Can police trace someone using a VPN in India?

Yes. A VPN only hides your IP address from the websites you visit. Under the CERT-In directions of 28 April 2022, VPN providers serving India must keep customers' validated names, addresses, contact numbers, emails and IP addresses for at least 5 years. Payments, linked accounts and seized devices also identify the user.

Can a foreign or new Gmail account be traced to me?

Yes. Email providers record when and from which IP an account was created, the phone number used for verification, and every login's IP address, device and time. Indian authorities send large numbers of legal requests to global platforms; Facebook alone reported 40,300 requests from India in the second half of 2020.

Do fake social media accounts protect someone running illegal content?

No. Platforms log IP addresses, devices and verification details for every account. Creating fake profiles can also bring charges under IT Act Section 66C (identity theft) and 66D (cheating by impersonation), each up to 3 years.

What was the Bulli Bai case?

In January 2022, an app hosted on GitHub listed Muslim women for fake auctions using their photos without consent. Mumbai Police and Delhi Police arrested four young people, including engineering and B.Tech students. Delhi Police said it traced the alleged creator using IP records and technical analysis.

Can someone using multiple Gmail IDs and fake accounts be arrested?

Yes. On 9 September 2026, Delhi Police arrested a 22-year-old B.Tech graduate who allegedly used several Gmail IDs and fake Instagram, Discord and Facebook accounts to circulate AI deepfakes. Police traced him through his digital footprint and technical evidence.

Is Telegram safe for selling content anonymously?

No. Paid channels need payments that land in bank accounts, customers complain, and investigators join groups. In 2026, Hardoi Police arrested a B.Tech graduate who ran about 21 Telegram and Instagram channels and found around ₹1.2 crore in his accounts.

Does hiding my identity help my case if I am caught?

No. It shows you knew the activity was illegal, adds separate charges for fake SIMs or profiles, can involve other people whose identity you used, and can make it harder to get bail.

Web Development Cyber Law for Developers

Using a Foreign Gmail, US Phone Number or VPN to Run a Porn Website From India? Why You Will Still Be Caught

Q: Is using a fake or someone else's SIM card a crime in India?

Yes. Under the Telecommunications Act, 2023, obtaining a SIM or telecom identifier through fraud, cheating or impersonation, or misusing someone else's SIM, can be punished with up to 3 years in jail, a fine of up to ₹50 lakh, or both.

Think a foreign Gmail, US number, VPN or fake accounts will hide you while running a porn website from India? This guide explains why they fail: email and platform logs, CERT-In's 5-year KYC rule for VPN providers, the Telecommunications Act 2023 penalty for fake SIMs, and real cases including the Bulli Bai GitHub app arrests and a 2026 Delhi deepfake arrest of a B.Tech graduate who used multiple Gmail IDs.

MetaSkillGroup

4 Oct 202612 min read8

Quick answer: No. Using a foreign Gmail, a US or virtual phone number, a VPN or fake social media accounts does not stop an operator in India from being traced. These tools hide your identity from other users, not from law enforcement. Email providers, VPN companies, telecom operators and payment systems all keep records that police can obtain. In January 2022, police arrested engineering students behind the Bulli Bai app hosted on GitHub, despite fake accounts. In September 2026, Delhi Police arrested a B.Tech graduate who used multiple Gmail IDs and fake Instagram and Discord accounts to spread AI deepfakes. Getting a SIM through a fake identity is itself a crime under the Telecommunications Act, 2023, with up to 3 years in jail and a fine of up to ₹50 lakh.

Last updated: October 2026

After hosting, the second most common myth is about identity:

"I'll use a new Gmail that isn't linked to me. I'll buy a US number online. I'll turn on a VPN. I'll make fake accounts. Nobody will ever know it's me."

People who think this way usually believe they are smarter than the system. The real cases below show what actually happens to them.

This article explains why foreign accounts, virtual numbers, VPNs and fake profiles fail when a crime is reported in India, and why trying them makes your situation worse, not better. It is not a guide to hiding. It is a clear explanation of why hiding does not work.

This article is part of our series Running an Adult Website in India as a Developer: Laws, Punishments, Real Arrests and Why You Will Get Caught. For the hosting side of this myth, read Can You Hide a Porn Website on Vercel, Render or Offshore Servers?

The Core Mistake: Hiding From People Is Not Hiding From Police

Anonymity tools are designed to stop ordinary people from seeing who you are: website visitors, other users, strangers on the internet. They are not designed to stop a criminal investigation, because every one of these tools is run by a company, and every company keeps records and responds to legal requests.

What you use	Who it hides you from	Who still knows
A new Gmail or foreign email	Website visitors and other users	The email provider: creation details, recovery number, login IPs and devices
A US or virtual phone number	People you message	The number provider, the payment method used to buy it, and the device it runs on
A VPN	The websites you visit	The VPN company, your payment method, and your ISP, which sees you connecting to the VPN
Fake social media accounts	Other users	The platform: signup details, login IPs, devices and linked accounts
A domain with "privacy protection"	Public WHOIS lookups	The registrar: your registration and payment details

Every anonymity tool is a company with logs, a payment system and a legal department. That is three more places your identity is recorded.

Myth 1: "A Foreign Gmail Can't Be Traced to Me"

A Gmail address is not "foreign" or "Indian". It is an account on Google's servers, and creating and using it leaves records:

When and from which IP address the account was created
The phone number used for verification or recovery
Every login: IP address, time, device and browser
Linked accounts and services where the email was used, including your hosting, domain and payment accounts

Major platforms receive and respond to legal requests from Indian authorities on a large scale. For example, Facebook reported receiving 40,300 government requests for user data from India in just July to December 2020, the second-highest in the world, and said it produced data in 52% of cases. Requests to US companies can also go through formal channels such as mutual legal assistance treaties (MLATs).

Real case: multiple Gmail IDs did not help (Delhi, September 2026)

On 9 September 2026, the Cyber Police Station, North District, Delhi arrested a 22-year-old B.Tech graduate for allegedly creating obscene AI-generated images of a woman and circulating them. According to police, he used several Gmail IDs and multiple fake Instagram, Discord and Facebook accounts specifically to stay anonymous. Police traced him by analysing his digital footprint, email IDs and other technical evidence, and seized his phone and two SIM cards.

He did exactly what this myth suggests. He was still arrested.

Myth 2: "A US or Virtual Number Can't Be Traced"

A foreign or virtual number does not come from nowhere:

It has to be bought, usually with a card, UPI, wallet or crypto account that is linked to you
It runs on a phone or computer that also has your real accounts on it
The apps you register with it record the IP addresses and devices you use

Getting a SIM with fake identity is a crime by itself

Under the Telecommunications Act, 2023, obtaining a SIM card or other telecom identifier through fraud, cheating or impersonation, or misusing someone else's SIM, is an offence. The Department of Telecommunications has publicly warned that this can mean up to 3 years in jail, a fine of up to ₹50 lakh, or both.

So "I'll use someone else's SIM" or "I'll get a SIM with fake documents" does not remove you from the case. It adds a new criminal charge and drags another person into it.

Myth 3: "A VPN Makes Me Invisible"

A VPN hides your IP address from the websites you visit. That is all it does. It does not hide:

Who paid for the VPN. Your card, UPI or wallet is on record with the VPN company.
That you connected to a VPN. Your Indian ISP can see your connection to the VPN server.
Your accounts. If you log in to anything linked to you, the VPN is irrelevant.
Your device. When police seize your laptop or phone, everything stored on it is examined, VPN or not.
Your money. If your project earns anything, the payment trail goes straight to your bank account.

VPN providers serving India must keep your details

Under the CERT-In directions of 28 April 2022, issued under Section 70B(6) of the IT Act, VPN service providers, along with cloud and VPS providers, must maintain customers' validated names, addresses, contact numbers, email addresses, IP addresses and the purpose of using the service for at least 5 years, even after the account is closed.

Real case: the Bulli Bai app (January 2022)

In January 2022, an app called Bulli Bai, hosted on GitHub, appeared online. It listed hundreds of Muslim women for fake "auctions" using their photographs without consent. It was a copy of an earlier app called "Sulli Deals", for which nobody had been arrested, and its creators were promoted through social media accounts.

Within days:

Mumbai Police arrested a 21-year-old engineering student from Bengaluru, a 21-year-old BSc student and an 18-year-old from Uttarakhand
Delhi Police arrested a 21-year-old B.Tech student from Assam, whom police described as the creator, using IP detail records and technical analysis, and found evidence of the app's development on his laptop

GitHub, fake social media handles and the belief that "the last one got away" did not protect any of them. Four young people, three of them studying science and engineering, were arrested in their early twenties.

Myth 4: "Fake Accounts Protect Me"

Fake accounts are one of the most common things investigators untangle. Platforms record:

The IP address and device used to create and log in to each account
Phone numbers and emails used for verification
Links between accounts created or used from the same device or network

When police receive a complaint, they send legal requests to the platform, map the accounts to IP addresses, and then ask the internet service provider which subscriber was using that IP at that time. In the Rashmika Mandanna deepfake case, Delhi Police scanned more than 500 social media accounts before arresting the creator in January 2024.

Creating fake profiles to commit or hide an offence can also bring additional charges, such as identity theft (IT Act 66C) and cheating by impersonation using a computer (IT Act 66D), each carrying up to 3 years in jail.

Myth 5: "Telegram and Encrypted Apps Keep Me Safe"

Encryption protects the content of messages in transit. It does not protect the person who is running a business on the platform:

Paid channels need payments, and payments land in bank accounts
Customers complain, take screenshots and go to the police
Undercover investigators and foreign police join groups
Your phone holds everything once it is seized

In 2026, Hardoi Police in Uttar Pradesh arrested a 2019 B.Tech graduate who allegedly ran around 21 Telegram and Instagram groups and channels selling obscene content through paid subscriptions, after a tip-off. Police found around ₹1.2 crore in his bank accounts. In 2022, the CBI's Operation Megh Chakra raided 59 locations across India based on a lead that came from New Zealand Police through Interpol.

Read these and more in Real Arrests in India for Running Porn Websites and Sharing Illegal Content.

Why Trying to Hide Makes Your Case Worse

Using fake identities and anonymity tools does not just fail. It actively hurts you in court:

It proves intent. Going to great lengths to hide shows you knew what you were doing was illegal. That makes it much harder to claim it was a mistake or a misunderstanding.
It adds charges. Fake SIMs (Telecommunications Act), fake profiles (IT Act 66C and 66D) and false documents bring separate offences on top of the original one.
It drags in other people. Using a friend's or family member's SIM, ID or bank account can put them under investigation too.
It weakens bail. Courts consider whether an accused is likely to tamper with evidence or abscond. Someone who used multiple fake identities can look like exactly that risk.

Common Myths at a Glance

Myth	Reality
"A new foreign Gmail isn't linked to me."	Email providers log signup IPs, recovery numbers, devices and every login.
"A US number can't be traced."	You paid for it and used it on your own device.
"I'll use someone else's SIM."	Obtaining or misusing a SIM through fraud or impersonation is a crime: up to 3 years and ₹50 lakh under the Telecommunications Act, 2023.
"A VPN makes me invisible."	VPN providers serving India must keep validated customer details for 5 years under CERT-In 2022.
"Fake accounts protect me."	Platforms log IPs and devices. The Bulli Bai and Delhi deepfake accused used fake accounts and were arrested.
"GitHub and open platforms are anonymous."	The Bulli Bai app was hosted on GitHub. Its alleged creator was traced through IP records and his laptop.
"Hiding well means I'll never be caught."	Hiding proves intent, adds charges and makes bail harder.

Key Takeaways

Anonymity tools hide you from people, not from police. Every tool is a company with logs and a legal team.
Foreign Gmail, US numbers, VPNs and fake accounts have all failed in real Indian cases.
VPN, cloud and VPS providers must keep your validated details for 5 years under CERT-In 2022.
Fake SIMs are a separate crime: up to 3 years and ₹50 lakh under the Telecommunications Act, 2023.
Bulli Bai (2022): engineering and science students arrested despite GitHub hosting and fake handles.
Delhi deepfake (2026): a B.Tech graduate arrested despite multiple Gmail IDs and fake accounts.
Trying to hide makes it worse: it proves intent, adds charges and hurts your chances of bail.

If you ever find yourself planning how to hide your identity before building something, that is your answer: don't build it.

Read the full series

Disclaimer: This article is for general awareness and educational purposes only and does not constitute legal advice. Cases described as arrests are at the investigation or trial stage unless a conviction is stated, and every accused person is presumed innocent until proven guilty. For advice on a specific situation, consult a qualified lawyer.

Sources

#vpn illegal website india,
#can police trace vpn india
#fake gmail traced
#virtual number tracing india
#cert-in vpn rules
#telecommunications act 2023
#bulli bai case
#cyber law india
#online anonymity myths
#developer legal guide