Someone used my PNR or booking details to cancel or steal my tickets

Plain-language help for ordinary people. General information, not legal advice. Helplines, portals and screen names were checked against official Government and regulator pages on 1 November 2026. Portals change: if a screen looks different, follow the words on the screen and the official guide linked in each step.

"I shared a ticket screenshot in a group. Someone used the PNR to cancel my flight and change the refund details."

A PNR and surname can be enough to open some bookings online. Contact the airline at once through its official app, then complain on AirSewa and to the police.

Safety first. Threatened or in danger: call 181 (women) or go to the nearest police station. Lost money: call 1930 at once.

Not legal advice. This page explains the rules in plain words so you can act. Consult a lawyer before you sue anyone or send a legal notice. Laws and portals change; check the linked official source.

Prevent it next time

• Do not post ticket screenshots or boarding passes online.
• Add a password or OTP lock to bookings where the airline allows it.

Step 1: stay safe and find out who it is

1. Do not share an OTP, PIN, password or card number.
2. Ask for their name, company, role and ID. Write it down.
3. Hang up and call the company on a number you find yourself, on its official website or app.
4. Ask whether this person works for the company or a partner. Ask for a written answer (Letter 1 below).

If it is genuine: hold the company accountable

Which rules this may break

• E-Commerce Rules, 2020, rule 4(4) and 4(5): grievance officer, acknowledgement within 48 hours, resolution within one month.
• Consumer Protection Act, 2019: deficiency in service and unfair trade practice.
• IT Act section 72A: disclosure in breach of contract to cause wrongful loss or gain.
• Note: your phone number and address are not sensitive personal data under the 2011 Rules, so IT Act section 43A usually does not help here. Consumer law and, from 2027, the DPDP Act do.

What the company must do, and by when

• Acknowledge your complaint within 48 hours and resolve it within one month.
• Investigate the seller or delivery partner and block their access to your details.
• Confirm in writing what it did.
• From 13 May 2027: use your data only for the purpose you gave it (DPDP sections 4 to 6) and answer for its processors (section 8(1)).

Letter 1: ask them to confirm who the caller is

Send it through the official channel. Keep a copy and the acknowledgement.

To: The Grievance Officer, [Platform name]
Subject: Please confirm whether this person works for you

Dear Sir or Madam,

I am your customer. My order ID: [number].

On [date] at [time] I received a call or message from [phone number]. This is not an official number. The person said they were [name], [role or employee ID], from the platform. They knew my [list the details they knew].

Please confirm in writing within 7 days:
1. Whether this person is your employee, agent, seller, delivery partner, logistics partner or partner.
2. If yes, their name, role and the agency they work for.
3. Whether you allow staff or agents to contact customers from personal numbers.
4. If they are not connected with you, please say so, so I can report the number.

Name:
Registered mobile number:
Date:

Letter 2: ask how your data got there

To: The Grievance Officer, [Platform name]
Subject: How did my personal data reach a personal phone? Complaint number [if any]

Dear Sir or Madam,

On [date] a person connected with you, [name if known], contacted me from a personal number [number] and knew my [details]. [Describe what they did.]

Please tell me in writing:
1. What personal data about me this person could see, and through which system or app.
2. Whether you shared my data with any agency, seller, delivery partner, logistics partner, partner or processor, and their names.
3. How my data reached a personal phone or account outside your official systems.
4. What action you have taken against the person or agency, including suspension while you investigate.
5. What you have done to stop this happening again.
6. Whether the seller or delivery partner can see my full phone number, and for how long.
Under the Consumer Protection (E-Commerce) Rules, 2020 the platform must have a grievance officer who acknowledges a complaint within 48 hours and resolves it within one month (rule 4(4) and 4(5)).

From 13 May 2027, sections 8 and 11 of the Digital Personal Data Protection Act, 2023 also apply.

Please reply within one month (acknowledgement within 48 hours). If I do not hear from you, I will escalate to the National Consumer Helpline and the Consumer Commission.

Name:
Registered mobile number:
Date:

Evidence to keep

• Screenshots of calls and messages with numbers, dates and times.
• Order, booking, policy or account numbers.
• Your complaint numbers and the company's replies.
• A note of what the caller knew or did.

More in the evidence checklist.

Can you sue? What realistically happens

• Consumer Commission: the most practical route for compensation. Cheap, no lawyer needed, file within 2 years.
• IT Act section 43A (until 13 May 2027): if the company was negligent with sensitive personal data (passwords, bank or card details, health records, biometrics) and that caused wrongful loss or gain, it must pay compensation. Claims up to Rs 5 crore go to your State's IT Secretary acting as Adjudicating Officer (section 46); larger claims go to a court. Appeal within 45 days (section 57). Your phone number and address alone are not sensitive data under the 2011 Rules.
• Civil suit for damages: possible, but slow and costly. Section 61 of the IT Act bars civil courts from matters the Adjudicating Officer can decide.
• Police: only where there is a crime, for example a person who disclosed your information in breach of a contract to cause wrongful loss or gain (IT Act section 72A, up to 3 years), identity theft (66C), cheating by impersonation (66D), stalking or threats.
• Realistic outcome: most people get results from a firm written complaint and the regulator or ombudsman. Courts take years. Consult a lawyer before suing.

From 13 May 2027: the Data Protection Board

From 13 May 2027 the DPDP Act's duties apply. The company is responsible for processing done by it or by anyone processing on its behalf (section 8(1)), may use a processor only under a valid contract (section 8(2)), must protect your data with reasonable security safeguards (section 8(5)), and must tell you and the Board about a breach (section 8(6)). It may use your data only for the lawful purpose you agreed to (sections 4 to 6). Section 44(2) removes IT Act section 43A from that date. Complain to the company first; if it does not resolve it, complain to the Data Protection Board. The Board can impose penalties up to Rs 250 crore, but penalties go to the Government (the Consolidated Fund of India, section 34), not to you. For money, use the ombudsman or the Consumer Commission. Appeals from the Board go to TDSAT within 60 days (section 29).

If it is fake: urgent steps

1. If anyone asks for an OTP, PIN or payment, stop. It may be fraud.
2. Call 1930 if money was lost, then file on cybercrime.gov.in.
3. Report the number on Chakshu (Sanchar Saathi).

Step by step guides:

Related guides

• Travel: airlines, trains, hotels and booking sites Bookings, ID copies at hotels, Digi Yatra, fake helplines and complaints.

See also when a platform shares your data with a third party and the escalation ladder.

Official sources

Checked on 1 November 2026. Company pages are labelled as the company's own words.

• National Consumer Helpline FAQ: Consumer Protection (E-Commerce) Rules, 2020
• PIB, 27 July 2020: Consumer Protection (E-Commerce) Rules, 2020 in force
• National Consumer Helpline (Department of Consumer Affairs)
• e-Jagriti: file a case before a Consumer Commission
• PIB: Consumer Commission pecuniary limits under the 2021 Rules
• Information Technology Act, 2000, updated text (India Code)
• Digital Personal Data Protection Act, 2023 (MeitY copy of the Gazette)