Cyber Fraud and Digital Financial Crimes in India: Emerging Criminal-Law Challenges

Introduction

India has seen a dramatic shift in the way financial transactions are carried out. Internet and mobile banking, payment applications, cards, digital wallets and instant payment systems have made financial services more accessible and efficient. At the same time, the digital financial sector has opened the way to cybercriminal activity that can be carried out remotely and on a large scale.

Digital financial crime is an umbrella term for any unlawful use of digital technologies, computer resources, electronic communication or an online financial system to obtain financial benefits, property, financial credentials or money. Deceptive emails (phishing messages), fake websites and web applications, social engineering, identity theft, and unauthorised transactions in or manipulation of digital accounts are all examples of cyber fraud.

The Reserve Bank of India (RBI) has reported card and internet fraud as the most common category of bank fraud by number in 2024–25. These figures refer to frauds reported by banks in that year and should not be read as the total extent of cybercrime or of digital financial losses in India.¹ They nonetheless illustrate the need to consider the legal implications of technology-enabled financial crime.

Cyber fraud is complicated by the fact that a single fraudulent transaction can combine several unlawful acts. A criminal may first obtain personal information, then gain access to an account, impersonate the victim and finally try to hide the money. The conduct may therefore engage cyber law, the general criminal law, the law of evidence and financial regulation.

The Information Technology Act 2000 (“IT Act”) continues to be a significant statute dealing with cybercrime. The Bharatiya Nyaya Sanhita 2023 (“BNS”), which came into force on 1 July 2024, sets out the current general criminal-law framework and contains provisions on cheating and cheating by personation.² The Bharatiya Sakshya Adhiniyam 2023 (“BSA”), which also came into force on 1 July 2024, sets out the current general framework for evidence, including electronic and digital records.³

Even with these provisions, the prosecution of cyber fraud is not without its challenges. It can be hard to determine who the true perpetrator is when false identities, mule accounts, virtual communications and intermediaries are employed. Electronic evidence may be spread across different devices, servers and financial institutions. Money can pass through multiple accounts quickly, before investigators can get hold of it. Questions of jurisdiction and international cooperation take on added importance when the offender is outside India.

This paper therefore explores the following core issue: is the current criminal-law system capable of responding to the new types of financial crime that increasingly unfold in the digital realm, and what legal and institutional changes are needed to strengthen the criminal-justice response to cyber fraud?

Research problem, questions and methodology

A. Statement of the problem

Traditional criminal law was fashioned for identifiable human conduct within an identifiable territory. Digital financial crime puts these assumptions to the test. An offender can defraud a victim from another jurisdiction, use an anonymous communication service, pose as someone else and transfer the funds through multiple financial accounts in minutes. The principal research problem is therefore not a lack of legislation. India has several legal instruments capable of tackling various types of cyber fraud; the difficulty lies in applying them in a coordinated way to fast-changing technological conduct.

B. Research questions

This paper addresses four main questions:

1.  To what extent can existing Indian criminal law address emerging forms of cyber fraud and financial crime?

2.  What problems arise in establishing criminal liability and in attributing digital financial crimes to specific offenders?

3.  What evidentiary, jurisdictional and institutional challenges affect the prosecution of cyber fraud and the recovery of its proceeds?

4.  What legal and institutional changes can strengthen India’s response to digital financial crime?

C. Objectives

This paper aims:

•  to explore key issues of digital financial crime in India;

•  to analyse the relevant provisions of Indian criminal and cyber law;

•  to discuss the evidentiary and investigative issues around cyber fraud;

•  to identify how financial-sector regulation can help prevent and respond to fraud; and

•  to make proposals for legal and institutional change.

D. Research methodology

The paper follows the doctrinal method of legal research. Its primary sources are legislation, judicial decisions, regulatory directions and government materials; its secondary sources are academic literature, legal commentary and institutional reports. The analysis focuses on Indian law, with only limited reference to the law of other countries where it helps to define a possible regulatory approach.

Emerging forms of digital financial crime

A. Phishing and smishing

Phishing is a deceptive communication intended to trick the victim into surrendering confidential information or taking some action that benefits the perpetrator. Smishing is a similar technique carried out through text or mobile messages. The victim may receive a message or call from someone pretending to be from a bank, a government agency, a delivery company or another financial institution, which may contain a link to a bogus site or a request for personal information. The criminal-law element lies in deceit combined with unauthorised access, identity theft or the transfer of money. The method of contact does not by itself define the offence; the prosecution must prove the ingredients of the substantive offence and link the accused to the conduct.

B. UPI and digital payment fraud

With the proliferation of instant payments, payment identifiers, QR codes, payment requests and deceptive payment interfaces have created new opportunities for payment-related fraud. An offender may induce a victim to authorise a transfer by persuading the victim that this is necessary to receive money, complete a refund or verify an account. The law distinguishes between an unauthorised transaction and a transaction that the victim was fraudulently induced to authorise. The technical record may show that the victim authorised the transaction, while the surrounding evidence may show that the victim was deceived into doing so. The distinction matters both for the allocation of financial responsibility and for criminal investigation.

C. Identity theft and account takeover

Identity theft is the misuse of another person’s identity. An attacker may take control of the victim’s account, or of its data; this is known as account takeover. Section 66C of the IT Act punishes the fraudulent or dishonest use of another person’s electronic signature, password or other unique identification feature.⁴ Section 66D of the IT Act punishes cheating by personation by means of a communication device or computer resource.⁵ These provisions are particularly relevant to digital financial fraud, in which fraudsters commonly use stolen identities and impersonation.

D. Investment and online trading fraud

With the rise in popularity of digital investment platforms, online investment fraud has grown as well. Fraudsters may create fake investment opportunities, pose as financial advisers or build a rapport with the victim on social media before persuading the victim to send money. Such conduct is likely to involve two or more offences, including cheating, cheating by personation, forgery, criminal breach of trust or offences under other financial laws.⁶ The investigation must establish what representations were made to the victim, who the accused is and what role the accused played, where the money went and what the accused actually intended.

E. SIM-swap and mobile-based fraud

SIM-swap fraud involves taking control of the victim’s mobile number through a replacement SIM card and then using it to access the victim’s accounts. Mobile identities are closely linked with banking and payment services, and their compromise can lead to further financial crime. An effective criminal-law response may therefore require collaboration among the telecom industry, banks, payment service providers and the police.

F. AI-enabled financial fraud

Artificial intelligence has created new opportunities for financial fraud. A person or organisation can be impersonated through convincing text, a synthetic voice, manipulated images or deepfake video. A scammer may, for example, call an employee of the victim organisation, pose as a senior executive and instruct the employee to transfer money; a synthetic video call can lend such a request false authenticity. These developments create further challenges, because the traditional signs of identity and authenticity may no longer be reliable.

Indian criminal-law framework

A. Information Technology Act 2000

The IT Act is the basic law on computer-related offences. Section 43 provides for compensation where a person, without the permission of the owner or the person in charge, accesses or otherwise interferes with a computer resource, and section 66 makes the acts referred to in section 43 an offence when they are done dishonestly or fraudulently.⁷ The provisions most relevant to financial cyber fraud are sections 66C and 66D: section 66C deals with identity theft, and section 66D with cheating by personation by means of a communication device or computer resource.⁸ These provisions show that Indian law already acknowledges the connection between digital technology and fraud. The IT Act must, however, operate together with the BNS, because many cybercrimes involve traditional offences such as cheating and personation as well as computer-specific conduct.

B. Bharatiya Nyaya Sanhita 2023

Cheating is dealt with in section 318 of the BNS. It covers deceiving a person and thereby fraudulently or dishonestly inducing that person to deliver property, or intentionally inducing that person to do or omit to do anything which he would not otherwise do or omit, where the act or omission causes or is likely to cause damage or harm to that person in body, mind, reputation or property.⁹ Cheating by personation is covered in section 319, which is especially relevant to online financial fraud, since fraudsters often pretend to be a company official, a government official, a bank representative or another trusted person.¹⁰ The BNS thus provides the general criminal-law basis, which can operate alongside the technology-specific provisions of the IT Act. The interaction of the two laws is significant. A digital fraud can have several components, combining the technical means of the fraud with the actual harm it causes. The legal framework should therefore be applied according to the facts and the elements of each offence, and digital fraud should not be treated as a wholly new type of criminal act.

C. Bharatiya Sakshya Adhiniyam 2023

Electronic evidence is central to the investigation of digital financial crime, and the BSA recognises electronic and digital records. Section 63 sets out the statutory conditions for the admissibility of electronic records.¹¹ Section 61 provides that the admissibility of an electronic or digital record cannot be denied merely on the ground that it is an electronic or digital record.¹² This is significant because, in financial crimes, the evidence may consist of:

•  bank transaction records;

•  UPI transaction information;

•  call records;

•  emails;

•  text messages;

•  IP addresses;

•  device information;

•  CCTV footage;

•  application logs;

•  server records; and

•  social-media communications.

Admissibility, however, is only one aspect of the question. Investigators must also establish the authenticity, integrity and relevance of the evidence and its connection with the accused and the case.

D. Digital Personal Data Protection Act 2023

Although it is not a criminal statute on financial fraud, the Digital Personal Data Protection Act 2023 governs the processing of digital personal data.¹³ Its framework can support the criminal law: by protecting personal data while allowing lawful processing, it can help to reduce the data-governance failures that enable identity theft and financial fraud. The commencement of the Act’s provisions is staggered under the notification dated 13 November 2025.¹⁴ Attention must therefore be paid to the commencement date of each particular obligation whenever the Act is relied upon.

Criminal-law challenges

A. Attribution of offenders

The person who operates a device to carry out a fraudulent transaction may not be the person who holds the bank account into which the money is transferred, and that account may be a mule account used by a larger criminal network. Likewise, a telephone number, email address or IP address is not a reliable indicator of the identity of the person who committed the offence. For a prosecution to succeed, it must be supported by evidence connecting the accused to the wrongdoing.

B. Mens rea and deception

In cases of cheating, the state of mind of the accused and the nature of the act must both be considered. In digital financial fraud, the prosecution must prove that the accused knew of the deception and acted with the intention of causing wrongful gain to one person or wrongful loss to another. This requirement does not change with the technology used for the transaction. The fact that money was transferred by a fraudster into a person’s bank account does not necessarily mean that the account holder participated intentionally in the fraud. Evidence of communications, transactions, the use of devices and the relationships between individuals is therefore important.

C. Mule accounts

Mule accounts are accounts used to receive, transfer or hide the proceeds of fraud. They raise difficult questions because the account holder may be:

1.  an active participant;

2.  a person who knowingly permits use of the account;

3.  a person deceived into providing access; or

4.  a person whose credentials were compromised.

The mere fact that fraudulent funds passed through an account cannot, therefore, by itself be the basis of criminal liability; knowledge, participation and the statutory elements of the offence must be established.

D. Electronic evidence

Digital evidence is prone to deletion, alteration and loss, and digital financial crimes can generate it in large volumes. Evidence may have to be collected from several institutions and service providers, and delay may reduce the availability of relevant records and make it more difficult to trace funds. The BSA provides the legal basis for electronic evidence; effective enforcement, however, requires standardised investigative procedures and forensic capacity. The BSA now governs the admissibility of electronic records formerly regulated by the Indian Evidence Act, 1872, and courts and investigators will have to apply the new provisions in a way that preserves authenticity and reliability.

E. Jurisdictional challenges

By its nature, cyber fraud can be international. An Indian victim may be contacted by an offender located overseas, through the infrastructure of another country, and the money may move through domestic and foreign accounts. The territorial organisation of criminal investigation can therefore cause delay. Obtaining digital evidence from service providers abroad may require formal legal assistance, and identifying the persons behind an anonymously operated online account may be difficult.

F. Rapid movement of fraudulent funds

Digital payments move money quickly, which distinguishes digital fraud from financial fraud in the traditional sense. Once moved, the money can be mixed with funds in other accounts or converted into other assets before the victim reports the crime to the police. The National Cyber Crime Reporting Portal (NCRP) and the cybercrime helpline 1930 are available for reporting financial cybercrime, and the portal advises victims of cybercrime to report immediately, on the portal or at the 1930 national helpline.¹⁵ Prompt reporting is sensible, because it may help the authorities and financial institutions to trace and freeze the defrauded funds.

Role of financial regulation

A. RBI customer protection framework

Criminal law is only one part of the response to digital financial fraud. Banking regulation is important both preventively and remedially. The RBI’s directions on unauthorised electronic banking transactions set out the principles governing customer liability and the reporting of such transactions. The regulatory approach recognises that banks must put in place appropriate systems to detect and act upon transactions that customers have not authorised.¹⁶

B. Fraud risk management

The RBI has consistently emphasised the importance of fraud detection, cyber security and consumer protection in the financial sector. Its Annual Report 2024–25 states that frauds occurred predominantly in the category of digital payments (card/internet) in terms of number.¹⁷

This highlights the need to combine criminal investigation with fraud monitoring in the financial sector.

C. National Cyber Crime Reporting Portal

The National Cyber Crime Reporting Portal is a key institutional mechanism for reporting cybercrime. It provides for the reporting of financial fraud and designates 1930 as the national helpline for victims of financial cyber fraud.¹⁸ The portal also allows other types of cybercrime to be reported and complaints to be tracked.¹⁹

The system is a significant step towards centralised reporting. The effectiveness of the reporting mechanism, however, will depend on whether complaints are acted upon quickly, evidence is preserved and criminal investigations are opened.

Judicial and evidentiary dimensions

A. Electronic evidence

Electronic records are increasingly an integral part of the evidence in criminal cases. Under the Indian Evidence Act, 1872, sections 65A and 65B governed the proof of electronic records.²⁰ In Anvar P.V. v. P.K. Basheer, the Supreme Court held that these provisions form a complete code on the proof of electronic records, so that secondary evidence of an electronic record is inadmissible unless it is accompanied by the certificate required by section 65B(4).²¹

In Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal, the Supreme Court held that the certificate under section 65B(4) is a condition precedent to the admissibility of evidence by way of an electronic record, and explained when it is required.²² The BSA has now replaced that statutory framework, and its sections 61 to 63 deal specifically with electronic and digital records.²³ These principles remain important: investigations of digital financial crime should secure the integrity and source of electronic information from the beginning.

B. Financial records as evidence

Bank records may prove the flow of money, but they do not by themselves prove a complete criminal chain. The closer the evidence comes to the elements of the offence, the easier it will be to show that the accused was involved.

C. Fraud classification and natural justice

The Supreme Court has also addressed the procedure by which banks classify accounts as fraudulent. In State Bank of India v. Rajesh Agarwal, it held that the principles of natural justice, particularly the rule of audi alteram partem, must be read into the RBI’s Master Directions on Frauds, so that a borrower must be given notice and an opportunity to be heard, and the decision must be made by a reasoned order, before the borrower’s account is classified as fraud.²⁴

The case did not concern ordinary consumer cyber fraud. It does, however, highlight the broader importance of procedural fairness when a financial institution or a regulator acts, with potentially serious consequences, on allegations of fraud.

AI and the future of digital financial crime

Artificial intelligence is likely to make some financial frauds more sophisticated.

Fraudsters could use AI-generated emails, synthetic video, voice cloning and tailored social-engineering attacks. AI can also allow messages to be adapted to the personality of the individual victim, making the deception more persuasive.

This may alter people’s sense of what is authentic.

A familiar voice on the telephone, or a familiar face on a video call, has long offered some assurance of who is speaking. Synthetic media undermines that assumption.

Criminal-law action must therefore rest on more than the apparent authenticity of a communication. Investigators should rely increasingly on transaction records, device information, account relationships, metadata, authentication logs and other evidence that exists independently of the communication.

AI can also be used defensively. Financial institutions can use it to identify unusual transaction activity, fraudulent accounts and suspicious transactions in order to prevent fraud.

AI is thus a double-edged sword: the same technology can give criminals greater power while also strengthening the capacity to prevent and investigate crime.

Recommendations

A. Strengthening digital forensic capacity

India should continue expanding specialised digital-forensic capabilities for cyber financial crime.

Investigators require training in:

•  blockchain and transaction tracing;

•  mobile-device forensics;

•  cloud evidence;

•  IP and network analysis;

•  digital payment systems;

•  AI-generated content; and

•  cryptocurrency-related investigations.

B. Faster financial response

Financial cyber fraud requires a fast response mechanism. Reporting must be followed by quick coordination between the police, banks, payment-system operators and other financial intermediaries. A delay of several hours can significantly impair the ability to trace and freeze the proceeds of fraud.

C. Standardised evidence preservation

Law-enforcement agencies and financial institutions should develop standardised procedures for preserving:

•  transaction logs;

•  device records;

•  IP information;

•  call records;

•  application logs;

•  account-opening documents;

•  KYC information;

•  CCTV footage; and

•  communications between accused persons and victims.

Standardisation can reduce evidentiary disputes and improve the quality of prosecutions.

D. Stronger regulation of mule accounts

Financial institutions need to strengthen their procedures for detecting suspicious account activity that may be linked to fraud.

They should, however, distinguish between genuine criminals and account holders who may have been drawn into the criminal activity without their knowledge.

E. Improved inter-agency coordination

Cyber financial crime often requires cooperation among:

•  State police;

•  cybercrime units;

•  financial institutions;

•  RBI-regulated entities;

•  payment-system operators;

•  telecom providers;

•  CERT-In;

•  the Indian Cyber Crime Coordination Centre; and

•  international law-enforcement agencies.

Institutional coordination should therefore be treated as a central component of cybercrime enforcement.

F. AI-specific investigative capability

As AI-enabled financial fraud becomes more sophisticated, investigative agencies need to build the capability and tools to detect synthetic content.

Deepfake-detection tools can be wrong, so investigators should not rely on them alone. Content suspected of being generated by AI should be verified against independent financial and electronic records.

G. International cooperation

Mechanisms should be further improved for accessing electronic evidence held outside India and for tracing funds moved through foreign accounts. International cooperation is particularly important where the infrastructure is located in one jurisdiction and the offender or the financial beneficiary in another.

Findings and discussion

The analysis shows that Indian criminal law contains significant provisions that can be used against cyber financial crime. The IT Act contains specific provisions on identity theft and on cheating by personation by means of a computer resource, and the BNS contains general provisions on cheating and cheating by personation.

The BSA provides the current framework for electronic and digital records. The difficulty lies not in a lack of criminal provisions, but in their fragmentation, in the difficulty of attribution and in the difficulty of enforcement. First, digital financial crimes can involve multiple actors and multiple intermediaries, and the role and intention of each individual must be investigated in detail. Secondly, electronic evidence must be collected and preserved in a way that meets statutory requirements and establishes its authenticity.

Thirdly, financial fraud demands a fast response, because money can be transferred between accounts and platforms almost instantly. Fourthly, the problem becomes more complicated where the offender, the infrastructure and the financial accounts are located in different countries. Lastly, AI will make fraud more complex, while also offering new means of detecting and preventing it. The findings indicate that technological and institutional reform is required alongside legislative reform. Creating new offences has little practical value if it does not lead to better investigation or evidence.

Conclusion

Cyber fraud is a serious and growing problem for the Indian criminal justice system. Financial services are becoming more mainstream and increasingly digital, and the rise of the financial technology (fintech) industry has made the sector more attractive to fraudsters.

India has a substantial body of law on the subject, including the Bharatiya Nyaya Sanhita 2023, the Bharatiya Sakshya Adhiniyam 2023 and the Information Technology Act 2000. These are complemented by the RBI’s financial-sector regulation on fraud prevention and customer protection.

The effectiveness of the legal response, however, depends heavily on attribution, the preservation of evidence, institutional coordination and prompt financial measures. The existing criminal provisions are not, by themselves, enough to deter cyber fraud effectively.

Artificial intelligence complicates the picture further. Synthetic voices, deepfake video and automated social engineering will test the reliability of ordinary means of recognising people. At the same time, AI and data analysis can help financial institutions and law-enforcement agencies to detect fraudulent transactions.

India’s future strategy should therefore combine technologically responsive criminal law, robust digital forensics, faster responses to financial fraud, procedural safeguards, institutional coordination and international cooperation.

The digital revolution in the financial sector should be matched by a digital transformation of the mechanisms for preventing, investigating and prosecuting financial cybercrime, so that those mechanisms are at least as effective as the technology they confront.

*****

Footnotes

1. Reserve Bank of India, Annual Report 2024–25, ¶ VI.61 & tbl. VI.3 (2025), https://www.rbi.org.in/Scripts/AnnualReportPublications.aspx?Id=1436 (card/internet frauds: 13,516 of 23,953 frauds reported by banks in 2024–25 (56.5 per cent), involving ₹520 crore; the data cover frauds of ₹1 lakh and above reported during the year, and the amounts involved do not reflect the loss incurred).

2. Bharatiya Nyaya Sanhita, No. 45 of 2023, India Code (2023), §§ 318–319.

3. Bharatiya Sakshya Adhiniyam, No. 47 of 2023, India Code (2023), §§ 61–63.

4. Information Technology Act, No. 21 of 2000, India Code (2000), § 66C.

5. Id. § 66D.

6. Bharatiya Nyaya Sanhita, supra note 2, §§ 316 (criminal breach of trust), 318 (cheating), 319 (cheating by personation), 336 (forgery).

7. Information Technology Act, supra note 4, §§ 43, 66.

8. Id. §§ 66C–66D.

9. Bharatiya Nyaya Sanhita, supra note 2, § 318(1).

10. Id. § 319.

11. Bharatiya Sakshya Adhiniyam, supra note 3, § 63.

12. Id. § 61.

13. Digital Personal Data Protection Act, No. 22 of 2023, India Code (2023).

14. Ministry of Electronics and Information Technology, Notification G.S.R. 843(E) (Nov. 13, 2025) (bringing ss. 1(2), 2, 18–26, 35, 38–43 and 44(1) and (3) of the Digital Personal Data Protection Act into force on publication, ss. 6(9) and 27(1)(d) one year after publication, and the remaining provisions, including the obligations of data fiduciaries, eighteen months after publication).

15. Indian Cyber Crime Coordination Centre, Ministry of Home Affairs, National Cyber Crime Reporting Portal, Report Suspect, https://cybercrime.gov.in/cyber_suspect (“If you have become a victim of Cybercrime, please report immediately at [the portal] or 1930 National Helpline Number.”).

16. Reserve Bank of India, Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions, RBI/2017-18/15, DBR.No.Leg.BC.78/09.07.005/2017-18, ¶¶ 4–7 (July 6, 2017), https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=11040&Mode=0 (instructions since consolidated in the Reserve Bank of India (Commercial Banks - Responsible Business Conduct) Directions, 2025).

17. Reserve Bank of India, supra note 1, ¶ VI.61 & tbl. VI.3.

18. Indian Cyber Crime Coordination Centre, Ministry of Home Affairs, supra note 15 (home page: “Any victim of financial cyber fraud can dial helpline number 1930”).

19. Id. (options to “Report a Crime” and “Track Your Complaint”).

20. The Indian Evidence Act, No. 1 of 1872, India Code (1872), §§ 65A–65B (repealed 2024).

21. Anvar P.V. v. P.K. Basheer, (2014) 10 SCC 473 (India).

22. Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal, (2020) 7 SCC 1 (India).

23. Bharatiya Sakshya Adhiniyam, supra note 3, §§ 61–63, 170.

24. State Bank of India v. Rajesh Agarwal, (2023) 6 SCC 1, ¶¶ 2, 81(vi)–(vii) (India).