Think Before You Click: Cyber Frauds, Online Scams, and the Law

Staying safe in the digital age is important, which is why it’s essential to be aware of cyber frauds and online scams.

A friend of mine, who is now retired and still uses her son’s old cell phone, most of the time to video call her grandchildren, got a call last month from a man who called himself a “Delhi Police cyber cell officer.” He told her that her Aadhaar number was associated with a parcel that had narcotics in, and she was being investigated and had to remain on the video call “for verification” and transfer the money to a “government-verified account” to show that she was innocent, he said. For almost 40 minutes she was terrified, till her son walked in, took one look at the screen and hung up.

This is no longer an unusual occurrence. It is indeed one of the fastest growing crimes in the country, and as I’m just starting out on a legal internship and still trying to get my foot in the door here, it didn’t seem like a school assignment and more like it was something I needed to be familiar with — whether it’s because the law is constantly changing, or because most people, even the educated, don’t know their rights when it happens to them.

The numbers are no longer small.These numbers are no longer small.

In India, there are more than 900 million users of the internet, and India is one of the world’s biggest and fastest-growing digital economies. Payments are now instant and banking is online, and even government services are increasingly accessible by apps. There is a downside to that convenience. An estimated loss of ₹22,495 crore ($2.7 billion) to cyber fraud was reported by over 28 lakh individuals in 2025, an increase of 24% from the previous year. That year, the national cybercrime helpline got nearly 3.24 crore calls, which amounts to nearly one call per second.

The state with the highest complaints of cyber fraud is Uttar Pradesh, closely followed by Maharashtra, which has reported the highest financial losses, surpassing ₹1,637 crore in the first half of 2026. These are not “facts” in a government report — these are people like my cousin, in their homes, systematically scared out of their bank accounts.

The crooks that are really out there and what they’re doing.

One of the most frightening recent trends is digital arrest scams. Often, they pretend to be from the CBI, ED, RBI, TRAI or local police using AI-generated voices, spoofed numbers, with notices that are issued using official logos that are disseminated by WhatsApp or email. Victim is told that he or she is “digitally arrested” and that they have to transfer the money while on video call without being able to see family, or risk prosecution. Senior citizens are especially vulnerable, partly because they learned in their youth that what a government official says goes — a lesson which fraudsters have mastered, often with great efficiency.

UPI and Banking Fraud, is a huge category in itself. Only UPI-related frauds resulted in a loss of more than ₹805 crore in just eight months of the previous financial year. These include so-called KYC requests, fake payment links (appearing as a refund), QR codes that allow payments to go out of your account without your knowledge, and more.

Job and loan scams are directed towards young professionals and fresh graduates — those like me. Fake work from home offers require a “registration fee” and disappear, and fake loan apps collect Aadhaar and PAN with some going to the extent of opening an account or loan in the victim’s name without their knowledge.

A newer threat and one that’s rapidly growing is Deepfakes and AI-generated content. The number of deepfake files has swelled from approximately 500,000 in 2023 to an estimated 8 million by 2025, while voice-cloning technology has reportedly gotten increasingly close to the real human voice. Many organizations already reported that they had been targeted with attacks involving fake videos and audio based on deepfake technology, such as fake video calls appearing as executives or fake celebrity endorsements for fake investment schemes.

What the Law Actually Says:

To a new law student, the obvious follow-up question is: what legal structure does there appear to be to respond to all this?

The Information Technology Act, 2000, makes hacking, identity theft, phishing, and unauthorized access to computer systems illegal, and supplements the provisions of the Bharatiya Nyaya Sanhita on cheating, forgery and criminal impersonation. There are also civil remedies available for financial fraud victims, such as a claim for compensation under Section 46 of the IT Act, in addition to a criminal case, if they have suffered loss as a result of unauthorised access to a system or theft of data.

The Indian Cyber Crime Coordination Centre (I4C) under the Ministry of Home Affairs, maintains the National Cyber Crime Reporting Portal, provides assistance for forensics and investigating cybercrime, and also operates the helpline 1930 that is specially created to freeze money that is transferred fraudulently to a chain of mule accounts. In the case of a freeze it is a very short “golden hour” for banks and payment platforms, meaning they can act on a fraudulent transfer right at the very moment of the request; then it’s too late once the money is moved through various accounts.

The one thing that kept coming up and I think that should be reiterated is that there is no Government agency in India who make arrests, investigations, or verify finances through a WhatsApp call or video link. All official sources, from the police to the RBI have said so. If you can recall only one piece of legal information from the whole thing, it should be that one.

What the Numbers Don’t Tell:

The most memorable aspect of my research for this is that the losses are not that large, they are deliberately designed against the psychology of the human being, not technical exploitation. Technologically sophisticated is not the reason why a fake CBI notice works – fear overrides careful thinking. The reason a fake job offer works is because it’s based on a real fear of getting a job. About 50% of those victimized by UPI are estimated not to report it, either out of embarrassment or because they believe nothing will happen, allowing the networks to continue using UPI in a relatively safe environment.

Particularly, the law provides victims with rights they aren’t exercising is the real problem. The lawyers are there! The helpline exists. A reporting portal is available. What is lacking is education on their proper usage within a brief enough timeframe to be of any consequence.

A few practical steps to keep in mind.

A Fresher’s Last Word

Before I got to work on this piece I was thinking of cyber fraud as something that could happen to other people, people that are careless, people that don’t know technology. This was a change in that assumption rather quickly, after some research. They’re becoming harder to resist and the law is still playing catch-up with technology that evolves on a monthly basis. Cyber law is fascinating to a new player because it’s not a subject that you can master overnight. It’s a real-time, real-world situation and those most vulnerable to it are least able to protect themselves.

The key to being safe in the digital age isn’t that of being a technologically savvy person. It’s about maintaining a healthy dose of scepticism, understanding the legal facts of the case that count (there are just a handful), and simply putting the phone down.

Here are the sources I drew on for the statistics and legal information in the blog: