IT Act 2000 Sections for Cyber Crime: Banker's Guide (IIBF 2026)

Every cyber fraud FIR a bank files, every compensation claim a customer raises, and every phishing site a bank gets taken down rests on a specific legal foundation. Knowing the IT Act 2000 sections for cyber crime is not optional trivia for IIBF candidates — it is the statute your branch's fraud, legal and IT security teams actually invoke when an account is hacked, a card is cloned, or a customer's KYC data leaks. This article walks through the key sections, the penalties attached to each, how adjudication and appeals work, and how bankers apply the Act in real incidents, in the order the exam typically tests them.

📜 IT Act 2000 Sections for Cyber Crime: The Core Framework

The Information Technology Act, 2000 (as amended in 2008) is India's primary cyber law, and a cluster of its sections deal directly with offences bankers encounter. Section 43 is the foundation — it makes unauthorised access, downloading, introducing a virus, damaging data, or denying access to a computer system a civil wrong, with the victim entitled to compensation for the actual loss caused, without any statutory ceiling after the 2008 amendment.

Section 43A is the one bankers should know cold: it makes a "body corporate" — including a bank — liable to pay compensation if it is negligent in implementing and maintaining "reasonable security practices and procedures" while handling sensitive personal data or information (SPDI), a standard fleshed out by the IT (Reasonable Security Practices) Rules, 2011. Section 65 covers tampering with computer source documents, while Section 66 criminalises the dishonest or fraudulent acts described in Section 43 — this is the general "hacking" provision. Building context on how these attacks actually happen helps the sections stick; see Computer Insecurity and Computer Hackers for the underlying technical methods these sections were drafted to punish.

💡 Exam Tip: Section 43 is civil (compensation), Section 66 is criminal (imprisonment/fine) for the same underlying acts done dishonestly or fraudulently — examiners frequently test this civil-versus-criminal distinction.

⚖️ Penalties and Punishments Under the Act

Beyond Sections 43 and 66, a family of sub-sections targets specific digital offences that map directly onto banking fraud patterns. Section 66B punishes dishonestly receiving stolen computer resources or communication devices. Section 66C is the identity-theft provision — fraudulent use of another person's password, digital signature or any other unique identification feature, directly relevant to net-banking credential theft. Section 66D punishes cheating by personation using a computer resource, the exact offence underlying most phishing and vishing scams. Section 66F covers cyber terrorism, carrying the harshest punishment in the Act. Section 67 deals with publishing or transmitting obscene material electronically, and Section 70 protects "protected systems" notified as critical information infrastructure, which can include core banking and payment infrastructure.

The table below summarises punishments as prescribed under the Act. Fines and imprisonment terms are the statutory maximums; courts and adjudicating officers exercise discretion within these limits based on facts. For the authoritative text of every section, the Ministry of Electronics and Information Technology hosts the consolidated Information Technology Act, 2000, which is the primary reference candidates should cite over any secondary summary.

⚠️ Common Mistake: Candidates often assume every cyber offence in the Act is bailable and minor. Section 66F (cyber terrorism) carries life imprisonment, and several offences involving repeat conviction or aggravated harm attract significantly higher exposure than first-time Section 66 cases.

🏛️ Adjudication, Compensation and the Appeal Process

Compensation claims under Section 43/43A are not decided by a criminal court in the first instance — they go to an Adjudicating Officer, appointed under Section 46, typically an officer not below the rank of Director in the state IT department. The Adjudicating Officer holds an inquiry, gives both parties a hearing, and can award compensation; claims beyond the Adjudicating Officer's pecuniary jurisdiction go to the competent civil court instead.

Appeals against an Adjudicating Officer's order originally went to the Cyber Appellate Tribunal (CAT) constituted under Section 48. Following the Finance Act, 2017, the CAT's functions were merged into the Telecom Disputes Settlement and Appellate Tribunal (TDSAT), which now hears these appeals. A further appeal on a question of law lies to the jurisdictional High Court. For banks, this matters operationally: how a suspected fraud is first logged, escalated and evidenced determines whether a later compensation claim or adjudication proceeds smoothly — a process detailed in Incident Management.

Corporate liability is fixed under Section 85: where a company commits an offence, every person in charge of and responsible to the company for its conduct at the time of the offence is deemed guilty, unless they prove the offence occurred without their knowledge and despite due diligence. This is why banks maintain documented IT security governance and named responsibility — it is the primary defence available under Section 85.

🔍 Applying These Sections in Bank Fraud Investigations

When a branch or bank CERT team investigates an incident — a compromised net-banking login, a cloned debit card, or a business email compromise — the legal workflow runs in parallel with the technical one. FIRs typically cite the applicable IT Act sections (43A, 66, 66C, 66D depending on the fact pattern) alongside relevant provisions of the Bharatiya Nyaya Sanhita, 2023, which replaced the IPC's cheating and forgery offences. Electronic evidence — server logs, CCTV, SMS/OTP records, transaction trails — must satisfy the certification requirements now under the Bharatiya Sakshya Adhiniyam, 2023 (which replaced Section 65B of the erstwhile Evidence Act) before a court will admit it, so preserving a clean, certified digital trail from the first hour of an incident is critical.

Section 79 gives intermediaries limited safe-harbour protection from liability for third-party content, provided they exercise due diligence — relevant where a bank's platform is misused by a fraudster to route stolen funds, distinct from cases where the bank itself was negligent under Section 43A. Understanding the channels through which such fraud typically enters is covered in Channels Of Cyber Crimes, and card-specific incidents overlap heavily with card skimming fraud detection techniques your fraud team should already be applying at the point of sale and ATM.

Once funds move, tracing typically involves accounts flagged for money mule accounts, and customers are directed to report promptly through the 1930 cyber crime helpline so the golden-hour freeze window under banking-sector reporting protocols can be used effectively. None of this legal and procedural response works without the physical layer holding first — server rooms, access controls and hardware safeguards covered under physical and environmental security controls are what keep an incident from becoming a Section 43A negligence finding in the first place.

📌 Remember: The technical chapter and the legal section are two views of the same incident — a hacking method under Electronic Card Frauds is what happened; Section 66C or 66D is what it is charged as.

✅ Conclusion: Locking the IT Act Down for the Exam

For IIBF's Prevention of Cyber Crime paper, do not try to memorise every sub-section in isolation. Anchor your revision around four clusters: Section 43/43A for civil liability and compensation, Section 66 and its sub-sections (66B–66F) for criminal offences, Sections 46/48 and the TDSAT route for adjudication and appeal, and Section 85 for corporate liability. Every case study question the exam sets will map to one of these clusters, usually combined with a fact pattern you can trace back to the exact IT Act 2000 sections for cyber crime covered above. Browse more chapter notes on the Prevention of Cyber Crime tag hub for the full picture beyond these legal provisions.

Ready to test your recall under exam conditions? Practise chapter-wise mock questions on iibf.store and check where your section-wise knowledge still has gaps before the real exam.

🧠 Practice MCQs: IT Act 2000 Sections for Cyber Crime

Want chapter-wise mock tests with 100+ MCQs? Start practising free →

❓ Frequently Asked Questions