoked at the FIR stage are Section 308 BNS [Section 384 IPC] extortion, Section 351 BNS [Sections 503 and 506 IPC] criminal intimidation, Sections 66E and 67 IT Act (and Section 67A where the imagery is sexually explicit), and Section 75 IT Act extraterritoriality where the offender is or appears to be outside India. For minor victims, Section 67B IT Act and the relevant POCSO sections (13, 14, 15) are mandatory inclusions, and the case is required to be reported under Section 19 POCSO. The Supreme Court's holding in Lalita Kumari v Government of Uttar Pradesh, (2014) 2 SCC 1 — FIR registration is mandatory where the information discloses a cognizable offence — is the operative procedural standard.
If the SHO refuses to register the FIR, the remedies are sequential. Section 173(3) BNSS [Section 154(3) CrPC] permits a written representation to the Superintendent of Police, who must satisfy herself that the matter discloses a cognizable offence and direct registration. Section 175(3) BNSS [Section 156(3) CrPC] permits an application to the Magistrate of First Class for a direction to register the FIR and investigate. The Magistrate's order under Section 175(3) BNSS is the standard backstop where the police route fails. For the IT-Act offences, the investigation must be by an officer of the rank of Inspector or above per Section 78 IT Act; this is a frequent ground for transfer of investigation to the cyber cell from the regular police station.
The takedown overlay — Section 79 and IT Rules 2021
Running in parallel to the FIR is the takedown overlay. Section 79 of the IT Act, 2000 grants the intermediary a conditional safe-harbour; Section 79(3)(b) was read down in Shreya Singhal v Union of India, (2015) 5 SCC 1 to require knowledge from a court order or government notification, so a user's complaint alone does not, of itself, expose the intermediary to liability for non-removal. But the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 supply a parallel operational channel that does not depend on Section 79(3)(b).
Rule 3(2)(b) of the IT Rules 2021 imposes a hard twenty-four-hour takedown obligation on the intermediary for content that "exposes the private area of such individual, shows such individual in full or partial nudity or shows or depicts such individual in any sexual act or conduct, or is in the nature of impersonation in an electronic form, including artificially morphed images of such individual". The provision is the operative non-consensual-intimate-imagery takedown standard and is directly applicable to the sextortion fact pattern. Rule 3(2)(a) requires the Grievance Officer (resident in India) to acknowledge within twenty-four hours and to dispose of the grievance within fifteen days. Rule 3A (added in 2022) supplies the Grievance Appellate Committee appeal route where the Grievance Officer's decision is adverse.
Where the sextortion content has already been published — or where there is reason to believe that publication is imminent — Section 69A of the IT Act, 2000 supplies the government-blocking route. Shreya Singhal upheld Section 69A together with the 2009 Blocking Rules as constitutionally valid on the reasoning that the provision is narrowly drawn and procedurally safeguarded. The Section 69A representation is the right instrument where the State interest aligns with the victim's — typically where the threatened publication has implications for public order, incitement, or community safety. For the ordinary individual-victim case, Rule 3(2)(b) is the operative instrument; Section 69A is held in reserve.
The minor-victim variant — POCSO and the mandatory route
Where the victim is below eighteen, the architecture changes in character. POCSO 2012 is a special statute; its procedural and substantive rules override the general criminal law where there is conflict. Section 19 POCSO is the mandatory-reporting provision — any person with knowledge or apprehension of an offence under POCSO is required to report to the Special Juvenile Police Unit or the local police; non-reporting by a person in charge of an institution is itself an offence under Section 21 POCSO. The reporting obligation is unconditional and is not waived by parental consent.
The investigation is conducted by the Special Juvenile Police Unit constituted under the Juvenile Justice (Care and Protection of Children) Act, 2015, in coordination with the Child Welfare Committee. The recording of the child's statement is governed by Sections 24 and 25 POCSO — in a place of the child's choice, in the presence of a person in whom the child has trust, audio-video recorded, and without exposure to the accused. The trial is conducted by the Special Court designated under Section 28 POCSO, with the in-camera procedure under Section 37 POCSO and the support-person framework under Section 39 POCSO.
The Section 67B IT Act offence — child sexual abuse material in electronic form — is the IT-Act counterpart of POCSO Sections 13 to 15. The maximum punishment under Section 67B is five years on first conviction and seven on subsequent conviction; under POCSO Section 14, the punishment is ten years and fine. The Section 81 IT Act overriding-effect clause and the Section 42 POCSO non-derogation clause are read together — both apply, and the prosecution proceeds under both. Sharat Babu Digumarti v Government (NCT of Delhi), (2017) 2 SCC 18, supplies the rule that where a special law specifically covers the conduct, recourse to the general law on the same conduct is barred; the rule is applied selectively in the POCSO/IT-Act overlap, with the consistent result that the POCSO charges are not displaced by the IT-Act charges and both are sustained.
Extraterritoriality — Section 75 IT Act and the cross-border problem
Sextortion, more than most online offences, is a cross-border phenomenon. A substantial fraction of the threat-and-extort operations directed at Indian victims are physically run from outside India — call centres in West Africa, Southeast Asia and the Gulf region are the principal operational geographies in the 2024–2026 data. Section 75 of the IT Act, 2000 supplies a textually broad extraterritoriality — the Act applies to any offence or contravention committed outside India by any person if the act or conduct constituting the offence involves a computer, computer system or computer network located in India. The provision is the basis on which Indian cyber cells pursue mutual-legal-assistance requests and Interpol Red Notices in cross-border sextortion matters.
The practical reach, however, is constrained. Service of process on a foreign-resident defendant requires the Mutual Legal Assistance Treaty framework where one exists, and Letter of Request channels through the Central Authority where it does not. The Section 75 extraterritoriality is, in practice, primarily useful as the jurisdictional anchor that permits the Indian investigation to proceed, the Indian charge sheet to be filed, and the Indian conviction to be entered in absentia where the foreign suspect cannot be brought to trial. The asset-recovery and identification work depends on the cooperation of the receiving jurisdiction's law-enforcement and financial-intelligence units.
Section 79 read with the IT Rules 2021 obligation on Significant Social Media Intermediaries to appoint India-resident Grievance Officers, Nodal Contact Persons and Chief Compliance Officers supplies a parallel cross-border lever. The threat of safe-harbour loss has been the operational mechanism by which the Government has secured compliance from foreign-headquartered platforms with Indian takedown and information-disclosure requests. For the sextortion complainant, the practical effect is that the major platforms — Meta, X, Google/YouTube, Snap, LinkedIn — operate India-facing channels even where the offender is offshore.
The under-reporting reality
The doctrinal architecture is workable. The reporting reality is that a substantial fraction of sextortion victims do not invoke it. The National Crime Records Bureau data and the NCRP portal numbers consistently understate the incidence; the gap between estimated incidence and reported cases is documented in the National Commission for Women's reports and in the parliamentary Standing Committee reports on cybercrime. The reasons are structural — fear of secondary exposure of the imagery during investigation; concern about family and social reaction; the perception that the offender's offshore location makes investigation futile; and, in the minor-victim case, a misjudged attempt by the family to "manage" the matter privately rather than trigger the POCSO mandatory-reporting framework.
The legal answer to the secondary-exposure concern is the in-camera procedure available for the IT-Act and POCSO trials, the witness-protection scheme notified under the Witness Protection Scheme, 2018 and now embedded in Section 396 of the BNSS, and the Section 37 POCSO in-camera rule that applies to the Special Court trial. The Supreme Court's holding in State of Maharashtra v Praful B Desai, (2003) 4 SCC 601 — that evidence by video-conference is admissible and is to be encouraged where the witness's physical presence would compound distress — has been applied repeatedly in cybercrime trials to permit the victim's testimony without further exposure.
The legal answer to the offshore-offender concern is that prosecution is not the only outcome the architecture produces. Identification of the operational network, suspension and seizure of the financial channels, takedown of the impugned content under Rule 3(2)(b), Section 69A blocking of the threatened-publication URLs, and inter-agency intelligence sharing under the I4C (Indian Cybercrime Coordination Centre) framework are independent outcomes that the FIR-and-portal route triggers. The investigation has value even where the conviction does not follow.
Open questions and unresolved doctrinal tensions
Three doctrinal questions are genuinely contested in 2026.
The first is whether sextortion should be a named offence in its own right. The Justice J S Verma Committee Report (2013), the Law Commission's 283rd Report on review of the cybercrime framework, and the Standing Committee on Communications and Information Technology reports have all considered the question and have divided on the answer. The Digital India Act consultation drafts circulated by the Ministry of Electronics and Information Technology have, in different iterations, proposed a named offence; whether the final statute will codify it remains open.
The second is the operation of the deepfake-and-synthetic-imagery overlay. The Section 66E "private area" definition was drafted for a non-AI world and is textually narrow. The Rule 3(2)(b) language ("artificially morphed images of such individual") is broader and has been applied by the platforms to AI-generated content; whether the criminal-law definitions stretch equally far is a question that has not yet been settled at the appellate level. The Delhi High Court's personality-rights line in Anil Kapoor v Simply Life India, 2023 SCC OnLine Del 6914 and the related rulings supply a civil-side framework that is being increasingly invoked alongside the criminal-side prosecution.
The third is the constitutional position of the Grievance Appellate Committee under Rule 3A of the IT Rules 2021. The Government's position is that the GAC is a non-judicial executive grievance-appellate mechanism. The civil-society challenge — pending in different forms before different High Courts — is that the GAC's binding power over private platform decisions, the executive composition of the GAC, and the absence of an explicit statutory anchor in the IT Act, place it in tension with the separation-of-powers framework and with Shreya Singhal. Kunal Kamra v Union of India, 2024 SCC OnLine Bom 360, on the Fact-Check Unit limb, has set up the analytical framework within which the GAC question will be resolved. For the sextortion complainant, however, the GAC route currently works in practice, and the takedown obligation under Rule 3(2)(b) is enforced by the platforms regardless of the constitutional contest over Rule 3A.
The architecture is layered, the under-reporting is real, and the doctrinal questions are open. But the framework is operational. A complainant who preserves the evidence before notification, who registers the complaint at cybercrime.gov.in and files the FIR with the cyber cell under Section 173 BNSS, who invokes Section 308 BNS, Section 351 BNS, Section 66E and Section 67 IT Act (and Section 67B plus POCSO where the victim is a minor), who serves a Section 67C IT Act preservation request on the intermediary, and who pursues the Rule 3(2)(b) takedown in parallel, has a serious prospect of identification, blocking, and prosecution within the working architecture that Shreya Singhal and Puttaswamy have left in place.