Delhi High Court Mandates E-KYC For Domain Registrations To Curb Online Frauds

To curb online scams run through fake websites impersonating popular brands, the Delhi High Court has ordered mandatory e-KYC for domain name registrations and restricted automatic privacy masking of registrant details. It has also directed banks to strengthen payment verification safeguards to protect unsuspecting consumers from being duped.

The directions were issued in a batch of commercial suits where several trademark owners complained that unknown persons were registering deceptive domain names incorporating their marks and using them to operate fake websites.

These websites impersonated genuine brands and induced members of the public to transfer money on the pretext of employment, franchises or distributorships.The batch involved misuse of several well-known trademarks, including Tata Sky, Amul, Bajaj Finance, Dabur, Meesho, Croma, Colgate and ITC.

A single-judge Bench of Justice Prathiba M. Singh first set out the steps to be taken once infringement is detected. It directed that

1. domain name registrars and registry operators must immediately lock, suspend or block infringing domain names upon receipt of court orders;
2. registrars must preserve and disclose complete registrant details within 72 hours when sought by trademark owners or law enforcement agencies;
3. domain names used for illegal or fraudulent activity must be permanently blocked and not made available for re-registration;
4. registrars and registry operators must adopt technological measures, including rights protection mechanisms, to prevent registration of domain names incorporating well-known trademarks;
5. domain name registrars must appoint grievance officers within the prescribed time;
6. government authorities such as the Ministry of Electronics and Information Technology and the Department of Telecommunications must act against non-compliant registrars, including by blocking access to their services; and
7. banks must strengthen consumer safeguards, including beneficiary bank account name verification.

The trademark owners argued that the current setup fell short because registrant identities were routinely masked through privacy protection features, WHOIS details turned out incomplete or fake.

It further argued that enforcement delays let fraudsters pull out funds before vanishing and popping up again with new domain names. They called for mandatory disclosure of registrant information, quick takedowns of infringing domains, and joint action by registrars, regulators, law enforcement agencies, and banks.

Agreeing with these submissions, the court underlined the wider public impact of such fraud, observing

“In the age of technology and internet, domain names/websites form the online soul of a business, and their distinctive character has to be protected. Repeated cases of cyber fraud, cyber terrorism, and other forms of online fraudulent activity traces back to registration of infringing domain names. Misuse of domain names and website content deserves to be dealt with stringent action as, in addition to infringing the interest of the owner of the mark/brand, it also endangers the larger public interest.”

To prevent future misuse, the court issued a second set of forward-looking directions.

It directed that,

1. domain name registrars must eliminate “privacy by default” and stop masking registrant details as an automatic opt-out feature, allowing privacy protection only as an opt-in, value-added service;
2. all registrars offering services in India must undertake compulsory e-KYC verification at the time of registration and conduct periodic re-verification; (3) service of court orders by email to a registrar's grievance officer would be valid and binding, and registrars cannot insist on foreign subpoenas;
3. government departments and critical public bodies must prepare a “reserved list” of names that cannot be registered as domain names by private persons;
4. the government must explore nominating a nodal agency, such as the National Internet Exchange of India, to act as a central repository of domain registration data to assist courts and law enforcement agencies.

The court also clarified the scope of “dynamic” and “dynamic+” injunctions in addressiong repeated and evolving forms of infringement through fresh domain names.

It further directed banks to activate the 'Beneficiary Bank Account Name Lookup' facility, allowing users to verify recipient credentials before online payments.

Applying these principles to the misuse of the “DABUR” mark, the court found that the impugned domain names incorporated the mark in a manner likely to cause confusion and deception.

It granted a 'dynamic+' interim injunction against the identified domain names, confirmed the continuation of existing injunctions, upheld the disclosure obligations on domain name registrars, and permitted extension of reliefs to subsequently discovered infringing domain names following the same modus operandi.