Sextortion in India: Intimate-Image Blackmail, 2-Hour Takedown, FIR, Evidence & Legal Remedies

By Adv. Govind Bali, Fastrack Legal Solutions LLP | Reviewed on 20 August 2026

Sextortion is blackmail built around sexual or intimate material. The offender may possess a genuine image or recording, fabricate a deepfake, record a video call, compromise an account, or merely pretend to possess private material. The threat is then used to demand money, further images, sexual access, continued contact, silence, or some other act.

Indian law does not contain one omnibus offence named “sextortion”. Liability is determined from the actual conduct. Depending on the facts, the case may involve extortion, attempted extortion, criminal intimidation, voyeurism, stalking, identity-based deception, privacy violations, publication of obscene or sexually explicit electronic material, child sexual abuse material, cheating, unauthorised account access and conspiracy.

Immediate legal answer: Do not pay merely to buy silence. Preserve the complete digital trail, report every live URL and account through the platform’s designated grievance channel, invoke the two-hour removal mechanism under Rule 3(2)(b) of the amended IT Rules, file a cybercrime complaint and police complaint, notify the bank immediately if money has moved, and seek urgent injunctive or criminal-court protection where continued publication is threatened.

Key Takeaways

Consent to create or privately share an intimate image is not consent to publish or forward it.
Under the IT Rules as amended in 2026, an intermediary must take reasonable and practicable measures within two hours of receiving a qualifying complaint concerning private-area exposure, nudity, sexual conduct, impersonation or artificially morphed imagery.
Payment rarely ends sextortion. It may confirm that the victim can be pressured and trigger escalating demands.
Preserve the threat, profile, URL, account identifiers, payment instructions and original files before blocking or reporting the offender.
A cognizable offence may be reported at any police station irrespective of where it occurred under section 173 BNSS; electronic information must be signed within three days.
Where sections 77, 78 or 79 BNS are alleged by a woman, the information must be recorded by a woman police officer or woman officer.
If the depicted person is under eighteen, POCSO and section 67B of the IT Act require special urgency, confidentiality and mandatory reporting.
A platform takedown does not substitute for an FIR, evidence preservation, bank action or an injunction against further dissemination.

1. What Conduct Amounts to Sextortion?

The word describes a method of coercion, not a single statutory charge. Common patterns include:

Relationship-based blackmail: a former partner threatens to circulate material originally created or shared within a relationship.
Video-call trap: a person is induced into a sexual video call, which is secretly recorded and used for payment demands.
Morphed-image or deepfake abuse: the victim’s face or voice is placed into fabricated intimate content.
Account compromise: private photographs or conversations are taken from a hacked cloud, email, messaging or social-media account.
Impersonation: a fake account distributes or threatens to distribute content in the victim’s name.
Child-targeted coercion: a minor is pressured to produce more material, pay money or meet the offender.
False-possession threat: the offender has no intimate content but relies on panic, a stolen profile photograph or a fabricated screenshot.
Commercial sextortion network: several persons operate accounts, payment channels and mule accounts across jurisdictions.

The complaint should describe facts instead of merely using the label “sextortion”: what was captured or fabricated, who threatened publication, what was demanded, where the message was received, whether anything was uploaded, whether money was paid, and whether the victim is a child.

2. What to Do in the First Hour

Do not negotiate under panic

Do not send more intimate material, identification documents, OTPs, remote-access permissions or money. Do not meet the offender. If a short response is needed to avoid immediate escalation while evidence and police assistance are secured, it should not contain admissions, abuse, counter-threats or promises.

Preserve before blocking

Take screenshots showing the entire screen, date, time, username and surrounding conversation.
Screen-record the offending profile, handle, bio, follower details, post, story, channel and live URL.
Export the complete chat where the application permits it.
Save original emails with full headers and original media without editing, cropping or compression.
Record phone numbers, email addresses, UPI IDs, QR codes, bank accounts, wallet addresses and transaction references.
Note the device used, platform, time zone, first contact, threat, demand, payment and publication chronology.
Preserve call logs, voicemail, cloud-login alerts and account-security notifications.
Keep copies of every platform complaint, acknowledgement, ticket number and response.

Do not repeatedly forward intimate material to friends, groups or advisers. Preserve it in a restricted, encrypted location and share it only through a legally necessary channel. Where a child is involved, casual possession or circulation can itself create serious statutory consequences.

Secure the compromised account

Change the password from a clean device.
Terminate unknown sessions and revoke third-party access.
Enable multi-factor authentication.
Secure the linked email and mobile number.
Preserve the security logs before they expire.
Do not factory-reset the relevant phone or computer before forensic advice where hacking is alleged.

3. The Two-Hour Platform Takedown Rule in 2026

Rule 3(2)(b) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, as amended with effect from 20 February 2026, requires an intermediary to act within two hours of receiving a complaint made by the individual or a person acting on that individual’s behalf. The special category covers content that prima facie:

exposes the individual’s private area;
shows full or partial nudity;
shows or depicts the individual in a sexual act or conduct; or
is electronic impersonation, including an artificially morphed image.

The intermediary must take all reasonable and practicable measures to remove or disable access to content hosted, stored, published or transmitted by it. The current consolidated IT Rules published by MeitY should be cited in the platform complaint. Older online guidance referring to a twenty-four-hour period is now outdated.

What a proper takedown complaint should contain

The victim’s name and a safe contact address.
A statement that the complainant is the depicted individual or is authorised to act on that person’s behalf.
Every exact URL, handle, post, story, channel, group or communication link presently known.
A concise identification of the private, nude, sexual, impersonated or morphed character of the material.
A clear statement that dissemination is without consent.
A demand for action under Rule 3(2)(b) within two hours.
A request to preserve content, upload logs, IP/device identifiers, subscriber details, timestamps and account records for lawful investigation.
A request for a unique complaint number and written action-taken confirmation.

Do not attach more intimate material than the grievance mechanism strictly requires. Wherever possible, identify it by URL, thumbnail, hash, timestamp or restricted reference. A removal request and an evidence-preservation request should be made together so that takedown does not destroy the investigative trail.

Other current intermediary deadlines

Mechanism	Current timeline	Purpose
Rule 3(2)(b) special intimate/impersonation complaint	Two hours	Removal or disabling of qualifying private, nude, sexual, impersonated or morphed content
General grievance under Rule 3(2)(a)(i)	Seven days	Resolution of a user grievance unless a faster special timeline applies
Certain Rule 3(1)(b) removal grievances	Thirty-six hours	Expedited decision/action for specified unlawful-content grievances
Rule 3(1)(d) actual knowledge through court order or authorised government intimation	Three hours	Removal or disabling of specified unlawful information after legally recognised actual knowledge
Appeal to Grievance Appellate Committee	Within thirty days of the decision communication	Online appeal against the Grievance Officer’s decision or failure to resolve within the prescribed period

The Grievance Appellate Committee is to deal with an appeal expeditiously and endeavour to resolve it within thirty calendar days. Urgent criminal or civil relief should not be deferred merely because a platform appeal is available.

4. Deepfakes and Morphed Intimate Images

The 2026 amendments expressly address synthetically generated information, including realistic AI-created or AI-altered audio, images and videos. Rule 3(3) imposes additional due diligence on intermediaries that enable the creation, alteration, publication or dissemination of synthetic content. The framework specifically treats non-consensual intimate imagery, sexually explicit deepfakes, synthetic “undressing”, sexualised voice cloning and deceptive impersonation as high-risk unlawful uses.

Permissible synthetic content is subject to labelling and provenance requirements under the amended framework; unlawful non-consensual intimate content does not become lawful merely because it carries an “AI-generated” label. MeitY’s official 2026 explanatory FAQs clarify the new duties, while expressly stating that the notified Rules remain the controlling legal text.

5. Offences Under the Bharatiya Nyaya Sanhita, 2023

The applicable provision depends on proof of threat, demand, payment, capture, dissemination, identity, victim and intention. The official text of the Bharatiya Nyaya Sanhita, 2023 should be applied to the actual allegations.

Provision	When it may apply	Important point
Section 308 BNS — extortion	Fear of reputational or other injury is used to dishonestly induce delivery of money, property or valuable security	Completed extortion and putting a person in fear in order to commit extortion carry different consequences; section 308(2) is cognizable and non-bailable
Section 351 BNS — criminal intimidation	Threat to person, reputation or property is intended to cause alarm or compel an act/omission	A threat imputing unchastity to a woman falls within the aggravated form under section 351(3); criminal intimidation is ordinarily non-cognizable and bailable under the First Schedule
Section 77 BNS — voyeurism	A woman’s private act is watched, captured or the image is disseminated	Consent to capture but not to dissemination is expressly treated as an offence; first conviction is cognizable and bailable, subsequent conviction cognizable and non-bailable
Section 78 BNS — stalking	A man repeatedly contacts a woman despite disinterest or monitors her internet, email or electronic communication	First conviction is cognizable and bailable; subsequent conviction is non-bailable
Section 79 BNS	Words, gestures, objects or conduct intended to insult a woman’s modesty or intrude upon her privacy	Cognizable and bailable; fact-specific and not a substitute for proving more serious dissemination or extortion offences
Sections 318/319 and other BNS provisions	Deception, personation or linked dishonest inducement is alleged	Use only where each statutory ingredient is supported; a fake profile alone does not prove every cheating ingredient

Section 308 is especially important. Extortion requires dishonest inducement and delivery of property or valuable security. If the victim refuses to pay, the completed form may not be made out, but attempted extortion, putting a person in fear in order to commit extortion, criminal intimidation and the underlying privacy or publication offences may remain.

6. Information Technology Act Offences

The Information Technology Act, 2000 may apply independently and alongside BNS provisions:

Section 66C: dishonest or fraudulent use of another person’s electronic signature, password or unique identification feature.
Section 66D: cheating by personation using a communication device or computer resource.
Section 66E: intentional or knowing capture, publication or transmission of an image of a person’s private area without consent, under circumstances violating privacy.
Section 67: publication or transmission of obscene material in electronic form.
Section 67A: publication or transmission of material containing a sexually explicit act or conduct.
Section 67B: specified electronic conduct involving children and sexually explicit material.
Section 67C: preservation and retention obligations of intermediaries.
Sections 72 and 72A: breach of confidentiality/privacy or disclosure in breach of lawful contract in the circumstances defined by those provisions.

These provisions are not interchangeable. Section 66E is tied to an image of a “private area” and privacy-violating circumstances. Section 67A requires material containing a sexually explicit act or conduct; it should not be added mechanically to every allegation involving an ordinary photograph. Sections 66C and 66D require their respective identity and deception ingredients.

7. If the Victim or Depicted Person Is Under Eighteen

A child is a person below eighteen for POCSO purposes. Sextortion involving a child may attract the Protection of Children from Sexual Offences Act, 2012, section 67B of the IT Act and other penal provisions. POCSO section 19 imposes mandatory reporting where a person apprehends or knows that an offence under the Act has been committed. Failure to report may itself be punishable, subject to the Act.

Do not download, duplicate or circulate child sexual material except to the minimum extent lawfully necessary for reporting or evidence. Section 15 POCSO separately regulates storage or possession of child pornographic material, including failure to delete, destroy or report in the circumstances stated there. The child’s identity and privacy must be protected throughout.

A parent, guardian, school or adviser should prioritise safety and specialist support. The child should not be blamed, repeatedly interrogated or made to narrate the incident to multiple people. Immediate reporting and evidence preservation should be coordinated with child-friendly police and POCSO procedures.

8. Filing the Cybercrime Complaint and FIR

The Government’s National Cyber Crime Reporting Portal accepts online cybercrime complaints, with special focus on offences against women and children. The cyber helpline is 1930. Where money has just been transferred, call 1930 and notify the bank/payment provider immediately so that the financial trail can be acted upon without delay. For the recovery process, see our guide on cyber-fraud money recovery in India.

Under section 173(1) of the Bharatiya Nagarik Suraksha Sanhita, 2023, information relating to a cognizable offence may be given orally or electronically to the officer in charge of a police station, irrespective of the area where the offence occurred. Information given electronically must be signed within three days. A free copy of the recorded information must be supplied to the informant or victim.

If the police station refuses to record cognizable information, section 173(4) permits the substance to be sent in writing and by post to the Superintendent of Police. If relief still fails, an application supported by affidavit may be made to the Magistrate under sections 173(4) and 175(3), subject to the statutory procedure. Our detailed guide explains Zero FIR, e-FIR and police-refusal remedies under section 173 BNSS.

What to ask the investigating agency to preserve

Subscriber and registration details of the offending account.
Login IP addresses, device information, timestamps and session logs.
Original upload, message, deleted-content and cloud records.
Payment-beneficiary KYC, account opening documents and transaction trail.
UPI, wallet, telecom and email records.
CCTV and ATM material where cash withdrawal followed transfer.
Mutual legal assistance or platform law-enforcement requests where infrastructure is abroad.
Forensic imaging of relevant devices with hash values and chain-of-custody documentation.

9. Electronic Evidence and Section 63 BSA

Electronic material must be preserved in a manner that supports authenticity, integrity and attribution. Sections 61 to 63 of the Bharatiya Sakshya Adhiniyam, 2023 govern proof of electronic records. A screenshot can be useful, but the original device, full conversation, metadata, source record and statutory certificate may be decisive.

Retain the original device and original electronic files.
Do not crop, enhance, annotate or re-save the only copy.
Create working copies and record hash values where professional forensic collection is available.
Maintain a contemporaneous chronology identifying who collected each item, when and how.
Preserve the account and platform acknowledgements even after the offending content disappears.
Prepare the section 63 certificate from a person competent to speak to the device/system and method of production; do not use a generic certificate unrelated to the actual source.

A platform takedown may make the public URL unavailable. That is precisely why the victim should preserve the URL and seek platform preservation before or simultaneously with removal.

10. Jurisdiction in Online Sextortion Cases

Section 197 BNSS states the ordinary rule that an offence is tried where it was committed. Sections 198 and 199 address offences spanning several areas and cases where an act occurs in one place and its consequence ensues in another. Section 202 specifically addresses cheating practised through electronic communications: jurisdiction may exist where the communication was sent or received, and where property was delivered or received.

For extortion, section 201 contains additional place-of-trial rules. The precise police station and court must be selected from the place of threat, receipt, publication, consequence, payment, accused and technical evidence. A Zero FIR may secure immediate registration and transfer, but it does not eliminate later questions of investigating and trial jurisdiction.

11. Urgent Injunction and Court Remedies

Where publication is imminent or recurring, criminal reporting alone may not provide sufficiently fast preventive relief. Depending on the parties and cause of action, a civil suit or writ remedy may seek:

an interim and permanent injunction against publication, republication, transmission or threat;
mandatory removal or disabling of identified URLs and mirror copies;
preservation and disclosure directions subject to lawful process;
restraint against creating impersonating accounts;
delivery-up or deletion after forensic preservation;
damages, where properly pleaded and proved; and
confidential filing, masking or restricted access to protect the victim’s identity and intimate material.

The right to privacy recognised in Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1, includes decisional and informational dimensions. However, the exact defendant, court, territorial jurisdiction, valuation, court fee and intermediary relief must be determined from the pleaded cause of action and applicable State law. An intermediary cannot be asked through a vague order to monitor the entire internet without identifying material and a lawful basis.

An urgent application should annex a sealed or access-controlled schedule of URLs, screenshots and identifiers rather than reproduce intimate content in the publicly accessible body of the plaint or petition. Ask for time-bound electronic communication of the operative order to the platform’s grievance and legal channels.

12. If Money Has Already Been Paid

Call 1930 immediately and record the acknowledgement number.
Report through the National Cyber Crime Reporting Portal.
Notify the remitting bank, beneficiary bank, UPI application or wallet and seek a transaction hold/recall.
Preserve UTR/RRN, bank statement, QR code, payment page and beneficiary details.
Disclose every payment, including earlier payments made in panic; concealment breaks the transaction chain.
Do not pay a supposed “recovery agent” who contacts you through an unofficial number.

Recovery is not automatic. Speed, availability of funds, account layering, bank response, police requisitions and judicial orders determine the result. A successful hold is not the same as final restitution.

13. Remedies When the Platform Does Not Act

Escalate to the published Grievance Officer and Resident Grievance Officer, where applicable.
Quote Rule 3(2)(b), identify each URL and retain proof of the time the complaint was received.
File an appeal to the Grievance Appellate Committee within thirty days where the grievance decision or non-resolution is appealable under Rule 3A.
Provide the police with the grievance ticket and request lawful preservation/removal communication.
Seek an urgent, narrowly framed court order identifying the content, account and relief required.
Document re-uploads separately; one removed URL may not automatically cover a different copy or account.

14. Legal Position of a Person Falsely Accused

Sextortion complaints are serious, but accusation is not proof. Mistaken identity, spoofed numbers, compromised accounts, edited chats, fabricated screenshots and relationship disputes require forensic examination. A person accused should not contact, threaten, shame or pressure the complainant into withdrawal. Nor should the person delete chats, reset devices or manufacture an explanation.

Preserve the complete conversation, not selected screenshots.
Secure login, location, device, telecom and payment records that may prove attribution or non-attribution.
Identify whether the alleged account was controlled by the accused at the relevant time.
Comply with lawful investigation notices through counsel where necessary.
Seek preservation of platform records before routine retention periods expire.
Where arrest is reasonably apprehended in a non-bailable case, assess anticipatory bail under section 482 BNSS.
Challenge mechanical addition of provisions whose statutory ingredients are absent, without trivialising the privacy harm alleged.

Bail depends on the invoked offences, punishment, classification, dissemination, age of the depicted person, amount demanded or received, custody required for devices/accounts, prior conduct and risk of evidence tampering. Section 308(2) BNS is cognizable and non-bailable; section 351 criminal intimidation is ordinarily non-cognizable and bailable. Section 77 voyeurism is bailable on first conviction but non-bailable on a subsequent conviction. IT Act and POCSO allegations materially alter the analysis.

15. Limitation, Court Fee and Filing Practice

Police/NCRP complaint: no court fee is payable. Report immediately; delay can destroy platform, telecom, banking and IP-log evidence.
Criminal limitation: the BNSS limitation chapter applies according to the maximum punishment. The ordinary statutory bar covers fine-only offences, offences up to one year and offences above one but not exceeding three years with respective periods; offences punishable above three years are not governed by that three-tier bar. Continuing and delayed-discovery questions remain fact-specific.
Magistrate application: filing and process fees are governed by the concerned State’s court-fee law and criminal-court rules; usually no ad valorem fee is involved.
Civil injunction: valuation, pecuniary jurisdiction and court fee depend on the relief and applicable State enactment. A damages claim may attract additional valuation and fee.
Platform grievance: preserve electronic filing proof, exact receipt time, ticket number and the platform’s published grievance policy.
Confidential material: move a specific application for sealed cover, restricted access, redaction or in-camera handling instead of assuming that filing automatically remains private.

16. Common Mistakes That Weaken the Case

Paying repeatedly and deleting the conversation.
Blocking before capturing the profile, URL and payment demand.
Forwarding intimate content to numerous people “for advice”.
Reporting only the account name without the exact live URL.
Using outdated twenty-four-hour takedown language after the 2026 amendment.
Failing to ask the platform to preserve logs while removing public access.
Submitting edited screenshots without the original device or complete context.
Invoking every BNS and IT Act provision without matching statutory ingredients.
Ignoring POCSO mandatory-reporting and confidentiality duties where a child is involved.
Filing in a convenient court without pleading territorial and pecuniary jurisdiction.
Assuming that a takedown permanently prevents re-upload.

17. Lawyer-Ready Document Checklist

One-page chronology with dates and exact times.
Victim’s identity document kept confidentially.
Full chat export and original device.
Screenshots and screen recording of the profile/content.
URLs, usernames, phone numbers, email IDs and account identifiers.
Original media and file metadata.
Call logs, emails with headers and cloud-security alerts.
Bank statement, UTR/RRN, UPI ID, QR code and beneficiary details.
Cybercrime portal acknowledgement and 1930 reference.
Police complaint, FIR/Zero FIR and refusal/escalation correspondence.
Platform grievance, ticket number, timestamps and response.
Proof of re-upload or continuing threat.
For a child: age proof, guardian details and POCSO reporting record.
For urgent court relief: sealed URL schedule, affidavit, urgency note and draft operative directions.

Frequently Asked Questions

Is sextortion a separate offence in India?

No single BNS or IT Act section is titled “sextortion”. The conduct is prosecuted through the provisions whose ingredients are proved, including extortion, intimidation, voyeurism, stalking, privacy, obscene/sexually explicit electronic publication, identity misuse and POCSO offences.

Does consent to send a private image permit the recipient to share it?

No. Consent is purpose-specific. Section 77 BNS expressly states that where a woman consents to capture but not dissemination to third persons, dissemination is an offence under that section when its other requirements are satisfied.

How quickly must social media remove an intimate or morphed image?

Under Rule 3(2)(b) of the IT Rules as amended in 2026, the intermediary must act within two hours of receiving the qualifying complaint and take all reasonable and practicable measures to remove or disable access.

Should the victim pay if the offender promises deletion?

Payment provides no enforceable assurance of deletion and commonly leads to further demands. Preserve evidence and obtain urgent platform, bank, police and court assistance instead.

Can an FIR be filed where the victim lives?

Section 173 BNSS permits cognizable information to be given at any police station irrespective of the area of occurrence. Final investigation and trial jurisdiction depend on sections 197–202 BNSS and the facts, including where messages were sent/received, consequences occurred and money was delivered or received.

What if the offender has not uploaded anything yet?

The threat and demand may still constitute attempted extortion, putting a person in fear in order to commit extortion, criminal intimidation or other offences. Preventive police action and an urgent injunction may be sought before publication.

Can a friend or lawyer file the platform complaint?

Rule 3(2)(b) allows the complaint to be made by the individual or a person acting on that individual’s behalf. The complaint should clearly state the authority and provide sufficient identifying links without unnecessary dissemination of the content.

Can deleted messages be recovered?

Sometimes, depending on the platform, device, backup, retention period and timely preservation request. Recovery is not guaranteed. Immediate forensic preservation and lawful platform requests improve the prospect.

Does the law protect male victims?

Yes. Extortion, criminal intimidation and applicable IT Act provisions are gender-neutral. Rule 3(2)(b) applies to an individual. Certain BNS offences such as voyeurism and stalking are drafted with specific gender elements, so the correct provisions must be selected from the facts.

What happens if the image is a deepfake and not real?

Morphed and impersonated intimate content is expressly covered by the special platform complaint mechanism. The 2026 IT Rules also impose specific obligations concerning unlawful synthetically generated information. Penal liability depends on the creation, threat, publication, deception and harm proved.

Conclusion

Sextortion succeeds by compressing time and isolating the victim. The legally stronger response is coordinated and evidence-led: preserve first, trigger the two-hour platform mechanism, report the cybercrime, stop the financial trail, secure the accounts, and seek a narrowly enforceable court order where necessary.

The complaint must separate what is known from what is suspected. Precise URLs, timestamps, identifiers, demands and payment records are more valuable than a long narrative unsupported by digital proof. At the same time, the law must be applied without gender assumptions, overcharging or public reproduction of the very material whose circulation is being restrained.

This article provides general legal information as of 20 August 2026. It is not legal advice or solicitation. Cybercrime procedure, platform rules, intermediary obligations and court practice are fact-specific and may change. Where there is an immediate threat to life, safety or a child, contact emergency services and the police without delay.

Fastrack Legal Solutions