Hacking vs Identity Theft: Difference and Sections 66 and 66C

The two crimes are constantly fused in popular speech because they so often occur in sequence, the account is hacked, then the identity is used, but they are distinct offences with different objects: hacking attacks a system, entry into a computer resource without permission, while identity theft attacks a person, the dishonest use of their identity features. Each is complete without the other, and the 2008 Amendment drew the line deliberately. Topics 53, 58 and 60 built the sections; this note, as asked, is the dedicated comparison.

1. The Two Offences

Figure 1: System against person

• Hacking: the conduct, not the word. Unauthorised access to or manipulation of a computer resource: the s.43 catalogue, access, downloading and copying, contaminants, damage, disruption, denial, made the s.66 offence when done dishonestly or fraudulently. The original s.66 was actually titled hacking; the 2008 Amendment removed the word, leaving the neutral conduct-based drafting, so precise answers say unauthorised access under ss.43 and 66 (Topics 53, 58)
• Identity theft: s.66C. Fraudulent or dishonest use of the electronic signature, password or any other unique identification feature of any other person: three years and fine to a lakh. The section, inserted in 2008 for the phishing era, protects the identity layer, credentials, biometrics, OTPs, signatures, Aadhaar-linked features, and is complete on use, however the features were obtained (Topic 60)
• The objects differ. Hacking is measured at the system's boundary, permission to access; identity theft at the person's identity, whose features are used. A hack is complete with nothing taken; an identity theft is complete with no system touched, credentials bought from a breach dump, shoulder-surfed or tricked out of the victim by vishing suffice (Topic 103)

2. The Fraud Chain They Share

Figure 2: Three independent stages

• Hack, theft, cheat. The full fraud runs three stages, each an independent offence: the intrusion that harvests credentials (ss.43, 66), the dishonest use of those identity features (s.66C), and the personation that cheats a bank, employer or relative out of money or property (s.66D with BNS cheating). Charge sheets in account-takeover frauds routinely carry all three, but conviction on each stands on its own elements.
• Where they diverge in proof. The hacking case is proved at the technical boundary, logs, IPs, the absence of permission, the s.79A reconstruction of entry; the identity theft case is proved at the use, the transaction or login made with the victim's features and the accused's connection to it; the s.66D case at the deception of the person cheated (Topics 82, 86)
• Aggravations and neighbours. Hacking escalates through s.70 and s.66F by target and intent (Topics 107, 109); identity theft's neighbours are s.66D personation, BNS forgery for fabricated identity documents, and the DPDP and s.72A consequences for the custodian whose breach leaked the features (Topics 87, 95)

3. Frequently Asked Questions

What is the difference between hacking and identity theft?

Hacking is unauthorised access to a computer resource, the conduct of Section 43 raised to an offence by Section 66 when done dishonestly or fraudulently; its object is the system, and it is complete at the intrusion even if nothing is taken. Identity theft under Section 66C is the fraudulent or dishonest use of another person's electronic signature, password or unique identification feature; its object is the person's identity, and it is complete on use even if no system was ever penetrated, credentials obtained from breach dumps or by deception sufficing. The word hacking itself was removed from the statute by the 2008 Amendment.

Can hacking and identity theft be charged together?

Routinely. In an account-takeover fraud the intrusion that harvested the credentials is Sections 43 and 66, the dishonest use of those credentials is Section 66C, and the personation that extracted money from a bank or victim is Section 66D with BNS cheating. The offences are independent stages, so each conviction rests on its own elements, and any one can stand alone: a hack with nothing used, an identity theft with nothing hacked, or a personation with a wholly invented identity.

4. Related Topics

• Topic 58: Section 66. The unauthorised access offence in full.
• Topic 60: Sections 66B to 66F. Identity theft and personation in the offence family.