Cybercrime

The anatomy of cybercrime in India

Financial fraud dominates: UPI and card fraud, phishing links, fake investment and 'task' apps, loan-app extortion, QR-code scams and SIM-swap attacks. Social engineering — manipulating people rather than breaking systems — is the common thread. The 'digital arrest' scam epitomises this: victims are told on video calls by fake police or CBI officers that they are under investigation, and coerced into transferring money to 'clear' themselves.

Beyond fraud, India faces ransomware on hospitals and businesses, data breaches of government and private databases, online child sexual abuse material, cyberstalking and sextortion, and deepfake-driven disinformation. The attacker ecosystem is transnational: scam compounds in Myanmar, Cambodia and Laos, Chinese-linked loan apps, and domestic money-mule networks that launder proceeds within minutes.

• Social engineering beats technical hacking in most Indian cases.
• Digital arrest scams: fake police video calls extorting money.
• Money mules move defrauded funds through layered accounts in minutes.
• Deepfakes add a disinformation and extortion dimension.

Legal framework

The IT Act 2000 criminalises hacking (Section 66), identity theft (66C), cheating by personation (66D), cyber terrorism (66F) and privacy violation (66E); Section 69A empowers content blocking, and the 2021 IT Rules regulate intermediaries. The BNS 2023 covers cheating, criminal breach of trust, stalking and defamation regardless of medium. The Digital Personal Data Protection Act 2023 adds a data-protection layer, and the CERT-In directions (2022) mandate incident reporting within six hours.

Gaps remain: the IT Act predates smartphones and social media; jurisdiction is murky when offenders, servers and victims sit in different countries; and electronic evidence rules (Bharatiya Sakshya Adhiniyam Section 63, the successor to Section 65B of the Evidence Act) demand certification discipline that police stations often lack. A comprehensive new cyber law has been under discussion for years.

• IT Act Sections 66, 66C, 66D, 66F are the workhorse provisions.
• CERT-In requires cyber-incident reporting within six hours.
• IT Rules 2021 impose due diligence on social-media intermediaries.
• India has no comprehensive modern cybercrime statute yet.

Institutional architecture

The I4C (2020) is the nodal framework with seven components: the National Cyber Crime Reporting Portal (cybercrime.gov.in), the 1930 helpline and Citizen Financial Cyber Fraud Reporting System, the National Cyber Forensic Laboratory, the Joint Cybercrime Coordination Team, cyber-threat analytics, training, and an ecosystem unit engaging banks and platforms. The 1930 system's ability to freeze defrauded money in transit — lakhs of calls, thousands of crores saved — is its biggest success.

CERT-In (2004) handles national incident response and threat advisories; the National Critical Information Infrastructure Protection Centre (NCIIPC) protects critical sectors; state cyber cells and cyber police stations investigate; and the National Cyber Security Coordinator advises at the apex. Capacity is the constraint: India has roughly one cyber police station per several districts, and forensic labs are overburdened.

• I4C's seven pillars span reporting, forensics, analytics and coordination.
• 1930 helpline freezes funds within the 'golden hour'.
• CERT-In: incident response; NCIIPC: critical infrastructure.
• Cyber police capacity lags far behind complaint volume.

The international dimension and the road ahead

Cybercrime is borderless, but law is not. India declined to join the Budapest Convention, objecting to its drafting process and data-access provisions; it relies instead on MLATs (slow, often taking years), direct platform requests under US law (the CLOUD Act route), and G8 24/7 network cooperation. India signed the UN Convention against Cybercrime (adopted 2024) negotiations actively, seeking a more inclusive treaty.

The road ahead has three lanes: prevention (awareness campaigns, SIM/device binding for UPI, platform accountability), capacity (more cyber police stations, forensic labs, trained judges and prosecutors) and cooperation (faster MLATs, joint operations against scam compounds, data-sharing agreements). With digital payments at over 13,000 crore UPI transactions a year, the attack surface will only grow — cyber hygiene at population scale is now a national security imperative.

• India is outside the Budapest Convention; relies on MLATs and bilateral channels.
• UN Convention against Cybercrime (2024) is the new global framework.
• UPI scale makes India the world's largest real-time payments target.
• Prevention through awareness is the cheapest and most scalable defence.

Previous year questions

No UPSC question has been asked directly on this micro-topic yet. Use the practice questions below.

Practice questions