1. Introduction

Biometric impersonation occurs when a person fraudulently uses, reproduces, manipulates, or misrepresents another person's biological or biometric identity to obtain an unlawful advantage, deceive an institution, access a protected system, or cause harm.

Biometric identifiers include:

Fingerprints and palm prints.

Facial geometry and facial-recognition templates.

Iris and retinal patterns.

Voiceprints used for authentication.

DNA profiles, where used for identification.

Biometric information associated with Aadhaar authentication.

For example, a person might use another individual's fingerprint to withdraw money, submit false biometric information during Aadhaar enrolment, or manipulate a facial-recognition system to impersonate a bank customer.

Criminal liability depends on the precise conduct, intention, technology involved, resulting harm, and applicable statutory provisions. A failed biometric match, by itself, does not establish a crime.

In India, the principal legal framework includes the Aadhaar Act, 2016, the Information Technology Act, 2000, and the Bharatiya Nyaya Sanhita, 2023 (BNS), alongside applicable procedural and evidentiary laws. The Government has specifically identified identity theft and computer-enabled impersonation as offences that may be prosecuted under the IT Act.

Government of India+1

2. Meaning and essential elements of biometric impersonation

Biometric impersonation may involve several distinct forms of misconduct.

A. Physical biometric impersonation

Using another person's fingerprint, iris, or facial characteristics to pass an identity check, access a restricted facility, or obtain a benefit.

B. Aadhaar-related impersonation

Providing false demographic or biometric information during enrolment, or fraudulently altering another Aadhaar holder's identity information.

C. Digital biometric impersonation

Using stolen biometric credentials, manipulated facial images, synthetic voiceprints, or forged digital identity records to deceive a computer-based authentication system.

For criminal liability, the prosecution must establish the ingredients of the particular offence. Depending on the provision, these may include dishonest or fraudulent use, impersonation, an intention to cause harm or mischief, deception, or the making of a false record.

Biometric information is not automatically proof of identity or guilt: the reliability of the authentication system and the integrity of the evidence may also be disputed.

3. Statutory provisions governing criminal liability

A. Aadhaar Act, 2016

The Aadhaar Act contains specific offences relating to impersonation and misuse of identity information.

Source: Aadhaar Act provisions published by UIDAI.

Government of India+1

Important distinction: Section 34 concerns impersonation at enrolment, whereas Section 35 addresses specified impersonation-related changes to an existing Aadhaar holder's information. Not every fraudulent fingerprint transaction automatically falls within either section; the statutory ingredients must be established.

B. Information Technology Act, 2000

The IT Act is particularly important where biometric impersonation involves computers, electronic authentication, or digital identity credentials.

Section 66C — Identity theft

This provision applies when a person fraudulently or dishonestly uses another person's electronic signature, password, or other unique identification feature.

Maximum imprisonment: 3 years.

Maximum fine: ₹1 lakh.

A biometric identifier may potentially qualify as a unique identification feature, depending on the facts and how it is used. For example, deliberately using another person's biometric-linked digital credentials to impersonate them may attract Section 66C.

IndiaCode+1

Section 66D — Cheating by personation using a computer resource

This section applies when a person cheats by impersonation through a communication device or computer resource.

Maximum imprisonment: 3 years.

Maximum fine: ₹1 lakh.

For example, using a manipulated facial image or biometric-linked identity to deceive an online verification system and fraudulently obtain a service may engage Section 66D, if all its elements are proved.

IndiaCode+1

Section 66E — Violation of privacy

Where the conduct also involves capturing, publishing, or transmitting an image of a person's private area in circumstances covered by the section, Section 66E may be relevant. It is not a general offence covering every misuse of biometric information.

C. Bharatiya Nyaya Sanhita, 2023 (BNS)

The BNS came into force on 1 July 2024. Its provisions may apply alongside special cybercrime or Aadhaar offences, subject to the facts and rules governing overlapping offences.

Section 319 expressly covers impersonation of real and imaginary persons. Its application still requires cheating, not merely the existence of a false identity claim. Section 336 distinguishes ordinary forgery from forgery intended for cheating, which carries a higher maximum punishment.

IndiaCode+2

For conduct committed before 1 July 2024, the corresponding provisions of the former Indian Penal Code may remain applicable. The relevant date and transitional rules must be examined before selecting charges.

IndiaCode+1

4. Leading case laws and their relevance

A significant legal limitation must be recognised: Indian courts have decided important cases concerning Aadhaar biometrics, digital identity theft, and online impersonation, but these decisions do not all concern the same factual offence. The following judgments establish relevant principles rather than a single universal rule for biometric impersonation.

Case 1: Justice K.S. Puttaswamy (Retd.) v. Union of India (2018)

Supreme Court of India · Aadhaar Constitution Bench judgment · 26 September 2018

Citation: (2019) 1 SCC 1; commonly known as the Aadhaar judgment.

Facts and legal questions

The Supreme Court examined the constitutional validity of the Aadhaar framework, including the collection and use of biometric information, data protection, privacy, and the relationship between identification systems and fundamental rights.

Decision and principles

The judgment upheld the constitutional validity of important parts of the Aadhaar framework while striking down or reading down certain provisions and limiting some uses of Aadhaar. It addressed the collection, storage, and use of biometric information through the principles of legality, legitimate state purpose, and proportionality.

Indian Kanoon+1

Relevance to criminal liability

The case is important in three ways:

Biometric identity systems must operate within a legally authorised framework.

Identity authentication and the handling of biometric data raise constitutional privacy concerns.

The existence of an authentication mechanism does not give every institution unrestricted authority to collect, use, or disclose personal information.

The judgment is not a direct conviction precedent for biometric impersonation. It supplies constitutional context for interpreting biometric identification and data-handling practices.

Case 2: Naveen Makhija v. State of Madhya Pradesh (2023)

High Court decision · 28 December 2023

Legal issue: Fraudulent use of another person's identity in a digital environment.

The case concerned a fake social-media profile created in another person's name and used to post objectionable photographs and messages. The reported decision considered offences under Sections 66B and 66C of the IT Act.

IndiaCode

Legal significance

The decision illustrates that identity misuse need not involve a physical identity document. Electronic identity features and the fraudulent creation or use of an identity can give rise to criminal liability when the relevant statutory ingredients are established.

Application to biometrics

A false digital profile is not itself biometric impersonation. However, where a perpetrator uses another person's biometric-linked credentials or a manipulated biometric identity as part of digital impersonation, the same distinction between ordinary misrepresentation and a legally defined identity-theft offence becomes important.

The case should be cited as an identity-theft analogy, not as a direct ruling on fingerprint spoofing or facial-recognition attacks.

Case 3: Dipakkumar Sureshbhai Ramani v. State of Gujarat (2019)

Gujarat High Court · 24 July 2019

Legal issue: Cheating by personation using a computer resource.

The decision considered whether creating a fake Facebook identity in another person's name and communicating through it could constitute an offence under Section 66D of the IT Act. The reported order treated the allegations as sufficient to support a prima facie Section 66D offence, while dealing separately with the invalid Section 66A charge.

IndiaCode

Principle

Digital impersonation may fall within Section 66D when the statutory requirement of cheating by personation is met. A prosecution cannot rely merely on the fact that an online identity is false; the relevant elements of the alleged offence must be shown.

Application to biometrics

If a person uses a synthetic face, biometric-linked account, or manipulated identity verification process to deceive a computer system, Section 66D may be relevant. The prosecution must nevertheless prove the required deception and other ingredients.

Case 4: Sri Amit Garg v. State of Karnataka (2022)

Karnataka High Court · Criminal Petition No. 4856 of 2021

This decision discusses Sections 66C and 66D of the IT Act, including the distinction between identity theft and cheating by personation.

Indian Kanoon

Legal significance

Section 66C focuses on fraudulent or dishonest use of specified identity features.

Section 66D focuses on cheating by personation through a computer resource or communication device.

Depending on the facts, conduct may raise questions under both provisions, but each offence must be independently established.

Application to biometric impersonation

The distinction matters where someone uses another person's fingerprint-linked credentials to obtain access and then uses that access to deceive a third party. The evidence must establish the particular conduct attributable to the accused rather than merely show that the victim's account or identity was compromised.

Case 5: Akhtar Ali @ Ali Akhtar @ Shamim @ Raja Ustad v. State of Uttarakhand (2025)

Supreme Court of India · 2025 INSC 1097 · 10 September 2025

This case appears among the reported decisions concerning Section 66C of the IT Act. The available case summary identifies an appeal involving the legality of a conviction under that provision.

VoxJuris

Relevance and caution

It is a potentially useful authority when researching the elements of identity theft under Section 66C. However, the precise holding and factual findings should be verified from the full Supreme Court judgment before asserting that it establishes a particular rule about biometric impersonation. A reference to Section 66C does not, by itself, mean that the case concerned fingerprints, iris scans, or facial recognition.

5. How criminal liability arises in common scenarios

The following examples illustrate how the legal provisions may apply.

These are potential legal classifications, not automatic findings of guilt. The precise charge depends on the facts, the applicable law, and the evidence.

6. Essential evidence required to prove the offence

Biometric impersonation cases can be technically complex because a successful authentication does not necessarily prove who physically presented the biometric sample.

The prosecution may need to establish the following:

1. Evidence of the original identity

Records establishing the victim's identity and the biometric information or credentials associated with that person.

2. Authentication records

Relevant transaction identifiers, timestamps, device details, authentication responses, and audit logs. The precise records available will depend on the system.

3. Evidence of impersonation

Evidence connecting the accused to the fraudulent act, such as witness testimony, device records, communications, financial records, or properly obtained forensic evidence.

4. Evidence of intent

For offences requiring fraudulent or dishonest conduct, cheating, or a specific intention to cause harm or appropriate identity, the prosecution must prove that required mental element.

5. Integrity of digital evidence

Electronic records must be collected and presented in accordance with applicable evidentiary requirements. Under the Bharatiya Sakshya Adhiniyam, 2023, provisions governing electronic and digital records are particularly relevant.

A fingerprint match or an authentication-success message should therefore not be treated as conclusive proof of the accused's identity or guilt without examining the wider evidence.

7. Criminal liability versus civil and constitutional liability

Biometric impersonation may create several forms of legal responsibility.

Criminal liability: Prosecution and punishment where a defined offence is established.

Civil liability: Potential compensation or other remedies for legally recognised injury or loss.

Data-protection liability: Possible consequences for unlawful processing, disclosure, or safeguarding failures, depending on the applicable statutory provisions and circumstances.

Constitutional liability: Judicial review where government action infringes fundamental rights, including privacy.

Institutional or regulatory liability: Consequences for organisations that violate applicable authentication, security, or confidentiality requirements.

These categories are distinct. A security failure does not automatically establish a criminal offence by the organisation or its employees. Criminal responsibility requires proof of the applicable offence and attribution of the conduct to the accused.

8. Legal safeguards and prevention

A sound legal and technical framework should include:

Purpose limitation: Biometric information should be collected and used only within the applicable legal authority and permitted purposes.

Authentication safeguards: Systems should employ appropriate anti-spoofing controls, secure devices, and additional verification where warranted.

Access controls: Biometric templates, identity records, and authentication credentials should be protected against unauthorised access.

Audit trails: Systems should maintain appropriate records that permit investigation of suspicious transactions.

Human review and redress: A failed biometric match should not automatically be treated as evidence of fraud or used to deny a legally guaranteed entitlement without considering applicable safeguards.

Accountability: Organisations should investigate suspected impersonation, preserve relevant evidence, and comply with applicable reporting and legal obligations.

These safeguards help distinguish intentional fraud from innocent authentication failures, technical errors, and wrongful allegations.

9. Conclusion

Biometric Impersonation Criminal Liability is best understood as the application of established criminal laws to the fraudulent misuse of biometric identity systems.

In India, the most relevant provisions include Aadhaar Act Sections 34–37, IT Act Sections 66C and 66D, and the applicable provisions of the BNS concerning cheating, personation, and forgery. The Supreme Court's Aadhaar judgment in K.S. Puttaswamy supplies important constitutional context, while decisions such as Naveen Makhija, Dipakkumar Sureshbhai Ramani, and Sri Amit Garg offer relevant guidance on digital identity theft and impersonation.

The central legal principle is that biometric impersonation must be proved through the ingredients of a specific offence and reliable evidence. Neither a failed authentication nor the mere presence of another person's biometric data establishes criminal guilt.

Research note: This is a general Indian-law overview, not an exhaustive review of all reported judgments. For litigation, verify the full judgments, the current statutory text, the date of the alleged conduct, and any applicable special complaint or cognizance requirements under the Aadhaar Act.