Accused in a Cyber Crime Case: Bail and Defence

I have been named in a cyber crime FIR: what should I do first?

Get a copy of the FIR and read the sections. In Delhi, FIRs are generally uploaded on the Delhi Police website within 24 hours, except in sensitive cases; in UP they are available through the UP Police portal; and if you cannot find yours, your lawyer can apply to the court. The sections tell you whether the case is bailable, which court will hear bail and how urgent things are. An FIR under sections 66C and 66D of the IT Act alone is a very different matter from one that adds section 318(4) BNS and section 111 BNS for organised crime.

Then stop and preserve. Do not delete chats, call logs, emails or apps, do not factory reset your phone, and do not close the bank account. Deleting data after learning of an FIR looks like destroying evidence, and it often removes the very records that would have shown your innocence, such as proof that you sold the SIM, that your phone was elsewhere, or that the money that came into your account was for a genuine sale.

Do not call the complainant to explain or settle before you have advice. In cyber fraud cases the complainant usually has no idea who you are; your call can be recorded and used as an admission. Contact your lawyer, collect your own papers, and decide the next step, usually anticipatory bail or a reply to the notice, within days rather than weeks. Our post on what to do when an FIR is registered against you covers the general steps.

Are cyber crime offences bailable?

Some are and some are not, and most FIRs mix both. Section 77B of the IT Act makes offences punishable with three years or more cognizable, and makes offences punishable with three years bailable. So hacking under section 66, identity theft under section 66C, cheating by personation using a computer under section 66D, privacy violation under section 66E and a first offence under section 67 are cognizable but bailable. Section 67A (sexually explicit material) and section 67B (child sexual abuse material) carry five years and are not bailable.

The difference usually comes from the BNS sections added alongside. Cheating and dishonestly inducing delivery of property under section 318(4) BNS carries up to seven years and is non-bailable. Extortion, forgery for the purpose of cheating and criminal conspiracy are often added. In larger frauds the police now invoke section 111 BNS, organised crime, which expressly lists cyber crimes and carries a minimum of five years; that changes the bail picture considerably, and courts look hard at whether the ingredients of a ‘continuing unlawful activity’ by an ‘organised crime syndicate’ are actually shown.

Bailable means the police or the court must release you on bail as of right once you furnish bail bonds. Non-bailable does not mean bail is refused; it means the court has discretion and will weigh the facts. Most people accused of non-bailable cyber offences do get bail at some stage. The question is when, and on what conditions.

Common charges in cyber crime cases

This table shows the maximum punishment and whether the offence is bailable. Check the FIR for the exact sub-sections, because they change the answer.

Will the police arrest me, or send a notice?

For offences punishable with up to seven years, which covers almost every cyber fraud charge short of organised crime, the police should normally issue a notice under section 35(3) BNSS asking you to appear, rather than arrest you. Arrest is allowed only if the officer records reasons under section 35(1), such as preventing further offences, proper investigation, preventing tampering with evidence, or securing your presence. The Supreme Court's guidelines in Arnesh Kumar v State of Bihar (2014) require police and magistrates to apply this test, not just copy the words of the section. Our post on the police notice under section 35 BNSS explains what happens when you go.

The notice must be served in the ordinary way. In Satender Kumar Antil v CBI, the Supreme Court directed in 2025 that notices under section 35 BNSS cannot be served through WhatsApp or other electronic means as a substitute for the modes the BNSS provides. A WhatsApp message from a number claiming to be the police, asking you to come to another state tomorrow, is not valid service, and in cyber cases it may itself be a scam. Verify it through the police station and your lawyer.

If you are arrested, the grounds of arrest must be given to you in writing. In Mihir Rajesh Shah v State of Maharashtra (November 2025), the Supreme Court held that written grounds, in a language you understand, are mandatory for all offences, and must be supplied at least two hours before you are produced before the magistrate for remand, failing which the arrest and remand are illegal. The narrow exception is an offence committed in the officer's presence, where oral grounds can be given first. Your rights at arrest are covered in our post on your rights on arrest in Delhi.

Should I apply for anticipatory bail in a cyber case?

If the FIR includes a non-bailable section and there is any real chance of arrest, yes, usually before you join the investigation. Anticipatory bail is sought under section 482 BNSS from the Sessions Court or the High Court. Courts look at the nature of the allegation, your role as shown in the FIR, whether custodial questioning is genuinely needed, your antecedents, and your willingness to join the investigation and produce devices. In cyber cases the investigation is largely documentary and digital, which is a strong argument against custody where you are ready to cooperate.

Courts are less willing where the amount is large, where the money trail leads clearly to you and has not been recovered, where you are said to be a key operator rather than a peripheral account holder, or where section 111 BNS is credibly made out. In those cases interim protection may be granted on conditions, such as depositing a part of the amount or handing over your phone, while the full application is heard.

When the FIR is in another state, your first application should normally be in the court with jurisdiction over that police station. If you genuinely cannot get there before arrest, the Supreme Court has accepted that a court where you live can, in exceptional cases, grant limited interim anticipatory bail for a short period so you can approach the proper court. Our post on anticipatory bail in Delhi covers the procedure in detail.

What to do after you get a notice or learn of the FIR

These steps apply to most cyber cases, whether the FIR is in Delhi, Noida, Ghaziabad or another state.

1. Get the FIR and the notice checked

   Collect the FIR copy and any notice. Your lawyer reads the sections, the date of the alleged offence, the amount and your alleged role, and works out whether the case is bailable and which court has jurisdiction.

2. Collect your own records

   Bank statements for the period, UPI history, the SIM purchase and ownership details, phone bills, sale invoices for any money received, and messages that explain the transactions. These are the papers that show what the money in your account actually was.

3. Decide on anticipatory bail

   If any non-bailable section is involved, file for anticipatory bail before appearing, unless your lawyer advises that the risk of arrest is low. Interim protection can sometimes be obtained at the first hearing.

4. Reply to the notice and appear

   Appear on the date given, with your lawyer's advice on what to carry. Give a short written reply with documents rather than long oral explanations. Ask for a receipt of what you submit.

5. Handle device requests carefully

   If the police ask for your phone or laptop, get a seizure memo listing it with its IMEI or serial number. Ask for the hash value or imaging details to be recorded. Take advice before giving passwords to accounts unrelated to the allegation.

6. Track the investigation

   Note every date you are called, every document you give, and what you are told. If the police keep calling you without progress, or seize property unrelated to the case, your lawyer can approach the magistrate.

How do courts decide bail in cyber fraud cases?

Regular bail after arrest is sought from the magistrate under section 480 BNSS and, if refused or if the offence is triable by the Sessions Court, from the Sessions Court or High Court under section 483. The general principles from Satender Kumar Antil v CBI (2022) apply: bail is the rule, especially where the investigation is largely complete and the offence is not punishable with death or life imprisonment. In cyber cases, a few factors usually decide the outcome.

The first is the money trail. Courts want to know how much reached your account, where it went next, and whether it has been frozen or recovered. An account holder through whom ₹40,000 passed is in a very different position from one through whom ₹40 lakh passed. The second is whether your devices have already been seized and imaged; once the data is with the forensic laboratory, the argument that you will tamper with digital evidence weakens. The third is custody already undergone compared with the likely sentence. The fourth is parity: if co-accused with a similar role have been granted bail, that is a strong ground. In cyber bail matters that come to Advocate B.K. Singh, the paper that most often helps at the first hearing is a one-page chart of the money, showing each credit to the client's account, the time it arrived and where it went, matched against the bank statement.

Conditions are common. Courts may require you to join investigation on specified dates, not to leave the country without permission, to surrender your passport, not to contact the complainant or witnesses, not to open new bank accounts or SIM cards without informing the IO, and sometimes to deposit an amount equal to what reached your account. If the chargesheet is not filed within 60 days for offences up to seven years, or 90 days for more serious ones, you become entitled to default bail under section 187 BNSS; see our post on default bail when the chargesheet is late.

Police from another state arrested me or a family member: what now?

This is common in cyber cases. Police teams from the state where the complaint was registered come to Delhi NCR, often with the local police, and arrest the person. The arrested person must be produced before the nearest magistrate within 24 hours, and the outside police must obtain a transit remand to take them to their state. That production before the local magistrate, usually in the duty court of the district court complex, is the first real chance to intervene.

At the transit remand hearing, your lawyer can check whether the written grounds of arrest were supplied in time, whether the arrest memo and the information to family were given, whether the offences actually justify arrest, and whether a medical examination was done. The local magistrate does not decide the case, but can refuse transit remand if the arrest is plainly illegal, and can record defects that help later. Family members should reach the police station or the court quickly with the person's ID, details of any illness and contact details of a lawyer.

Once the person is taken to the other state, regular bail is sought from the court there. For families in Delhi NCR that means engaging counsel in that district, which our firm does through associate counsel where needed, while the papers are prepared here.

My bank account was used in a fraud. Am I guilty?

Not automatically. A large share of people arrested in cyber fraud cases are account holders whose accounts received defrauded money: ‘mule accounts’. Some knowingly rented or sold their accounts for a commission. Others were students or daily earners who handed over an account kit for a small payment without understanding what it would be used for. Some received money for a genuine sale of goods or crypto and had no connection with the fraud at all. The law punishes knowledge and dishonest intention, not the mere fact that money passed through.

The defence in a mule account case is built on the records. What was the money for? Is there an invoice, a chat, a listing on a marketplace or a crypto exchange record that explains it? Who controlled the net banking, UPI app and SIM linked to the account? Was the debit card or chequebook handed to someone else, and is there evidence of that? Did the account holder withdraw and keep the money, or did it go straight out through transactions they did not make?

Be honest with your lawyer about what you knew. If you sold your account, the defence is different from a case where you never knew it was being used, and an approach based on the truth, such as cooperating with the investigation to identify the person who bought the account, usually works better than a denial the records will contradict. Account freezing and the release of money are dealt with separately in our post on getting a frozen account released.

How do I get my seized phone or laptop back?

Apply to the magistrate for release on superdari, that is, interim custody on a bond, under section 497 or section 503 BNSS. Police seize devices under section 106 BNSS, and the court has power to order their release pending trial. The usual answer from the prosecution is that the device is needed for forensic examination. The response is that once a forensic image (a complete, hashed copy) has been taken, the device itself is not needed, and you can undertake to produce it whenever the court asks.

Phones and laptops lose value fast and often hold work and personal data unrelated to the case. Courts in Delhi regularly release devices on conditions: that the data is imaged first, that the device is not sold or wiped, and that it is produced when required. Ask for a copy of the seizure memo at the time of seizure, check that the IMEI or serial number is correctly recorded, and note any damage. If the seizure memo does not match what you handed over, raise it at once in writing.

Whether you can be compelled to give your phone password is not settled. Some High Courts have held that giving a password is not testimonial compulsion barred by Article 20(3) of the Constitution; others have taken a more protective approach. Do not refuse or agree without advice, and do not give passwords to email or cloud accounts that have nothing to do with the allegation unless you are legally required to.

How is a cyber crime case defended?

The central question in most cyber cases is attribution: can the prosecution prove that you, and not someone else, did the act? An IP address identifies a connection, not a person, and in shared Wi-Fi, office networks or mobile data with carrier-grade address sharing it may point to many users. A SIM card may be registered in your name but used by someone else, especially where it was bought with your documents by a shopkeeper or a relative. A bank account may be yours while the net banking credentials and UPI app sit on a phone in another state. The defence tests every link in that chain.

The second line is the evidence itself. The prosecution must prove electronic records through a proper certificate under section 63 of the Bharatiya Sakshya Adhiniyam, with hash values, and must show a clean chain of custody from seizure to forensic report. Seizures not recorded on video under section 105 BNSS, unsealed devices, late hashing, a forensic report that does not match the seizure memo, and call detail records without the required certificate are all points of attack. Our post on electronic evidence and the Section 63 BSA certificate explains these rules.

The third is the ingredients of the offence. Cheating needs dishonest inducement from the start; a failed business deal or an unpaid online order is not automatically cheating. Organised crime under section 111 BNS needs a continuing unlawful activity by a syndicate, with the legal conditions met. Jurisdiction is another point: under sections 197 to 199 BNSS an offence can be tried where an act was done or its consequence followed, which in cyber cases may be several places, but the police station must still show some connection.

Key provisions for the accused

Papers to collect for a bail application in a cyber case

Can a cyber crime case be settled or quashed?

Sometimes. IT Act offences punishable with up to three years can be compounded by the court under section 77A, unless they affect socio-economic conditions or were committed against a child or a woman. Some BNS offences are compoundable under section 359 BNSS, with the complainant's consent and, for some, the court's permission. Cheating under section 318(4) is compoundable with the court's permission. Where an offence is not compoundable, the High Court can still quash the FIR under section 528 BNSS on a genuine settlement if the case is essentially private and no larger public interest is involved; see our post on quashing an FIR after a compromise.

Settlement is realistic in disputes between known parties: an online business deal gone wrong, an account dispute between former partners, a social media quarrel. It is much harder in a mass fraud with many victims, where the police and courts treat the case as a public matter. Courts also look carefully at a ‘settlement’ that simply returns money to one victim while others remain unpaid. Quashing on merits, where the FIR does not disclose any offence against you, is a separate route and does not need the complainant's consent.

Mistakes people accused in cyber cases make

• Wiping or replacing the phone. It looks like destruction of evidence and destroys records that might have helped.
• Going to another state alone on a WhatsApp message. Verify the notice. Go with advice, and with anticipatory bail where needed.
• Contacting the complainant directly. It can be seen as intimidation or used as an admission.
• Giving long oral statements. Short written replies backed by documents are safer and leave a record of what you said.
• Hiding what you knew about the account. The bank and phone records usually show it. A defence built on the truth holds up better.
• Ignoring court dates after bail. Missing dates in another state's court leads to warrants and cancelled bail. Keep track of every date.

What happens after the chargesheet is filed?

Once the police file the chargesheet, the court takes cognizance and summons the accused, and copies of the documents relied on are supplied, including electronic records. This is the time to check what the prosecution actually has: the bank trail, the forensic report, the certificate under section 63 BSA, the call records, and the statements. If the material does not show your link to the offence, a discharge application before charges are framed is often the right step; see our post on discharge applications.

If charges are framed, the trial proceeds with prosecution witnesses, typically the complainant, bank officials, nodal officers of telecom companies, forensic examiners and the IO. Cyber trials often turn on the cross-examination of the technical witnesses: how the data was extracted, whether the hash values match, and whether the records really link the accused to the act. Bail conditions continue during trial, and changes, such as permission to travel abroad, need an application to the court.

What to do this week if you are accused in a cyber case

• Get the FIR copy and note every section applied
• Verify any police notice through the police station before acting on it
• Do not delete data or reset your phone
• Download bank statements and UPI history for the relevant months
• Gather invoices, chats and SIM details that explain the transactions
• Decide with your lawyer whether to file anticipatory bail now
• Keep a list of every date, call and document given to the police
• Tell your family who to contact if you are arrested

When to get a lawyer, and what to expect

In a cyber case, the most useful time to involve a lawyer is before you answer the first notice or appear at the police station, because what you say and hand over then shapes the whole case. A lawyer can check whether the sections are bailable, file anticipatory bail in the right court, prepare a written reply, deal with device seizure and appear at a transit remand hearing at short notice.

When Advocate B.K. Singh looks at a cyber fraud file for an accused, the first thing he checks is the money trail: how much actually reached the client's account, where it went within the next hour, and who was operating the net banking at the time. His computer science background (MCA) helps in reading IP logs, device extraction reports and the forensic certificate for what they actually prove. Our firm handles these cases from the Dwarka and Vaishali offices, in Delhi, Noida and Ghaziabad courts and, through associate counsel, in other states; see our page on criminal cases in Delhi's courts. If you have received a notice or learnt of an FIR, you can send the papers through our online enquiry form and we will tell you the urgent steps.