Cybercrimes in India once meant a stranger misusing a chat room. Today, they can mean a forged Supreme Court order on your screen. Around 2000–01, Delhi Police arrested a man accused of stalking Ritu Kohl online. In September 2025, an Ambala couple faced forged Supreme Court orders from fraudsters. I wanted to know how one world became the other. This blog follows the evidence through 4th November 2026, so every 2026 figure remains partial.
However, I refuse to assume a neat story where one crime simply replaces another. Harassment, hacking and identity misuse never vanished, though larger schemes later joined them. So, the real question is what changed: scale, speed, organisation, or the trust victims extended. Along the way, I test every claim against official records. Stay with me, because the gap between money held and money returned surprised me most.
Cybercrimes in India, 2000–2008: Chat Rooms and a Young Statute
First, the legal backdrop deserves precision, because dates here often get muddled. The Information Technology Act received assent in June 2000 but commenced on 17 October 2000. Its core purpose was legal recognition of electronic records, not policing online abuse. Consequently, police often reached for older criminal law when harassment appeared. Meanwhile, cyber cafes and chat rooms gave harassers anonymity and gave investigators headaches. Unauthorised access already troubled police, since Delhi registered a stolen-internet-hours case in May 2000. So, was this a crime wave, or merely crimes awaiting better statutes?
Then came Ritu Kohli’s complaint, one of India’s earliest widely reported cyber stalking cases. Delhi Police arrested Manish Kathuria, accused of posing as her in a chat room. He allegedly circulated her home number, and obscene calls followed. Reports consistently mention IPC Section 509, which concerns insulting a woman’s modesty. However, sources disagree on the year, offering both 2000 and 2001. Some accounts add IT Act provisions, but others say the Act could not apply. No judgement surfaced, and Pavan Duggal told the BBC the case had “fizzled out”.
Cybercrimes in India, 2009–2015: Identity, Amendment and Free Speech
Next, the amended law arrived, and its dates need careful separating. The Information Technology (Amendment) Act, 2008 carries 2008 in its title. Yet, assent came on 5th February 2009, with a notification dated 27th October 2009. It added offences such as identity theft, cheating by personation and privacy violation. Meanwhile, online banking, e-commerce and networks like Orkut widened everyday digital exposure. Thus phishing and impersonation found far more targets than before. Still, the harder question was where punishment ended and free expression began.
Section 66A answered that question badly, and the Supreme Court said so. On 24th March 2015, Shreya Singh v. Union of India struck it down entirely. The judges found it blurred discussion, advocacy and incitement, violating Article 19(1)(a). Importantly, offensive speech is not automatically criminal, whereas stalking, threats and fraud remain punishable. Therefore, Section 66A is dead law, and in 2022 the Court ordered pending cases closed. Did that ruling weaken policing, or merely sharpen its aim?
Cybercrimes in India, 2016–2019: Phones, Payments and Patchy Safeguards
Then the phone became the bank, and connectivity climbed quickly. Telecommute Regulatory Authority of India (TRAI) counted 422.20 million internet subscribers by 31st March 2017, up from 342.65 million a year earlier. Meanwhile, UPI launched on a pilot basis in April 2016 with 21 banks. Public rollout followed that August, and routine transfers became tap-and-send habits. Naturally, UPI fraud, fake KYC messages, OTP deception and SIM swaps found fresh audiences. However, I cannot claim UPI caused this, because comparable crime data simply does not exist. So, I treat the link as association, not proof of causation.
Institutions responded, though unevenly and often after the payments boom began. RBI’s July 2017 circular limited customer liability and placed the burden of proof on banks. Zero liability applied to third-party breaches reported within three working days. Subsequently, the Home Ministry set up I4C in October 2018 with a ₹415.86 crore outlay. Then the national reporting portal went live in pilot on 30th August 2019. Notice the sequence: payments scaled first, while reporting machinery arrived afterwards. Evidence cannot say whether earlier infrastructure would have changed outcomes, but the timing deserves scrutiny.
Paradoxically, convenience cut both ways, and cybercrimes in India found openings wherever friction vanished. Instant transfers pleased honest users, yet UPI fraud pleased impostors just as much. RBI later credited additional authentication with building confidence in digital payments. Even so, authentication cannot stop someone from being talked into approving a payment. I cannot quantify these weaknesses for 2016–2019, since comparable data are missing. Still, safeguards that arrive late hand fraudsters a head start.
Cybercrimes in India, 2020–2023: Screens, Loans and Scam Networks
Then the pandemic pushed work, hiring, borrowing and shopping onto phones. In 2021, I4C launched a cyber fraud reporting system aimed at freezing stolen money quickly. Meanwhile, instant-loan apps drew police attention in Telangana from December 2020. Police alleged that apps harvested contacts and photos, then shamed borrowers into paying. They also reported six suicides and alleged roughly ₹21,000 crore moved abroad, according to reports. These remain police allegations, not court findings, so I label them carefully. Later, three of four arrested Chinese nationals got bail after chargesheet delays.
Meanwhile, ransomware struck a hospital rather than a household on 23rd November 2022. AIIMS Delhi fell back on manual operations, and police registered an FIR. Parliament heard that hackers demanded no specific amount, despite widely reported ₹200 crore claims. In December 2023, I4C flagged over 100 task and investment websites for blocking. It described overseas operators using ads, chat apps, and mule accounts or rented accounts. Loan sharks and fake jobs were old; the delivery machinery was new. So, who built that machinery, and who profited from its gaps?
Behind many of these schemes, mule accounts quietly did the plumbing. A mule account is opened by one person but operated by another to move stolen money. Cyber fraud rarely ends where the victim pays; it travels through layers of such accounts. That layering explains why cybercrimes in India often outrun a single police station’s jurisdiction. Consequently, banks, telecoms and platforms hold evidence that victims cannot reach. Investigators need that evidence quickly, and speed is where the system strains.
Cybercrimes in India, 2024–2026: Borrowed Authority and Synthetic Voices
Then fraud began borrowing authority itself, the most unsettling shift I found. On 1st July 2024, the Bharat Nyaya Sanhita (BNS) replaced the Indian Penal Code for new offences. That September, I4C launched a Suspect Registry, linking banks with portal complaint data. On 17th October 2025, the Supreme Court took suo motu cognisance of digital arrest scams. The bench said such forgery “cannot be treated as an ordinary or routine offence of cheating or cybercrime”. In December 2025, it authorised a pan-India CBI investigation. Did institutions finally notice the pattern, or merely its loudest victims?
Subsequently, the Court’s 4th August 2026 order told RBI to frame a mule-account procedure. RBI published draft amendments for comment, and comments closed on 2nd October. On 29 October 2026, the bench said rules must make banks “indemnify” victims where fraud follows a “failure of due diligence”. That remains a judicial observation, and RBI expects to notify its rules by 30th November 2026. So, this is not yet a universal entitlement, and the rules stay unnotified. Meanwhile, MeitY’s amended IT Rules on synthetic content took effect on 20th February 2026. AI claims need caution, because most voice-clone reports still rest on police suspicion.
Fourteen Faces of Cybercrimes in India
Before I present the list, remember that cybercrimes in India mixes methods, schemes and harms, overlaps heavily, and remains non-exhaustive.
I grouped them by how they feel to victims, not by statute. Some began as old harassment and merely changed channels. Others, like digital arrest scams, depend on manufactured authority more than technical skill. Cybercrimes in India rarely respect tidy categories, so expect overlap. Each entry below stays brief, evidence-led and non-operational.
1. Cyberstalking and online harassment
Cyberstalking means repeated online monitoring, contact or intimidation that leaves someone frightened or restricted. Offenders typically use fake profiles, relentless messages, or published phone numbers. Kohli’s complaint shows the pattern was visible near the start. Later cases leaned on IPC and IT Act provisions, and the BNS now governs new offences. Importantly, offensive speech differs from stalking, a line Shreya Singhal’s reasoning keeps intact. Victims often report fear, withdrawal, reputational damage and workplace disruption. Impersonation overlaps whenever harassers create fake profiles in someone’s name.
2. Image-based sexual abuse and non-consensual morphing
Image-based sexual abuse means creating or sharing intimate images without consent, including morphing faces onto explicit material. The harm lies in the image circulating, whether or not money is demanded. Sextortion differs because it adds a threat to extract payment or compliance. Telangana police also alleged that loan-app agents morphed borrowers’ photos to pressure them. Furthermore, the 2026 IT Rules amendment targets non-consensual intimate synthetic content on platforms. Survivors face trauma, stigma and content that keeps resurfacing. Consent, therefore, remains the central legal and moral question.
3. Hacking, data theft and ransomware
Three terms hide in one headline, so I separate them. Unauthorised access means entering a system without permission. Data theft means copying information out, whereas ransomware means locking systems for ransom. The AIIMS Delhi attack of 23rd November 2022 pushed services into manual mode. Meanwhile, CERT-In tracked 29,44,248 cybersecurity incidents in 2025, but those are incidents, not crimes. Stolen data later fuels impersonation, and disrupted hospitals endanger patients.
4. Phishing and spoofed email or SMS
Phishing means deceptive messages posing as trusted senders to extract credentials or clicks. It is a technique, not a completed crime, until money actually moves. Citizens flagged 19,418 malicious-link communications through DoT’s Chakshu facility in 2025. Those reports describe attempts, not losses. Additionally, RBI has announced an exclusive bank.in domain to help customers recognise genuine banks. Spoofed messages work because familiar logos lower our guard. Banks and telecom operators therefore share responsibility for authenticating what reaches us.
5. Card fraud and skimming
Card fraud means unauthorised use of card data, copied physically or exploited online. The transaction is unauthorised, which differs from deception-led payments the customer approves. RBI’s 2017 circular set liability rules separating those situations. Bank-reported card, internet and digital-payment frauds of ₹1 lakh and above fell to 293 cases in FY26, from 13,332 in FY25. However, that series excludes smaller frauds, so it understates ordinary experience. I could not verify a recent skimming prosecution, so I name none.
6. Identity theft and impersonation
Identity theft means misusing someone’s credentials or identifiers, while impersonation means pretending to be someone to deceive. The IT Act treats them separately, in Sections 66C and 66D. A forged-KYC SIM shows how stolen identity enables later impersonation. Sanchar Saathi lets citizens check connections registered under their names. DoT says over four crore such requests have been resolved. Conversely, impersonation needs no stolen data, such as a caller posing as an officer.
7. UPI, KYC and OTP fraud
UPI fraud usually means deceiving someone into approving a payment, rather than breaking UPI itself. In contrast, OTP theft or fake KYC processes capture credentials so fraudsters can act. Distinguishing them matters because liability can differ under RBI rules. In 2025, Chakshu received 1,06,483 reports of KYC or payment-related suspected fraud. Another 60,985 reports concerned fake customer-care numbers. UPI fraud, meanwhile, rides on a system handling billions of monthly transactions. Losses can be modest or ruinous, and recovery is never guaranteed. For practical steps on securing your phone and personal data, read our guide on mobile security.
8. SIM-swap fraud
SIM-swap fraud means obtaining a replacement SIM so one-time passwords reach the wrong person. Ahmedabad police alleged that a gang took ₹79.70 lakh from a businessman in this way. They also alleged help from telecom insiders, which remains unproven. Police said ₹50 lakh frozen was returned. DoT says its ASTR tool had disconnected over 88 lakh suspicious connections by 15th July 2026. Unlike OTP trickery, a SIM swap targets the telecom layer, not the person.
9. Task and fake-job scams
Task scams offer small payments for simple online jobs, then demand deposits to unlock earnings. Fake job offers are old; the task format drew official attention in 2023. In December 2023, I4C identified over 100 such websites, and MeitY blocked them. I4C said overseas operators used mule accounts to move proceeds. Separately, ThePrint reported that 6,998 Indians were rescued from scam compounds abroad. Those workers are trafficking victims, distinct from defrauded job-seekers. Both groups suffer, yet their stories need separate telling.
10. Loan-app abuse and harassment
Loan-app abuse involves unlawful lenders recovering dues through contact harvesting, shaming and threats. Legitimate digital lending, by contrast, comes from regulated entities following RBI directions. RBI issued Digital Lending Directions on 8th May 2025, according to the government. A public directory of legitimate lending apps followed from 1st July 2025. Telangana police alleged earlier abuses, including morphed photos and suicides. Those remain allegations, yet they show how personal data becomes leverage. Check that directory before trusting any app with your contacts.
11. Sextortion
Sextortion means threatening to expose intimate images, real or fabricated, unless victims pay or comply. It differs from image-based abuse because the threat itself becomes the weapon. Citizens reported 10,901 sextortion attempts on Chakshu in 2024 and 21,189 in 2025. Those count reported attempts, not completed crimes or total prevalence. Likewise, National Crime Records Bureau (NCRB)’s 2024 snapshot ties 3.1% of cybercrime cases to sexual exploitation, a different measure. Shame, isolation and repeated payments mark its harm. I could not verify a strong prosecution example, so I include none.
12. Digital-arrest scams
A digital arrest is a fraud, because Indian law has no such procedure. Callers pose as police, CBI, customs or judges, then demand money over video. Forged court orders sometimes supply the manufactured authority, as in Ambala. I4C told the Supreme Court of 1,23,672 related complaints in 2024 and 58,239 in 2025, reported Indian Express. It also counted 21,928 complaints from January to August 2026, a partial-year figure. Reported losses were roughly ₹1,935 crore in 2024 and ₹1,211 crore in 2025. These are complaint counts, not convictions or unique victims.
13. Investment and trading scams
Investment fraud means fake platforms, advisers or groups luring deposits with promised returns. Genuine market losses differ, because real investments fall without anyone lying. One report citing I4C data put investment schemes at 77% of 2025 cyber fraud losses; I treat that cautiously. Chakshu received 29,140 investment-related reports in 2025. Moreover, NSE warned in 2024 that advisory clips were falsely created using technology. Not every investment scam uses AI. However, mule accounts then carry the money onward.
14. Deepfake and AI voice-clone fraud
Deepfake fraud uses AI-generated or altered audio or video to impersonate a real person. Synthetic impersonation differs from a human mimic or an ordinary fake account. In Kozhikode, in July 2023, police suspected deepfake use in a ₹40,000 video-call fraud. Most Indian voice-clone reports similarly rest on police suspicion, without published forensic confirmation. Consequently, I write “suspected” unless evidence says otherwise. Harms include money lost, damaged reputations and eroded trust in familiar voices. Rules on labelling synthetic content now exist, but enforcement is untested.
What the Numbers Say About Cybercrimes in India
Numbers on cybercrimes in India feel solid, yet each one measures something quite different. NCRB counts police-registered cases, and 2024 recorded 1,01,928 cybercrime cases. That compares with 50,035 in 2020, according to a July 2026 Rajya Sabha reply. Crime in India 2024 is the latest NCRB edition I could confirm. Separately, the portal logged 24,02,579 financial-fraud complaints in 2025, reporting ₹22,495 crore. The Home Ministry itself calls that data dynamic, so figures may change. Complaints are not FIRs, victims or proven crimes.
Source: Ministry of Home Affairs reply in Rajya Sabha, 21st July 2026, citing NCRB data (calendar years, police-registered cases).
| Measure | Latest figure | What it counts |
|---|---|---|
| NCRB cases | 1,01,928 (2024) | Police-registered cases |
| Portal complaints | 24,02,579 (2025) | Financial-fraud complaints |
| CERT-In incidents | 29,44,248 (2025) | Security incidents, not crimes |
| Chakshu reports | 5,19,662 (2025) | Attempted-fraud reports |
Source: PIB releases on NCRB data (21st July 2026), the Home Ministry (11th February 2026), CERT-In and DoT. Each row has a different scope; do not add or compare them.
Now comes the number that unsettled me: held money versus returned money. For FY2023-24 to FY2025-26, the Home Ministry reported ₹9,079 crore marked under lien. The same reply reported about ₹206 crore refunded, against ₹56,087 crore in reported losses. I refuse to compute a recovery rate, because lien and refunds measure different stages. Likewise, “saved” figures describe money held or stopped, not money back in victims’ accounts. Furthermore, rising counts partly reflect easier reporting through the 1930 helpline and portal. Therefore, recorded growth cannot precisely measure the real growth of crime, and I avoid stitching these datasets into one 2000–2026 curve.
Source: Ministry of Home Affairs reply, 22nd July 2026 (cumulative, FY2023-24 to FY2025-26). Refund and lien figures come from one reply; scope may differ.
Source: Department of Telecommunications, Rajya Sabha reply of 5th February 2026 (calendar year 2025; reports of attempted fraud, not losses). “Others” combines four categories.
Law, Enforcement and Reporting for Cybercrimes in India
The amended IT Act still anchors cybercrime law, covering hacking, identity theft, personation and privacy offences. Meanwhile, the Bharatiya Nyaya Sanhita governs offences committed after 1st July 2024. Older cases, like Kohli’s, remain tied to the IPC provisions actually invoked. I avoided BNS section numbers because I could not verify them. I4C coordinates, and runs the portal, the Suspect Registry and the Samanvaya platform. State and UT police, however, register FIRs, investigate and file chargesheets. So, a portal complaint does not automatically become an FIR.
Enforcement faces stubborn obstacles that awareness cannot solve alone. The ratio of roughly one FIR per thirty complaints, by my calculation, raises capacity questions. Mule accounts channel stolen money, and RBI’s MuleHunter.AI had reached 23 banks by December 2025. Platforms face tougher synthetic-content duties, including three-hour takedowns for certain orders. Victim support still lags, since a restoration module reportedly began operating around April 2026. Meanwhile, the Supreme Court’s August 2026 order told states to operationalise State Cyber Crime Coordination Centres. Who guards the gaps between banks, telecoms, platforms and police?
If you lose money to cyber fraud
- Call the 1930 helpline promptly and report at cybercrime.gov.in.
- Contact your bank or payment provider through official channels.
- Keep transaction references, messages, screenshots, URLs and acknowledgement numbers.
- Report suspicious calls or messages without loss on Chakshu (Sanchar Saathi).
- Follow up with local police, because a portal complaint is not an FIR.
- Prompt reporting can help freeze funds, yet recovery is never guaranteed.
What Cybercrimes in India Teach Us
So how did we travel from chat-room harassment to forged court orders? Scale, speed, reach, organisation and tools changed, while fear and trust stayed the levers. Fraudsters still exploit urgency, aspiration, intimacy and borrowed authority, only through better channels. Cybercrimes in India therefore demand institutional safeguards alongside public awareness. Banks must tighten onboarding and monitor mule accounts, while telecom operators verify SIM issuance. Platforms must act faster on impersonation, and states must convert complaints into investigations.
Policy deserves its own paragraph, because individual vigilance has limits. Regulators should publish lien, restoration and refund data together, so citizens see real outcomes. Courts have begun pressing for victim compensation, but binding rules must follow. States need trained cyber units, and complaints deserve timely conversion into investigations. Schools and workplaces can teach verification habits without blaming victims. Even UPI fraud, which feels intensely personal, depends on systemic gaps, and cyber fraud thrives on isolation. Cybercrimes in India will shrink only when communities and institutions move together.
Meanwhile, I will verify unexpected calls through numbers I find independently. I will also report attempted scams on Chakshu, because those reports help others. You can help by checking on elderly relatives and refusing to shame victims. Moreover, demand transparency on refunds, not just headlines about money held. Will we treat the next scam as someone’s fault, or our shared failure? Share this article with one person today, and report one suspicious message this week.
ExpressIndia.info will keep tracking cyber fraud with verified data and plain language. We will hold institutions accountable, and we will keep readers informed and protected.
#CybercrimesInIndia #DigitalArrest #CyberFraud #UPIFraud #ExpressIndia