India's IT Rules 2026 require platforms to pull flagged deepfakes within three hours, yet fraudulent AI videos of Finance Minister Nirmala Sitharaman and the BSE's chief executive keep resurfacing months later. The rule on paper is strong; the enforcement in practice is not — and that gap is where investors lose money.
What does the three-hour takedown rule actually require?
The IT (Intermediary Guidelines) Amendment Rules that came into force on 20 February 2026 require significant social-media intermediaries to remove flagged synthetically generated content within three hours of a valid notice — two hours for non-consensual intimate imagery — alongside new labelling duties for AI content. As reported by legal outlets covering the amendment, it is one of the tightest takedown regimes anywhere in the world, at least on paper.
If the rule is so strict, why does the fraud keep spreading?
Because takedown is whack-a-mole against an opponent that regenerates instantly. As documented by MediaNama, a deepfake of BSE Managing Director Sundararaman Ramamurthy offering stock tips first circulated in January 2026 and resurfaced repeatedly, forcing the exchange to issue a second advisory on 8 March 2026 — the video, it said, had "resurfaced multiple times" despite police and platform action. A fake of Nirmala Sitharaman endorsing a returns scheme kept reappearing in waves, repeatedly debunked by the PIB Fact Check Unit. Each removed copy is replaced by a re-uploaded, slightly altered one, and the three-hour clock resets against a fresh URL.
Who actually pays for this enforcement gap?
Retail investors, overwhelmingly. A deepfake carrying the face of a finance minister or a stock-exchange chief borrows institutional trust to sell a scam, and the losses land on ordinary savers who believed a video of a credible official. The reputational cost falls on the impersonated public figures, who spend time and legal effort disowning words they never spoke. The broader damage — eroded trust in every genuine official communication — is harder to price but real, and our India deepfake statistics track how fast this category is growing.
Why is provenance a better defence than faster takedowns?
Because it flips the question from "is this fake?" to "is this the genuine, verified source?" Chasing removals is inherently reactive — the content must exist and spread before anyone can flag it. If an institution's authentic spokespeople, official channels and genuine video are registered and verifiable in advance, a viewer or platform can check authenticity at the point of sharing, before the scam does its work. This proactive logic is the foundation of how the Zimorta model works: establish the real baseline first, then detect deviations from it.
What should institutions and talent do right now?
Treat takedown as the last layer, not the first. Register authentic likeness and voice, publish verifiable official channels, watermark genuine content, and run continuous monitoring so a fresh fake is caught in hours rather than after the second advisory. For anyone whose face or voice carries commercial trust, quantifying that identity is part of defending it — our likeness rate calculator helps put a number on what a misused persona is actually worth.
The bottom line
A three-hour rule is only as good as its enforcement, and India's fraud deepfakes keep proving how leaky that enforcement is. The durable fix is not a faster delete button — it is making authenticity verifiable before the fake ever gets shared.
