May 23, 2026

AI-Generated Deepfakes and Corporate Fraud: Legal Remedies and Liability Frameworks Under Indian Law (2026)

Introduction: The Intersection of Synthetic Media and Financial Crime

The weaponisation of artificial intelligence (AI) has fundamentally altered the landscape of corporate white-collar crime. The proliferation of “deepfake” technology—highly realistic, synthetically generated audio and video replicating the likeness and voice of real individuals—has introduced a sophisticated vector for corporate fraud. Threat actors increasingly deploy deepfake audio to impersonate Chief Executive Officers (CEOs) or senior management, issuing fraudulent, urgent financial transfer instructions to subordinate employees, resulting in multi-crore losses.

Historically, Indian jurisprudence evaluated corporate fraud through traditional concepts of documentary forgery and physical personation. However, the legal architecture has undergone a radical recalibration in 2026 to address the ephemeral, digital nature of synthetic media. This publication analyzes the intersection of deepfake technology and corporate fraud, examining the newly notified 2026 IT Rules, the penal provisions under the Bharatiya Nyaya Sanhita (BNS), and the evidentiary mandates of the Bharatiya Sakshya Adhiniyam (BSA).

Statutory Recognition: The IT Amendment Rules, 2026

The most decisive regulatory response to deepfake proliferation was the notification of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026, which came into effect on February 20, 2026.

For the first time, Indian law explicitly recognizes and regulates AI-generated media by introducing the concept of Synthetically Generated Information (SGI). The Rules define SGI broadly in technology-neutral terms to include audio, visual, or audio-visual information altered algorithmically to appear “real, authentic or true” and indistinguishable from a natural person.

For corporate entities victimized by deepfake impersonation, the 2026 Amendments provide unprecedented, rapid civil remedies:

  • Mandatory Provenance and Labelling: Intermediaries and generative AI platforms must now embed permanent, unique metadata (digital watermarks) into synthetic outputs. Visual SGI must carry prominent labels, and audio SGI must feature prefixed audio disclosures, destroying the element of deception essential for fraud.
  • Ultra-Rapid Takedown Timelines: Recognizing the viral velocity of deepfakes, the Amendment drastically reduces the statutory window for content removal. Upon receiving a court order or a government reasoned intimation (via the Sahyog portal), intermediaries must remove the unlawful deepfake within 3 hours (reduced from 36 hours). For highly invasive morphed imagery, the takedown window is just 2 hours.
  • Loss of Safe Harbour: Failure by Significant Social Media Intermediaries (SSMIs) to deploy appropriate technical measures to detect SGI or adhere to the 3-hour takedown mandate strips them of their immunity under Section 79 of the IT Act, exposing the platforms directly to civil and criminal liability.

Criminal Liability: BNS 2023 and IT Act 2000

When a deepfake is utilized to execute a corporate financial fraud, the investigating agencies invoke a concurrent matrix of the Information Technology Act, 2000, and the newly enforced Bharatiya Nyaya Sanhita (BNS), 2023.

The Information Technology Act, 2000

  • Section 66C (Identity Theft): The unauthorized capture, cloning, and use of a corporate executive’s unique biometric identification feature (voice or facial mapping) to create a deepfake constitutes identity theft, punishable by up to three years’ imprisonment.
  • Section 66D (Cheating by Personation by using Computer Resource): This is the primary charging section for deepfake financial fraud. Mimicking a corporate officer via a synthesized audio call to induce a financial transfer squarely satisfies the ingredients of this offence.

The Bharatiya Nyaya Sanhita (BNS), 2023

  • Cheating and Personation (Sections 318 & 319): Section 318 BNS penalizes cheating and inducing the delivery of property (corporate funds), while Section 319 explicitly penalizes cheating by personation.
  • Digital Forgery (Sections 335 & 336): The BNS modernizes the definition of forgery to seamlessly encompass electronic records. The creation of a deepfake video or audio file with the intent to support a fraudulent financial claim or cause damage to the corporate entity constitutes forgery for the purpose of cheating.
  • Organised Crime (Section 111): If the deepfake corporate fraud is executed by a transnational cyber-syndicate resulting in massive financial extortion, the rigorous provisions of Section 111 (Organised Crime) apply, converting a standard bailable cheating offence into a non-bailable crime carrying a maximum penalty of life imprisonment.

Evidentiary Challenges Under BSA 2023

The introduction of deepfakes poses an existential threat to the reliability of digital evidence in corporate litigation and criminal trials. If a CEO denies authorising a fund transfer, and the prosecution produces a voicemail as evidence, how does a court distinguish between a genuine recording and a synthetic clone?

Under the Bharatiya Sakshya Adhiniyam, 2023 (BSA):

  • Section 63 Compliance: The admissibility of the digital recording is governed by Section 63 (the successor to Section 65B of the Evidence Act). It mandates a strict dual-certification process for electronic records.
  • The Burden of Authentication: However, Section 63 merely proves that the electronic record was produced by a specific computer resource; it does not automatically prove authenticity of the content in the age of AI. Courts are now compelled to look beyond Section 63 certificates, routinely calling upon forensic experts under Section 39 of the BSA (Expert Opinion) to conduct spectral analysis and algorithmic vetting of the audio files to rule out Generative Adversarial Network (GAN) manipulation.

Civil Remedies and Personality Rights

Beyond criminal prosecution, corporate officers targeted by deepfakes can seek immediate civil equitable relief.

  • Personality Rights and Privacy: Building upon the Supreme Court’s recognition of privacy as a fundamental right (Justice K.S. Puttaswamy v. Union of India), High Courts recognize the commercial value of a corporate leader’s “personality rights.” The unauthorized cloning of a CEO’s voice or likeness is a tortious invasion of privacy and a misappropriation of personality rights.
  • John Doe Injunctions: Corporate legal teams can urgently move civil courts for ex-parte ad-interim injunctions against unknown perpetrators (John Doe orders) and intermediary platforms, mandating the immediate global blocking of the synthetic media to prevent reputational collapse and further financial deceit.

Conclusion

The 2026 IT Amendment Rules and the BNS framework signal India’s definitive regulatory pivot from passive observation to aggressive containment of synthetic media. For corporate entities, the defense against deepfake fraud can no longer rely solely on post-facto litigation. Companies must operationalize the legal standards by enforcing strict multi-factor authentication for financial transfers, updating their data protection protocols under the Digital Personal Data Protection (DPDP) Act, 2023, and leveraging the new 3-hour statutory takedown window to mitigate exposure. As the technology obfuscating reality evolves, corporate governance and legal compliance must proactively integrate AI-specific risk management.

By Team
Prev