On August 26, 2025, a Reddit post in the TeenIndia and Kolkata communities went viral after a woman alleged that a phone repair shop in Kolkata had leaked her private videos
What followed were weeks of relentless online harassment.
The leaked videos quickly spread across social media platforms, with the woman's Instagram account becoming ground zero for a disturbing mix of harassment and exploitation. While some users reached out to alert her about the compromised content, many others saw an opportunity to prey on her vulnerability. Her direct messages flooded with lewd propositions, requests for sexual favors, and inappropriate advances from strangers who had stumbled upon her private content.
Decode was able to verify the existence of the leaked material and corroborated the incident through one of the Instagram users who had initially warned the victim about the breach.
In her Reddit post, the woman laid bare the devastating personal toll of the incident. "I am completely broke rn (right now)," she wrote, describing not her complete emotional collapse. The trauma extended beyond online harassment into her most intimate relationships. Her parents, upon learning of the situation, ceased all communication with her. She wrote that she deleted all her social media accounts and changed her phone number too.
“I feel like my whole life has collapsed and I don’t know how I’ll ever recover from this,” she told the Reddit community.
When fellow Reddit users urged her to seek legal recourse through the National Cybercrime Reporting Portal (NCRP), the woman shared evidence that she had already taken preliminary steps. A screenshot of an email from 'Cyber Police' showed her complaint had been processed and transferred to a local Mahila Thana on August 25, 2025, at 4:58 PM. The official correspondence instructed her to contact the women's police station for follow-up action, suggesting that formal legal proceedings were underway.
Turns out, the portal routed her case to a police station in Bilaspur, Chhattisgarh — not Kolkata where the incident happened.
Decode called the number listed in the email. The number belonged to a police station in Koni, where a constable at that station who also works under the Crime and Criminal Tracking Network System, answered and said the station had not received any complaint.
The reporter then asked senior police officials working in the Cybercrime department of Chhattisgarh Police if the routing of the case to a different state was an inadvertent error made by the portal. “I don’t think there is any room for error. Because the system is very detailed and one has to fill in jurisdictions before you get an acknowledgement for the complaint. I think the complainant had chosen Chhattisgarh as the jurisdiction and that is why she was directed to the said number,” a cyber official told Decode.
The constable from Koni station added that complaints involving women and children often see fewer follow-ups. “We receive follow-up calls when our numbers are sent via emails to the complainants.”
On average, she gets around six calls daily, but they are all related to financial fraud.
“If it is a case related to child and women and involves sexual abuse, we have been instructed to direct the victims to the local police stations. When we ask the victims to take the NCRP acknowledgement number complaint and go to their local police stations, they commonly hang up,” Koni police station constable added.
Decode had multiple conversations with the Chhattisgarh Police’s cybercrime wing, but they were not able to direct us to a copy of the complaint that was filed through NCRP.
We reached out to the Cybercrime Wing of West Bengal. Decode has not been able to confirm whether the case was registered there. The article will be updated once we get a response.
The National Cyber Crime Reporting Portal website. A victim can register a complaint anonymously in the Women and Children related Crime Section.
The Flawed System
The woman's case exposes deeper systemic failures within India's cybercrime reporting infrastructure. While she dutifully filed her complaint through the national cybercrime reporting portal, the very system designed to protect her revealed significant shortcomings that often leave victims more vulnerable than before.
NS Nappinai, a senior advocate in the Supreme Court and founder of Cyber Saathi, who was instrumental in setting up the NCRP between 2018 and 2019, doesn't mince words about the portal's deficiencies.
"There have been repeated complaints of the portal being ineffective slow and crashing often however, it still provides a valuable option. While using it personally, I felt that the content sought or choices for filling forms were arduous and cumbersome," she explained.
Nappinai herself experienced these glitches firsthand when attempting to report a cybercrime in Delhi, only to receive a police station reference from Haryana.
The legal framework is in place to address such violations. "This falls under Section 66 E of the Indian Information Technology Act, 2000," Nappinai clarified, noting that even consensual recording doesn't grant rights to disseminate content, let alone unauthorised access and distribution.
Yet having laws on paper means little when the reporting mechanisms consistently fail those who need them most.
The NCRP was launched on August 30, 2019 as a revamped version of the Cybercrime reporting portal, where earlier only cybercrime complaints related to child pornography, rape or sexually abusive content could be filed. Since 2019, all cybercrime complaints can be filed through the portal. Between 2021 and June 2025, NCRP has processed over 6.5 million incidents, according to Ministry of Home Affairs data. These numbers suggest a system handling significant volume, but they mask a troubling reality about effectiveness.
When Complaints Hit A Dead End
The case of the Kolkata shop is not an isolated one, several past cases show repair-shop technicians leaked content from customers’ phones and blackmailed victims. In 2019, the Delhi police had registered 350 cases in just six months after photographs and videos were found stolen from their phones. The source in all these cases were: Phone repair shops.
“In most cases, victims don't come to police stations. They opt for online complaints as they don't feel comfortable talking about personal data," a police officer had told India Today.
The statistics paint a sobering picture of systemic failure. A Parliament of India report presented to the Rajya Sabha on August 20, 2025, revealed that of the 20,33,316 complaints filed on NCRP in 2024, only 49,582 resulted in registered FIRs—a mere 2.43 percent conversion rate. For every 100 victims who found the courage to report their trauma, fewer than three saw their complaints translate into formal investigations.
Pavan Duggal, a Supreme Court advocate and cyberlaw expert, explained, "The NCRP is not an FIR portal and the complaint you register in the portal does not convert into an FIR automatically.”
This fundamental disconnect creates a cruel irony: victims believe they're taking decisive legal action, when in reality they're entering a bureaucratic maze with no guaranteed exit.
The problem stems from India's federal structure, where the NCRP operates under the Ministry of Home Affairs while policing remains a state subject. This creates jurisdictional gaps that often trap victims between systems. "On one hand, you are a victim of cybercrime and on the other, there is no guarantee and you face harassment while filing an FIR in your local police station," Duggal observed.
Siddharth P, co-founder and director of the Rati Foundation, which works to protect children from sexual violence, sees this pattern repeatedly. "While there is a provision to report anonymously on crimes related to women and children, the complaints rarely translate into FIRs and are taken up for investigations in local police stations," he noted.
“In theory, the NCRP PDF of acknowledgement is liable to be converted to an FIR, but a lot depends on the jurisdictions of police stations,” Siddharth added.
Even when victims follow protocol and present their NCRP acknowledgment numbers within the stipulated three days, conversion to FIRs remains inconsistent across jurisdictions.
The Parliamentary report acknowledges this enforcement gap explicitly: "A significant contributor to this phenomenon is the lack of visible accountability or swift enforcement. As a result, citizens feel that justice in cybercrime cases is slow and uncertain. Women and youth, key drivers of digital uptake, are especially impacted by safety concerns."
The Alternate Paths To Justice
Faced with these systemic failures, victims and advocates have developed workarounds that shouldn't be necessary.
Nappinai suggests leveraging the Intermediary Guidelines of 2021, which allow complaints directly to platform grievance officers without requiring police involvement. If platforms refuse compliance, victims can escalate to the Ministry of Electronics and Information Technology's (MeiTY) Appellate Committee—a regulatory mechanism that bypasses traditional law enforcement entirely.
Yet even experts acknowledge the limitations of relying solely on digital pathways. The constable from Koni, Bilaspur, recognising the portal's constraints, advocates for a dual approach: "We cannot do much through the portal. Once victims register the complaints, we advise them to reach the local police station and lodge an FIR." This recommendation essentially treats the NCRP as a preliminary step rather than a complete solution, requiring victims to navigate both digital and physical bureaucracies to achieve meaningful action.
For the Kolkata victim, whose perpetrator had "got into all my social media accounts including my gmail accounts," such platform-specific remedies offer limited comfort when the violation extends across multiple services and potentially countless websites.
Digital rights advocates have developed tools like StopNCII.org and TakeItDown to address non-consensual intimate image sharing. Sophie Mortimer, manager of the Revenge Porn Helpline that operates StopNCII.org told Decode, “When someone creates a case on the site, it allows them to create hashes or unique digital fingerprints of their intimate images. The hashes are shared with the industry partners who use them to flag non-consensual intimate images as they are uploaded to their sites.”
StopNCII.org is a tool for adults above 18 years all over the world. The organisation has partnered with the National Center for Missing and Exploited Children (NCMEC) to share the technology behind StopNCII.org which they used to create Take It Down which operates similarly as StopNCII.org but for under 18s.
Take It Down, a platform which works with companies like Instagram and Snapchat to notify them that nudes, partially nudes, or sexually explicit images or videos may be posted on the platform, told Decode, “there is no set timeline for removal as the specific scan and detection methods differ in each case.”
While these services can remove content from partner platforms usually within two to three days, their effectiveness diminishes when content spreads to what Siddharth P describes as "shady websites." These platforms often operate outside conventional takedown mechanisms, creating permanent digital scars for victims whose intimate content has traveled beyond mainstream social media.
As the Kolkata woman retreats further into isolation, her case becomes a stark data point in a larger failure of systems meant to protect the vulnerable.
The constable, whose number was officially emailed to the woman for follow-ups, said the team has the authority to register zero FIRs for cybercrimes, which are grievous in nature. However, as there are seldom follow-up calls by victims, the team sitting in Koni could rarely convert a complaint into a Zero FIR and direct it to the local police station for investigation.