Deepfakes, identity theft, and the dark web: Legal gaps in AI-Generated fraud, an Indian perspective

Abstract

The rapid proliferation of artificial intelligence (AI)-generated deepfakes and synthetic identities has catalyzed a new era of cybercrime in India, facilitated by the anonymity of dark web ecosystems. This paper examines the critical legal and regulatory gaps in addressing AI-driven identity fraud within India's evolving digital landscape. Through analysis of case studies, including Aadhaar biometric breaches traded on Tor networks, AI voice cloning scams targeting financial institutions, and electoral deepfakes, the study reveals the inadequacy of existing frameworks such as the Information Technology Act (2000) and the Digital Personal Data Protection Act (2023). These laws fail to criminalize non-consensual deepfakes, define liability for AI-generated synthetic identities, or provide mechanisms to trace dark web-facilitated fraud. A comparative assessment of global models (EU’s Digital Services Act, South Korea’s Punishment of Deepfake Crimes Act) underscores the urgent need for India to adopt a techno-legal approach. The paper proposes a three-pillar reform strategy: Enacting specialized legislation criminalizing malicious deepfakes with stringent penalties; Establishing a National Deepfake Detection Toolkit (NDDT) for law enforcement; and creating blockchain-verified digital identity systems to prevent synthetic identity theft. This research argues that without immediate legislative intervention and institutional capacity-building, India’s digital governance framework risks obsolescence in the face of rapidly advancing AI-enabled cyber threats.