Your Money, Their Target: Cybercrime, Financial Fraud and Who Must Answer
Digital scams exploit fear and trust. India’s response must combine customer vigilance with enforceable accountability for financial service providers.
News analysis | Updated 3 October 2026
A familiar voice, an unfamiliar trap
Imagine receiving a call during dinner: your bank account will be blocked unless you update your KYC immediately. The caller knows your name, sounds professional and sends a convincing link. Minutes later, your savings begin disappearing.
This is an illustrative scenario, but the dilemma is real. Digital banking offers extraordinary convenience; criminals exploit the same speed. For victims, the next question is painfully practical: who must answer when money moves faster than the complaint system?
The answer requires more than telling customers to “be careful”. It involves criminal law, banking regulation, the circumstances of the transaction and the response after fraud is reported.
The numbers—and the recovery gap
A Ministry of Home Affairs release reports more than 53.87 lakh cyber-fraud complaints across financial years 2023–24 to 2025–26, involving ₹56,087 crore in reported amounts. In that dataset, ₹9,079 crore was marked as lien and ₹206 crore was refunded. These are reported figures, not a judicial determination of every loss.
The distinction matters. Money held under a lien has been restrained; it has not necessarily reached the victim. Reporting, tracing, securing funds and restoring them are different stages.
For a household awaiting school fees or medical treatment, a successful freeze is welcome, but an actual refund is the outcome that counts. Authorities should therefore communicate recovery stages clearly rather than leave victims interpreting optimistic aggregate figures.
Scams sell urgency before they steal money
A fake KYC message threatens exclusion. An investment pitch promises exceptional returns. A supposed employer demands an advance fee. An impersonator posing as an investigator threatens arrest unless the victim transfers money.
These narratives differ, but their machinery is similar: establish authority, create emotional pressure and prevent independent verification. Criminals may ask victims to install remote-access software, share credentials or make a payment themselves.
The Central Bureau of Investigation has explicitly warned that “digital arrest” has no legal existence under Indian law. A video call featuring uniforms or an official-looking background does not create legal authority.
A useful defence is to interrupt the script. End the call and contact the institution through an independently obtained official number. A number supplied by the suspicious caller is not independent verification.
Likewise, receiving money through UPI does not require entering a UPI PIN. A request to scan a payment QR code and enter the PIN to obtain a refund is a warning sign.
Identity theft can outlast the transaction
Stolen identity information can create a second crisis. A victim may discover unfamiliar accounts, disputed borrowing or transactions linked to documents they never knowingly submitted.
Financial harm is therefore wider than a missing balance. Victims may need to contest inaccurate credit records, secure compromised accounts and establish that an electronic identity was misused.
India’s Information Technology Act, 2000 addresses these offences. Section 66C covers dishonest or fraudulent use of another person’s password, electronic signature or other unique identifying feature. Section 66D concerns cheating by personation through a computer resource or communication device.
The Bharatiya Nyaya Sanhita, 2023, also matters. Section 318 addresses cheating, including dishonest inducement to deliver property under subsection (4); Section 319 addresses cheating by personation. Applicable charges depend on the evidence and conduct involved.
Criminal prosecution can punish offenders. It does not, by itself, resolve every dispute about a bank’s reimbursement obligations.
Banks have duties beyond sending warnings
The Banking Regulation Act, 1949, particularly Section 35A, provides RBI with direction-making powers relevant to protecting depositors and the public interest. Digital security is consequently a regulatory responsibility, not merely an advertising promise. taxguru.in
RBI’s Digital Payment Security Controls, 2021 require covered institutions to maintain security governance and fraud-monitoring arrangements. Relevant risk indicators include unusual transaction patterns, new beneficiaries, device or location changes and suspicious activity.
This creates legitimate questions after a loss: were warning signals detected? Did the institution respond appropriately? Was there an accessible route to report fraud?
KYC obligations also involve ongoing monitoring. Under the RBI framework, supported by the Prevention of Money-laundering Act, 2002, and related rules, identifying a customer is not simply a one-time document collection exercise.
However, the presence of a receiving account does not automatically prove its bank caused the victim’s loss. Accountability requires examining the applicable duty, any breach and its connection to the damage.
What current RBI liability rules mean
The bank framework originating in RBI’s 2017 directions, subsequently consolidated, distinguishes three situations:
Bank fault: customer liability is zero where the loss results from the bank’s contributory fraud, negligence or deficiency.
Third-party breach: where neither bank nor customer is at fault, reporting within three working days of receiving the bank’s communication attracts zero liability. Reporting in four to seven working days attracts prescribed caps; later reporting follows the bank’s policy.
Customer negligence: sharing payment credentials can leave the customer bearing losses until reporting; subsequent losses fall on the bank.
The bank bears the burden of proving customer liability. The directions provide for shadow credit within ten working days of notification and resolution within a maximum of ninety days. These protections concern covered unauthorized electronic transactions; separate frameworks may apply to other providers.
Report immediately. A liability window is not a reason to delay.
“You entered the OTP” is not the whole investigation
An unauthorized debit differs from a transfer the customer approved after deception. This distinction can affect reimbursement.
Suppose a criminal secretly takes over an account. Compare that with a customer who knowingly presses “pay” because a caller falsely claims to be a police officer. Both involve fraud, but the payment evidence and applicable liability analysis may differ.
An OTP or PIN record should not end every inquiry. Investigators should examine possible credential compromise, bank failures, the complaint timeline and the surrounding circumstances.
Equally, fraud does not create an automatic right to reimbursement in every case. A reasoned decision should identify the relevant rule and explain the evidence, rather than rely on a generic rejection.
January 2027 brings a further change
RBI’s 24 June 2026 amendment directions for commercial banks apply to relevant transactions occurring on or after 1 January 2027. They are therefore future provisions at this article’s publication date.
They expressly address fraudulent transactions involving approval obtained through coercion or duress. A conditional, once-in-a-lifetime compensation arrangement covers eligible individual customers, including sole proprietors, in specified customer-negligence cases: gross loss must not exceed ₹50,000, with compensation capped at 85% of net loss or ₹25,000, whichever is lower.
Reporting to both the bank and 1930 or the national portal within five calendar days is required. The arrangement covers eligible losses during the specified one-year period from commencement. It is not a universal refund guarantee.
Apps and intermediaries cannot disappear from scrutiny
A transaction may involve a bank, payment application, telecom operator and outsourced technology provider. Victims should not have to untangle that entire chain before receiving a complaint acknowledgement.
RBI’s 2024 cyber-resilience and digital-payment-security directions for non-bank payment system operators, issued under the Payment and Settlement Systems Act, 2007, address security governance and third-party risks, with phased implementation.
Responsibilities differ across entities. Still, outsourcing technology should not become an excuse for avoiding examination of the regulated provider’s own duties.
The first response: act, document, escalate
If money has been lost:
Alert the bank immediately through an official channel. Request safeguards against further transactions and retain the complaint acknowledgement.
Call 1930 and report at cybercrime.gov.in. Supply accurate transaction references, amounts and recipient details available to you.
Preserve evidence: messages, call details, screenshots, transaction statements and the sequence of events.
Secure compromised access: change passwords using a trusted device and address suspected SIM or remote-access compromise.
Seek a written liability decision, including the rule relied upon and the reasons for any refusal.
Do not pay someone promising guaranteed recovery. A second scam can exploit the desperation created by the first.
The complaint route has changed
The RBI Integrated Ombudsman Scheme, 2026, effective 1 July 2026, replaced the 2021 scheme, subject to transitional arrangements. It offers free redress for service deficiencies involving covered entities.
First complain to the provider. If its reply is unsatisfactory, or it fails to reply within thirty days or the applicable longer prescribed timeline, approach cms.rbi.org.in.
The current scheme generally requires filing within ninety days of the applicable timeline expiring or the provider’s last communication, whichever is later. Criminal investigation does not itself bar the service complaint, although parallel proceedings on the same grievance can affect maintainability.
Trust needs measurable accountability
Digital finance cannot operate without customer care, but customer caution cannot substitute for secure systems.
The practical test is whether suspicious activity receives attention, complaints trigger prompt action and reimbursement decisions explain the evidence. Public reporting should distinguish money reported lost, money restrained and money returned.
Criminals target money by manipulating trust. Banks, payment providers and authorities must rebuild that trust through prevention, transparent decisions and effective recovery. For the victim, accountability becomes real when someone answers the complaint—and explains what happens next.
Comments