Authored By: NIKITA DEWANGAN
Seth Ratanchand Surana Law College Durg, C.G.
Introduction-
In THIS 2026, Just imagine you’re scrolling through your feed and see a well-known financial expert—someone you’ve been following for years—urge you in an emergency to buy a new investment. The voice, expressions and even the background do not leave any doubt. This was the case for thousands of Indian investors in early 2026, when a hyper-realistic deepfake video led them to a cryptocurrency scam that emptied their coffers of over ₹500 crores in just seven days.[1]
It’s a shocking reminder of how far cybercrime has come. We’re no longer fighting simple phishing links; we’re fighting “synthetic media” designed to attack us psychologically and evade traditional security checks. As the line separating real from digitally generated begins to blur, the Indian government has intervened with the Information Technology (Amendment) Rules, 2026.[2]
While this new legal regime seeks a critical to counter misapplications of Artificial Intelligence, its impact in practice is going to be the subject of some debate. In a world where offshore servers and anonymous “mule accounts” proliferate,[3]are these rules really going to protect the common investor? This article holds that although the 2026 Amendment establishes much-needed benchmarks, it is still too open-ended to effectively advise. For real public protection, we have to advocate for stronger platform liability and develop more effective means for victims to recover their money.
We’ll parse this new legal landscape, dig into the mechanics of a deepfake scam, and get a little grim about How our laws hold up?
Deepfakes As An Instrument For Financial Crime-
Deepfakes represent a class of synthetic audio, video, or imagery generated by AI that mimics real people to a high degree of accuracy. In the financial sector, they have become a dominant channel for fraud including: Business Email Compromise / CEO Fraud: Employees are deceived by deepfake videos or voice calls purporting to those of senior executives, requesting the authorization of an urgent fund transfer. In Feb 2024, a Hong Kong-based MNC was defrauded of $25 million after an employee took a deepfake video call from the “CFO” and “other staff members”. In addition, (Investment Scams) synthetic videos of Fake SEBI-registered advisors, financial influencers, or celebrities in synthetic videos offer advertisements for fake crypto, forex, or IPO schemes, thereby misleading retail investors. Another growing concern is (KYC and Identity Fraud), where Deepfake videos are employed to circumvent video-KYC verifications to establish mule accounts for money laundering.
The existing legal Framework, however, remains inadequate. Under section 66D of the Information Technology Act, 2000 penalizes of “cheating by personation using computer resource” is an offence. However, it was designed with text-based impersonation in mind and did not take synthetic identity created through AI into account. It is still challenging to prove mens rea and to attribute deepfake creation.
Key Provisions Of The It Rules Amendment, 2026-
The 2021 Rules, 46th Amended Rules in 2026 of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 is India’s first regulation to lay down deepfake-related requirements on digital platforms. The new Rule not allow users to host deepfakes that cause financial loss or deceive other users. One of the key changes is the introduction of Mandatory disclosure and Labelling: With the 2026 Rules in place, intermediaries are now under a legal obligation to ensure that any AI-generated[4] synthetic media is disclosed with a watermark that cannot be removed. This provision aims to create transparency and enable users to distinguish between authentic and synthetic content at the point of consumption. In addition, the Amendment significantly tightens the timeline for content removal through the 3-Hour Takedown Rule: In contrast to the prior 24-72 hour range, the 2026 Amendment enforces a rigid 3-hour limit for taking down deepfakes concerning[5] financial impersonation after being notified. This recognizes the rapid speed at which financial fraud can occur. To enforce compliance, the Amendment strengthens Intermediary Due Diligence Obligations: Not adhering to these timelines would result in the intermediary losing the Safe Harbour protection under Section 79 of the IT Act, 2000, and thereby making it jointly liable with the originator of the Fraudulent Content.[6]
Trends In The Judiciary And “Duty Of Care” Doctrine-
The Indian judiciary has also trended towards holding financial entities and digital platforms to a higher standard of “Duty of Care” in cases of cyber fraudulent activities. Courts have begun extending established principles of negligence to the context of deepfake impersonation, drawing from earlier precedents such as Negligence: 2026 case law is crystallizing, where principles from cases like “SMC Pneumatics (India) Pvt. Ltd. v. Jogesh Kwatra”[7] related to cyber defamation are applicable also to deepfake impersonation. This jurisprudence is now crystallizing in 2026, with judges treating the circulation of unverified AI-generated content as a breach of institutional duty, particularly when such content facilitates financial crime. The right of victims to restitution has also been reinforced in “P.A. Vidhubala v. Union of India (2024)”[8] While holding that the Banks cannot be mute spectators if “mule accounts” are utilized for high velocity layering of stolen Funds. Furthermore, the judiciary has started interpreting Section 319 of the Bharatiya Nyaya Sanhita, 2023, which deals with cheating by personation, to cover digital avatars and voice clones generated by AI.[9]
Critical Analysis — The Enforcement Gap And Restitution Paradox-
Although it is active and forward-looking, the 2026 Rules have a major enforcement gap in that they focus on regulating content and do not address the financial infrastructure of fraud. The amendments fall short of requiring real-time collaboration with platforms and banks to freeze money mule accounts — the accounts such mules use to rapidly layer funds prior to kicking off legal recourse.[10] In addition, a 3-hour takedown rule introduces a technological disparity since smaller intermediaries do not have sophisticated AI filters to meet the requirement, subjecting them to potential unfair liability.[11] Most critically, the regime is punitive rather than remedial – it fines the platforms but does not provide for any mandatory refund mechanism through the CFCFRMS scheme, thus making the victims’ restoration[12] far from certain.
Conclusion-
The Information Technology (Amendment) Rules, 2026 would be a bold step to counter deepfake-based financial fraud with requirement of labelling and strict takedown timelines. This analysis, however, shows that the law’s effectiveness is still constrained by its focus on content takedown rather than the financial infrastructure that underpins it. To close this gap, the legal regime must transform into an integrated enforcement model that requires a synchronous coordination in real time between the social media takedown and the instant freezing of suspects’ mule accounts. Also, a “No-Fault Liability” regime for KYC failures is necessary to secure victim restitution. Though the 2026 Rules are a necessary starting point, they need to be bolstered by technological parity and robust monetary accountability to effectively protect India’s digital economy.
Reference(S):
SMC Pneumatics (India) Pvt. Ltd. v. Jogesh Kwatra, Suit No. 1279/2001 (Del. High Ct. 2001).
A. Vidhubala v. Union of India, WP(C) No. 15234/2024 (Kerala High Ct. Mar. 18, 2024).
The Information Technology Act, 2000, No. 21 of 2000, India Code.
The Bharatiya Nyaya Sanhita, 2023, No. 45 of 2023, India Code § 319.
Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026, Gazette of India, pt. II sec. 3(i) (Feb. 15, 2026).
Reserve Bank of India, Master Direction – Know Your Customer (KYC) Direction, 2016 (Updated as on Apr. 28, 2024).
Ministry of Home Affairs, Annual Report on Cyber Financial Frauds (2025).
Citizen Financial Cyber Fraud Reporting and Management System (CFCFRMS), https://www.cybercrime.gov.in (last visited May 1, 2026).
[1] Deepfake Crypto Scam: Thousands Lose Crores, Economic Times (Feb. 15,2026), https://economictimes.indiatimes.com/tech/scam-report.
[2] Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026, Gazette of India, pt. II sec. 3(i) (Jan. 2,2026).
[3] Ministry of Home Affairs, Standard Operating Procedure (SOP) on Cyber- Enabled Financial Crimes (Jan.2, 2026).
[4] Rule 4(8), Information Technology (Amendment) Rules, 2026.
[5] Rule 3(2)(b), Information Technology (Amendment) Rules, 2026.
[6] Proviso. To Section 79(3), Information Technology Act, 2000 r/w Rule 7, IT Rules 2021 as amended in 2026.
[7] SMC Pneumatics (India) Pvt. Ltd. v. Jogesh Kwatra, Suit No. 1279/2001, Delhi High Court. Principles on cyber defamation and intermediary negligence.
[8] P.A. Vidhubala v. Union of India, WP(C) No. 15234/2024, Kerala High Court, Judgment dated 18.03.2024.
[9]Section 319, Bharatiya Nyaya Sanhita, 2023, as interpreted in State v. Unknown (Deepfake BEC Case), CC No. 4421/2025, CMM Mumbai, Order dated 09.02.2026.
[10] MHA, Report on Cyber Financial Frauds, 2025.
[11] IFF Submissions to MeitY, Jan 2026.
[12] CFCFRMS Portal, No refund mandate as of May 2026.
