OSINT investigation · public sources only
Who is behind that fake account? Lawful OSINT, takedown and the legal route.
Reviewed by the Codesnag cyber team and the VirtualVakil legal team · Last reviewed:
Short answer
The Codesnag cyber team, working with the advocates of VirtualVakil, investigates fake, impersonating, harassing and scam accounts using public-source information only: what the account, its linked profiles, websites, domains, payment handles and public records reveal, and how they connect. We report the account to the platform and its Grievance Officer for takedown, and, where the facts justify it, take the matter to the police or a court, which are the only routes that can make a platform disclose who registered an account. We never break into accounts, and we cannot promise to identify the person.
Being threatened, or are intimate images involved? Report on cybercrime.gov.in or call 1930 now, and keep the evidence. Do not engage with the account.
Who it is for
Fake profiles, impersonation, harassment and scam accounts
Individuals and creators
- A profile using your name and photos
- Trolling, threats or harassment from anonymous accounts
- Morphed or intimate images posted or shared
- A scam account that took your money
Businesses
- Fake customer-care profiles and helpline numbers
- Fake job offers or investment schemes using your name
- Look-alike websites and fake apps
- Anonymous defamatory posts about the business
What OSINT can and cannot show
What public sources can reveal, and what only the platform knows
What it can often show
- Other accounts run by the same person: reused usernames, photos, bios, links and posting patterns
- Where the profile photos were taken from, by reverse image search
- Phone numbers, UPI IDs, websites or payment pages the account itself has published
- Public domain registration and hosting records for a scam website
- Archived copies of posts and pages that were later deleted
- Whether the same scam has been reported elsewhere, and by whom
What it cannot show
- The name, phone number, email or IP address the account was registered with. Only the platform holds these.
- Private messages, private posts or anything behind a login.
- The person's location from their phone or network.
That is why every investigation ends with a route to the platform, the police or a court: they can obtain what public sources cannot.
Our rules
What we never do
We work only with public-source information and evidence you are entitled to give us.
Log in to, guess the password of, or break into any account
Unauthorised access is an offence under IT Act S. 43 read with S. 66, whoever the target is.
Send 'tracking links', phishing pages or malware to the suspect
Deceiving someone into revealing their device or location is not public-source research, and it taints the evidence.
Buy leaked databases or use paid 'number lookup' bots
Data of this kind is usually stolen and often wrong.
Pose as police, the platform or anyone else to get information
Impersonation to obtain data can itself be an offence.
Publish or 'expose' the person we think is behind an account
Findings go to you, your advocate, the police or the court, never to social media. A wrong public accusation can be defamation under BNS S. 356.
We also cannot promise to identify the person behind an account, or that a platform, the police or a court will act.
Takedown and the legal route
How a fake account is taken down, and how its owner can be identified
1.Report to the platform
Through the platform's own impersonation or harassment form first, with the evidence organised so the reviewer can act.
2.Complain to the Grievance Officer
Under the IT Rules, 2021 the Grievance Officer must acknowledge a complaint within 24 hours and resolve it within seven days. Content that impersonates you, including morphed images, or exposes you intimately, must be removed within two hours of your complaint, which someone may make on your behalf.
3.Appeal if it is not resolved
If the Grievance Officer's decision does not resolve it, you may appeal to the Grievance Appellate Committee within 30 days of that decision.
4.Police complaint
On cybercrime.gov.in or at the police station, with the OSINT findings attached. The police can require the platform to provide the information it holds; under the IT Rules the platform must respond to a lawful order from an authorised agency within 72 hours.
5.Court orders
Where the police route stalls or the matter is civil, such as defamation or brand impersonation, a court can be asked to order the platform to take content down and to disclose the subscriber information behind the account. The Magistrate can also be asked to direct an investigation under BNSS S. 175(3).
Timelines from the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, rule 3(2), rule 3A and rule 3(1)(j), as updated on 10 February 2026.
The law that usually applies
Sections often used against fake and harassing accounts
Which sections fit depends on the facts; our advocates choose them for your complaint.
- IT Act S. 66C
- Identity theft: fraudulent use of another person's password, electronic signature or other unique identification feature.
- IT Act S. 66D
- Cheating by personation using a computer resource.
- BNS S. 319
- Cheating by personation.
- BNS S. 356
- Defamation.
- BNS S. 78
- Stalking, including monitoring a woman's use of the internet, email or other electronic communication.
- BNS S. 351
- Criminal intimidation.
- IT Act S. 66E and S. 67
- Publishing private images without consent; publishing obscene material, such as morphed photos.
One team
Cyber experts find it. Advocates take it forward.
The Codesnag cyber team does the public-source research and records how each finding was obtained; the advocates of VirtualVakil turn it into the takedown request, the complaint or the court application.
- Account hacked rather than faked? Instagram or WhatsApp hacked: how to get it back
- Fraud, data theft or a complex case? Cyber crime investigation by advocates and cyber experts
- Only need the complaint drafted? We file your cyber crime complaint · cyber help by situation
- A business under attack? Cyber incident response · Cyber Surety (a membership, not insurance)
FAQs
Public sources sometimes connect the account to other profiles, photos, websites or payment handles that point to a person; often they do not. The registration details are held only by Instagram's operator, Meta, which discloses them to the police or under a court order. The practical route is to preserve the evidence, report the account to Instagram and its Grievance Officer, and file a police complaint with the findings so that the police can ask for the records.
No. We never break into accounts or send tracking links or malware. Unauthorised access is an offence under IT Act S. 43 read with S. 66 whatever the motive, and it would damage your case. Be wary of anyone who offers it.
Under rule 3(2)(b) of the IT Rules, 2021, as amended on 10 February 2026, an intermediary must take all reasonable and practicable measures to remove content that impersonates you, including morphed images, or that exposes you intimately, within two hours of receiving your complaint. Other complaints must be acknowledged within 24 hours and resolved within seven days.
Appeal to the Grievance Appellate Committee within 30 days of the Grievance Officer's decision, and file a police complaint or, where it fits, approach a court for a takedown and disclosure order. Our advocates prepare these.
Looking at information that people or organisations have made public is lawful; getting around logins, deceiving people or using stolen data is not. We stay on the lawful side and record how each finding was obtained, so it can be relied on.
Only if the account itself, or another public source, has published it. We do not run 'lookups' on private data. Subscriber details come from the platform or telecom operator, through the police or a court.
Yes. We trace fake customer-care profiles, fake job offers, look-alike websites and fake apps using your name, report them to the platforms, registrars and hosts, and take the legal route where needed.
The first call is free. We quote after it, once we know how many accounts are involved and which route fits.
Primary sources
Where these rules come from
- IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, updated as on 10 February 2026 (MeitY): rule 3(1)(j), rule 3(2), rule 3A
- Information Technology Act, 2000: S. 43, S. 66, S. 66C, S. 66D, S. 66E, S. 67 (India Code)
- Bharatiya Nyaya Sanhita, 2023: S. 78, S. 319, S. 351, S. 356 (India Code)
- Bharatiya Nagarik Suraksha Sanhita, 2023: S. 175 (India Code)
- National Cyber Crime Reporting Portal (cybercrime.gov.in), Ministry of Home Affairs
Last reviewed 19 Oct 2026. General information, not legal advice for your case. If anything here differs from the official text, the official text prevails. Codesnag and VirtualVakil are not the police or a government service. codesnag.ai is a unit of Cyber Legal Intelligence Partners.