COMBATING CYBER FRAUD IN DIGITAL INDIA: RBI SAFEGUARDS, LEGAL FRAMEWORK, AND POLICY ROADMAP

Why In News?

According to the Status of Policing in India Report (SPIR) 2026, growing trust and daily reliance on digital payment apps like UPI paradoxically make users more vulnerable to cybercriminals.

What Is The Current Scale And Architecture Of Digital Payments In India?

Macroeconomic Expansion: Over the past decade, digital payment volumes in India grew 38-fold with a Compound Annual Growth Rate (CAGR) of 53% in volume and 13% in transaction value. (Source: RB)

UPI Dominance in Retail Finance: The Unified Payments Interface (UPI) commands 66.8% of total digital payment volume and 53.4% of total transaction value. 

• UPI transaction volume surged nearly four-fold from 3,885 crore (valued at ₹83.4 lakh crore) in 2021 to 15,547 crore (valued at ₹200.7 lakh crore) in 2024.

Surging Attack Surface Across Connected Households: Internet connectivity now reaches over 86% of Indian households. Annual cybersecurity incidents escalated sharply from 10.29 lakh in 2022 to 22.68 lakh in 2024. (Source: PIB)

Mounting Financial Toll and Low Restitution: Financial losses reported on the National Cyber Crime Reporting Portal (NCRP) reached ₹22,848 crore across 24 lakh cases in 2024, rising to ₹22,931 crore across 28 lakh cases in 2025. 

Why Do Cyber Frauds Surge Despite Expanding Digital Literacy?

Cognitive Manipulation Over Technical Hacking: Modern cyber frauds execute through Authorized Push Payment (APP) scams rather than core infrastructure breaches. 

• Over 80% of financial cybercrime relies on social engineering, coercive urgency, or deceptive impersonation.  

The "Engineered Brain Freeze" Phenomenon: An investigation led by the Indian Institute of Technology (IIT) Madras across five major metropolitan centers revealed that highly educated individuals—including IT professionals, investment bankers, medical doctors, and public-sector officers holding formal cybersecurity certifications—regularly fall victim to scams. 

• Scammers target victims during acute personal stress (e.g., family illness, retirement, job transition), triggering an "engineered brain freeze" or "mind arrest" that overrides System 2 deliberative reasoning.  

India-Specific Exploitation Vectors: Fraudsters exploit widespread public trust in national digital infrastructure by deploying fake SEBI-registered trading apps, Aadhaar / UPI criminal linkage threats, and video-call-based "digital arrest" scams. 

 

What Structural And Regulatory Frameworks Secure India's Cyberspace?

Statutory Foundation: The Information Technology Act, 2000 (IT Act, 2000) penalizes identity theft under Section 66C, cheating by personation under Section 66D, and unauthorized data extraction under Section 43.

• The Payment and Settlement Systems Act, 2007 (PSS Act, 2007) empowers the RBI to mandate operational cybersecurity norms under Sections 10(2) and 18. 

Data Governance Standard: The Digital Personal Data Protection Act, 2023 (DPDPA, 2023) imposes strict data minimization and security obligations on data fiduciaries alongside severe financial breach penalties.

Sectoral Security Directives: The RBI Master Direction on Digital Payment Security Controls, 2021 mandates secure-by-design application architecture, two-factor authentication, and continuous vulnerability assessment. 

• The RBI Master Directions on Cyber Resilience, 2024 extends risk-based behavioral analytics, transaction velocity tracking, and mandatory 6-hour incident reporting to non-bank Payment System Operators.

What Challenges Hamper Cyber Fraud Mitigation?

Complexity in Distinguishing Negligence from Technical Breach: Determining whether credential disclosure resulted from user negligence or underlying malware/remote-access compromise requires deep forensic examination.

• Example: State Bank of India vs Hare Ram Singh (2026), the Delhi High Court ruled that disputes involving OTP authentication and net-banking credential compromise cannot automatically assume customer negligence without forensic scrutiny of system security integrity. 

Telecommunications Intermediary Negligence in SIM Swapping: Fraudsters bypass banking authentication by acquiring fraudulent duplicate SIM cards, exposing weak identity verification at telecom service provider outlets. 

• Example: Basaveshwara Pattana Sahakara Bank Niyamitha vs BSNL (2026), the Karnataka High Court held telecom operator BSNL liable for gross deficiency and directed ₹55 lakh compensation after unauthorized duplicate SIM issuance facilitated net-banking fraud.  

Sophisticated Cross-Border Laundering Through Mule Networks: Stolen proceeds are instantaneously funneled across multi-tiered mule bank accounts and transferred to offshore fraud factories in Southeast Asia, making post-transaction recovery nearly impossible.  

• Example: Enforcement Directorate Annual Report & NCRP Data (2025–2026), revealed over 1.51 lakh criminal linkages and organized fraud factories generating hundreds of crores through illegal online betting and investment syndicates, while recovery rates remained below 14%. 

Way Forward 

Enforce Exclusive Secure Domain Infrastructure: Transitioning financial institutions to verified domain namespaces eliminates website spoofing and phishing links.

• Example: RBI .bank.in Exclusive Domain Migration (Circular RBI/2025-26/28), mandated all regulated commercial and cooperative banks to migrate to IDRBT-administered .bank.in domains.

Implement Friction-Inducing Transaction Lags: Introducing time delays for high-value peer-to-peer transfers breaks the psychological control of fraudsters and enables user cancellation.  

• Example: RBI Lagged Credit Safeguard Proposal (Option 1, 2026), proposes a mandatory 1-hour delay for account-to-account transfers exceeding ₹10,000—a threshold capturing 45% of fraud volume and 98.5% of total fraud value—allowing cancellation during the critical "golden hour".  

Deploy Enhanced Authentication for Vulnerable Demographics: Establishing mandatory trusted secondary authenticators prevents high-value social engineering extortion targeting senior citizens.  

• Example: RBI Trusted Person Authentication Safeguard (Option 2, 2026), mandates secondary authentication by a designated trusted person for transfers above ₹50,000 initiated by citizens aged 70 years and above and Persons with Disabilities (PwD).

Pioneering AI-Driven Mule Detection and Real-Time Intelligence: Leveraging artificial intelligence and machine learning to scan transaction pipelines identifies anomalous account activity before execution.  

• Example: Reserve Bank Innovation Hub (RBIH) Mulehunter.AI & DPIP Prototype, deploys real-time risk scoring of beneficiary profiles prior to payment execution to freeze active mule accounts.  

Adopt Global Shared-Liability Frameworks: Distributing fraud losses across banks, telecom companies, and digital platforms incentivizes preventive system engineering.  

• Example: Singapore Shared Responsibility Framework (SRF) & UK Mandatory APP Reimbursement Model, enforces shared financial liability among telecom operators, digital platforms, and banks.

Conclusion

Securing Digital India demands transitioning from reactive victim-blaming to institutional shared liability, real-time AI threat intelligence, and behavioral payment safeguards to preserve public trust in financial inclusion.  

Source: THEHINDU