--- title: "A fake recruiter had my CV from a job portal and asked for a fee" description: "A 'recruiter' knew your CV details and asked for registration, training or interview fees. Your rights, how to fight it step by step, and what to do if it..." url: "https://dpdpr.in/rights/scenarios/fake-recruiter-had-my-cv/" canonical: "https://dpdpr.in/rights/scenarios/fake-recruiter-had-my-cv/" site: "dpdpr.in" updated: "2026-11-02" disclaimer: "Independent reference, not legal advice. Not affiliated with the Government of India or MeitY." --- # A fake recruiter had my CV from a job portal and asked for a fee Plain-language help for ordinary people. General information, not legal advice. Helplines, portals and screen names were checked against official Government and regulator pages on 1 November 2026. Portals change: if a screen looks different, follow the words on the screen and the official guide linked in each step. "The recruiter knew my last company and salary from my portal profile. She said the interview was confirmed after a Rs 2,500 fee." The situation in a citizen's own words, paraphrased from public reports. No names or personal details. Treat any fee for an interview or joining as a red flag. Report the recruiter to the portal and, if you paid, to 1930. **Safety first.** Threatened or in danger: call **181** (women) or go to the nearest police station. Lost money: call **1930** at once. ## Your rights - **Right to a platform grievance officer.** Online platforms must acknowledge in 24 hours and resolve in 7 days, and act on impersonation or privacy complaints in 36 hours (IT Rules, 2021, as amended in 2026). - **Right to check an overseas recruiter.** Only Government registered agents may recruit for jobs abroad; MEA says their service charge cannot exceed Rs 20,000. Check on emigrate.gov.in. - **Right to police help.** The police must take your complaint about threats, stalking or harassment. You can also report online at cybercrime.gov.in. - **Right to compensation for deficiency in service.** Under the Consumer Protection Act, 2019 you can claim compensation before a Consumer Commission. File within 2 years. - **DPDP rights from 13 May 2027.** You can ask what data the company holds and who it shared it with (section 11), ask for correction or erasure (section 12), and complain to the company, then to the Data Protection Board (sections 13 and 27). The company answers for its processors (section 8(1)). ## How to fight it, step by step One action per step. Each step says what to write, what to attach, what you get back, and how long to wait before the next step. If the person turns out to be fake, skip to [If it is fake](#fake). 1. **Save the evidence before you block or delete anything.** What to write: A short note with the date, time, number used, and exactly what was said or what details they knew. What to attach: Screenshots of the call log, SMS, WhatsApp chats (with the number visible), and any payment screen. What you get back: A record that cannot later be denied. How long to wait: Do this the same day. 2. **Do not pay any 'registration', 'training' or 'security' fee. Stop replying.** What to write: Nothing. What to attach: Nothing. What you get back: No further loss. How long to wait: At once. 3. **Report the recruiter on the job portal.** What to write: The recruiter's name, company claimed, and messages. What to attach: Screenshots. What you get back: A report reference. How long to wait: 24 hours. 4. **Write to the portal's grievance officer.** What to write: Letter 2 below, question 6. What to attach: Evidence. What you get back: Acknowledgement in 24 hours. How long to wait: 7 days. 5. **Call 1930 and file on cybercrime.gov.in if you paid.** What to write: Each payment with UTR numbers. What to attach: Payment screenshots. What you get back: An acknowledgement number. How long to wait: At once. 6. **For a job abroad offer, check the agent on emigrate.gov.in and complain there, or call 1800 11 3090.** What to write: Agent name and licence number, if any. What to attach: Offer letter and receipts. What you get back: A complaint reference. How long to wait: As MEA sets. 7. **Get a lawyer if the stakes are high.** What to write: Nothing yet. Take your full file to the lawyer. What to attach: All of the above. What you get back: Advice on a legal notice, a claim before your State's IT Adjudicating Officer, or a civil suit for damages. How long to wait: Before you send any legal notice or file a suit. This page is not legal advice. ## What people tried and what worked - People did not pay, reported to the portal and filed cyber complaints. - Arrests were reported in one city case where a fake call centre used recruiter access. Based on reports on public forums, and the news reports listed below. Paraphrased, with no usernames or personal details. What worked for one person may not work for you; the numbered steps above are the official route. ### News reports - [Delhi Police busted a fake call centre using recruiter access.](https://www.indiatoday.in/india/delhi/story/delhi-police-fake-call-centre-using-recruiter-access-busted-2725158-2025-05-15) (indiatoday.in) **Not legal advice.** This page explains the rules in plain words so you can act. Consult a lawyer before you sue anyone or send a legal notice. Laws and portals change; check the linked official source. ## Step 1: stay safe and find out who it is 1. Do not share an OTP, PIN, password or card number. 2. Ask for their name, company, role and ID. Write it down. 3. Hang up and call the company on a number you find yourself, on its official website or app. 4. Ask whether this person works for the company or a partner. Ask for a written answer (Letter 1 below). ## If it is genuine: hold the company accountable ### Which rules this may break - **IT Rules, 2021 (amended 2026):** platform grievance officer timelines. - **Emigration rules (MEA):** registered recruiting agents only; charge capped at Rs 20,000. - **BNS and IT Act:** cheating and impersonation (IT Act section 66D) are crimes. ### What the company must do, and by when - Acknowledge in 24 hours, resolve in 7 days. - Remove impersonating or intimate content within the set times. ### Letter 1: ask them to confirm who the caller is Send it through the official channel. Keep a copy and the acknowledgement. To: The Grievance Officer, \[Job portal name\] Subject: Please confirm whether this person works for you Dear Sir or Madam, I am your customer. My registered email or mobile: \[number\]. On \[date\] at \[time\] I received a call or message from \[phone number\]. This is not an official number. The person said they were \[name\], \[role or employee ID\], from the job portal. They knew my \[list the details they knew\]. Please confirm in writing within 7 days: 1. Whether this person is your employee, agent, recruiter, employer, partner or partner. 2. If yes, their name, role and the agency they work for. 3. Whether you allow staff or agents to contact customers from personal numbers. 4. If they are not connected with you, please say so, so I can report the number. Name: Registered mobile number: Date: ### Letter 2: ask how your data got there To: The Grievance Officer, \[Job portal name\] Subject: How did my personal data reach a personal phone? Complaint number \[if any\] Dear Sir or Madam, On \[date\] a person connected with you, \[name if known\], contacted me from a personal number \[number\] and knew my \[details\]. \[Describe what they did.\] Please tell me in writing: 1. What personal data about me this person could see, and through which system or app. 2. Whether you shared my data with any agency, recruiter, employer, partner, partner or processor, and their names. 3. How my data reached a personal phone or account outside your official systems. 4. What action you have taken against the person or agency, including suspension while you investigate. 5. What you have done to stop this happening again. 6. Which recruiters downloaded or viewed my CV, and on what dates. Job portals are online platforms under the IT Rules, 2021: their grievance officer must acknowledge in 24 hours and resolve in 7 days. For jobs abroad, only Government registered recruiting agents may recruit, and MEA says their charge cannot be more than Rs 20,000. From 13 May 2027, sections 8 and 11 of the Digital Personal Data Protection Act, 2023 also apply. Please reply within 7 days. If I do not hear from you, I will escalate to the police, the Grievance Appellate Committee and, for jobs abroad, the Ministry of External Affairs. Name: Registered mobile number: Date: ### Evidence to keep - Screenshots of calls and messages with numbers, dates and times. - Order, booking, policy or account numbers. - Your complaint numbers and the company's replies. - A note of what the caller knew or did. More in the [evidence checklist](https://dpdpr.in/rights/evidence-checklist/). ### Can you sue? What realistically happens - **Consumer Commission:** the most practical route for compensation. Cheap, no lawyer needed, file within 2 years. - **IT Act section 43A (until 13 May 2027):** if the company was negligent with *sensitive* personal data (passwords, bank or card details, health records, biometrics) and that caused wrongful loss or gain, it must pay compensation. Claims up to Rs 5 crore go to your State's IT Secretary acting as Adjudicating Officer (section 46); larger claims go to a court. Appeal within 45 days (section 57). Your phone number and address alone are not sensitive data under the 2011 Rules. - **Civil suit for damages:** possible, but slow and costly. Section 61 of the IT Act bars civil courts from matters the Adjudicating Officer can decide. - **Police:** only where there is a crime, for example a person who disclosed your information in breach of a contract to cause wrongful loss or gain (IT Act section 72A, up to 3 years), identity theft (66C), cheating by impersonation (66D), stalking or threats. - **Realistic outcome:** most people get results from a firm written complaint and the regulator or ombudsman. Courts take years. Consult a lawyer before suing. ### From 13 May 2027: the Data Protection Board From **13 May 2027** the DPDP Act's duties apply. The company is responsible for processing done by it or by anyone processing on its behalf (section 8(1)), may use a processor only under a valid contract (section 8(2)), must protect your data with reasonable security safeguards (section 8(5)), and must tell you and the Board about a breach (section 8(6)). It may use your data only for the lawful purpose you agreed to (sections 4 to 6). Section 44(2) removes IT Act section 43A from that date. Complain to the company first; if it does not resolve it, complain to the Data Protection Board. The Board can impose penalties up to Rs 250 crore, but **penalties go to the Government (the Consolidated Fund of India, section 34), not to you**. For money, use the ombudsman or the Consumer Commission. Appeals from the Board go to TDSAT within 60 days (section 29). ## If it is fake: urgent steps 1. If anyone asks for an OTP, PIN or payment, stop. It may be fraud. 2. Call 1930 if money was lost, then file on cybercrime.gov.in. 3. Report the number on Chakshu (Sanchar Saathi). Step by step guides: Report money lost to fraud: call 1930 ### Report money lost to fraud: call 1930 1930 is the national cyber crime helpline run with the Ministry of Home Affairs. It links your report to banks and wallets so they can try to stop the money. Call as fast as you can. The sooner the report reaches the bank, the better the chance. **Keep this ready before you start:** - Your mobile number. - Name of the bank, wallet or app the money left from. - Account number, wallet ID or UPI ID that was debited. - Transaction ID or 12 digit UTR number for each payment. - Date and amount of each payment. - Card number, if a debit or credit card was used. - Screenshots of the payment and of the chat or SMS. 1. Dial **1930** from any phone. 2. Tell them you want to report a financial cyber fraud. 3. Give each transaction one by one: bank, transaction ID or UTR, date and amount. 4. Write down the acknowledgement number they give you. It also comes by SMS. 5. Save that SMS. Take a screenshot of it. 6. Now file the full complaint on [cybercrime.gov.in](https://cybercrime.gov.in) (steps below). The official cybercrime.gov.in instructions ask you to complete it within 24 hours of the call. 7. Call your bank's official customer care number too, and ask them to block the card, UPI or account. Use the number on your card or passbook. Checked on 1 November 2026 against: [I4C (Ministry of Home Affairs): National Cybercrime Reporting Portal and 1930](https://i4c.mha.gov.in/ncrp.aspx), [National Cyber Crime Reporting Portal: FAQ](https://cybercrime.gov.in/Webform/FAQ.aspx). Check a job abroad offer and complain about a recruiting agent ### Check a job abroad offer and complain about a recruiting agent Fake overseas job offers are common. Only Government registered recruiting agents may recruit for jobs abroad. The Ministry of External Affairs lets you check an agent and complain. **Keep this ready before you start:** - The agent's name, licence number and address. - Offer letter, messages and payment receipts. - Your passport details, if the agent has them. 1. Ask the agent for its licence number. Write it down. 2. Check it on [emigrate.gov.in](https://emigrate.gov.in/). MEA also publishes a list of registered recruiting agents. 3. Do not pay an unregistered agent. MEA's guidance says a registered agent's service charge cannot be more than Rs 20,000 per worker. 4. If an agent cheated you, lodge a complaint on eMigrate, or write to the Protector General of Emigrants. 5. For help any time, call the Overseas Workers Resource Centre on **1800 11 3090** (24x7, 11 languages). 6. If money was taken by fraud, also call 1930 and file on cybercrime.gov.in. Checked on 1 November 2026 against: [Ministry of External Affairs: complaints against recruiting agents](https://www.mea.gov.in/complaints-against-recruiting-agents), [Ministry of External Affairs: FAQ for people going abroad for work (eMigrate, OWRC 1800 11 3090)](https://fsi.mea.gov.in/issues-of-intending-emigrants.htm), [eMigrate portal (Ministry of External Affairs)](https://emigrate.gov.in/). Complain to the app or platform, then the Grievance Appellate Committee ### Complain to the app or platform, then the Grievance Appellate Committee Social media and other online platforms must publish the name and contact of a Grievance Officer. The IT Rules, 2021 (as amended on 10 February 2026) set short time limits. **Keep this ready before you start:** - Links (URLs) to the post, profile or account. - Screenshots with date and time. - Your own account name, and the complaint number from the platform. 1. Find the platform's Grievance Officer. The rules require the name, contact and complaint method to be shown on the website or app, usually under Help, Legal or Grievance. 2. Send your complaint there. Attach links and screenshots. 3. The Grievance Officer must acknowledge it within 24 hours and resolve it within 7 days. 4. For a request to remove content such as impersonation, privacy invasion or harassment, the limit is 36 hours. 5. For content that shows your private body parts, nudity, sexual acts, or impersonates you (including morphed images), the platform must act within 2 hours of your complaint. 6. If you are not satisfied, or get no reply within 30 days, appeal to the Grievance Appellate Committee within 30 days. 7. Open [gac.gov.in](https://gac.gov.in). Click **Appellant Login (File appeal / View status)**. 8. Agree to the privacy policy, enter your mobile number and the captcha, then click **Send OTP**. 9. Fill the appeal and upload the Grievance Officer's reply or your complaint proof. 10. The GAC order is uploaded on the site. You get an SMS and email. The platform must publish a compliance report. 11. The GAC does not handle money fraud or cybercrime. For those use 1930 or cybercrime.gov.in. Checked on 1 November 2026 against: [IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, as amended up to 10 February 2026](https://www.meity.gov.in/documents/act-and-policies/information-technology-intermediary-guidelines-and-digital-media-ethics-code-rules-2021-it-rules-2021-IjM5QjMtQWa), [Grievance Appellate Committee (IT Rules, 2021): FAQ](https://gac.gov.in/CMSData/FAQs). ## Related guides - [\*\*Employers, job portals and job offers\*\*What your employer can collect, fake job offers, and job portal data.](https://dpdpr.in/rights/employers-jobs/) See also [when a platform shares your data with a third party](https://dpdpr.in/rights/platforms-and-third-parties/) and the [escalation ladder](https://dpdpr.in/rights/escalation-ladder/). ## Official sources Checked on 1 November 2026. Company pages are labelled as the company's own words. - [IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, as amended up to 10 February 2026](https://www.meity.gov.in/documents/act-and-policies/information-technology-intermediary-guidelines-and-digital-media-ethics-code-rules-2021-it-rules-2021-IjM5QjMtQWa) - [Grievance Appellate Committee (IT Rules, 2021): FAQ](https://gac.gov.in/CMSData/FAQs) - [Ministry of External Affairs: complaints against recruiting agents](https://www.mea.gov.in/complaints-against-recruiting-agents) - [Ministry of External Affairs: FAQ for people going abroad for work (eMigrate, OWRC 1800 11 3090)](https://fsi.mea.gov.in/issues-of-intending-emigrants.htm) - [eMigrate portal (Ministry of External Affairs)](https://emigrate.gov.in/) - [National Cyber Crime Reporting Portal: FAQ](https://cybercrime.gov.in/Webform/FAQ.aspx) - [I4C (Ministry of Home Affairs): National Cybercrime Reporting Portal and 1930](https://i4c.mha.gov.in/ncrp.aspx)