The State of Cybercrime in India: Trends and Challenges

From a morning phone call that turns out to be a fake bank executive, to an entire hospital’s computer system being held hostage for ransom, the face of crime in India has changed dramatically. Digital crime is no longer a niche worry for IT professionals. It is a mainstream issue that touches students, homemakers, small business owners, senior citizens, and even premier institutions. And if the numbers from recent years are anything to go by, the problem is only getting bigger.

A sharp rise that cannot be ignored
The many faces of cybercrime
Financial fraud and online scams
Sexual exploitation and online harassment
Defamation and identity theft
Hacking, ransomware, and data breaches
Why India is so vulnerable
Rapid economic and technological growth
The world’s largest base of new internet users
The professionalisation of cybercriminals
Cross-border complications
The legal framework: strong on paper
Where enforcement struggles
High-profile cases that shook public confidence
The awareness gap
The road ahead

A sharp rise that cannot be ignored

Cybercrime in India has been climbing steeply for the better part of a decade. According to early National Crime Records Bureau (NCRB) data, registered cases shot up by 63.5% in 2019, marking one of the first warning signs that digital offences were outpacing almost every other category of crime. That trend has not slowed down.

More recent NCRB figures tell an equally stark story. Cybercrime cases rose from over 52,000 in 2021 to more than 86,000 in 2023, an addition of over 33,000 cases in just two years. The 2023 Crime in India report flagged cybercrime as the category with the sharpest spike, rising 31.2% in a single year, largely driven by cheating through personation and offences under the IT Act.

What makes these numbers more worrying is that they represent only reported cases. A huge number of victims never file complaints because they feel embarrassed, unsure of where to go, or convinced that nothing will come of it. The real volume of digital crime is almost certainly much larger than any official dataset suggests.

The many faces of cybercrime

Cybercrime is an umbrella term. Underneath it sits a long list of offences, each with its own motive, method, and victim profile. Understanding these categories helps explain why the problem has become so difficult to contain.

Financial fraud and online scams

Financial fraud is by far the most common form of cybercrime today. This includes UPI scams, online banking frauds, and crypto-related cheating. Criminals often impersonate bank officials, delivery agents, or government staff to trick victims into sharing OTPs, CVVs, or login credentials. The scale is staggering. Through the Citizen Financial Cyber Fraud Reporting and Management System, more than Rs. 8,189 crore has been saved across over 23.61 lakh complaints up to 31 December 2025. The amount saved gives a sense of how much money criminals actively try to siphon off every single day.

Sexual exploitation and online harassment

A disturbing chunk of cybercrime involves sexual offences. This includes sextortion, where cybercriminals threaten to release private images or videos unless the victim pays up or provides further sexual favours. It also covers cyberstalking, morphed images being circulated, and the creation of fake profiles to defame. Minors are particularly vulnerable, and provisions under the POCSO Act are frequently invoked alongside IT Act sections in such cases.

Defamation and identity theft

Digital defamation has exploded alongside social media use. A single tweet, reel, or WhatsApp forward can destroy reputations within hours. Closely linked is identity theft, where a person’s personal information is stolen and misused to cause financial or reputational damage, often through phishing and spam. Fake social media profiles set up to harass or defame someone fall under this broader category.

Hacking, ransomware, and data breaches

These are crimes targeting systems rather than individuals, though the damage still hits people hard. Hackers break into servers, steal corporate or government data, and sometimes lock down entire networks until a ransom is paid. The 2016 Zomato data breach, where sensitive user data was stolen, was prosecuted under Section 66 (hacking) and Section 72A (disclosure of personal information without consent) of the IT Act.

Why India is so vulnerable

The reasons behind this surge are not mysterious. They reflect the country’s digital leap and the gaps that have come with it.

Rapid economic and technological growth

India is undergoing one of the largest digital transformations in human history. UPI, Aadhaar-linked services, digital banking, e-commerce, and streaming platforms have become part of everyday life. More transactions online mean more opportunities for fraud.

The world’s largest base of new internet users

India has over 800 million internet users, many of whom are first-time users with low digital literacy. A senior citizen navigating UPI for the first time, a farmer using WhatsApp to sell produce, a teenager setting up an Instagram account – each is a potential target simply because cybersecurity habits have not kept up with connectivity.

The professionalisation of cybercriminals

Cybercrime today is not about lone hackers in basements. It is an industry. Criminals now rent hacking tools, phishing kits, and botnets, enabling targeted vishing and smishing attacks using leaked personal data. Call-centre-style operations in certain districts run organised scam networks that target victims across the country and overseas.

Cross-border complications

A fraud committed against a Mumbai resident might be orchestrated from Southeast Asia, routed through servers in Eastern Europe, and cashed out in a third country. Jurisdictional hurdles slow down investigation, and mutual legal assistance between countries is often painfully slow.

The legal framework: strong on paper

India does not lack laws when it comes to cybercrime. The Information Technology Act, 2000, along with its 2008 amendment, forms the backbone of the legal response. Key provisions include Section 66 for computer-related offences, Section 66C for identity theft, Section 66D for cheating by personation using computer resources, Section 66F for cyber terrorism, and Section 67 for publishing obscene material electronically.

The Indian Penal Code (now being replaced by the Bharatiya Nyaya Sanhita) also plays a supporting role. Sections on cheating (420), forgery (463-471), defamation (500), and criminal intimidation (503) are regularly applied alongside IT Act provisions.

On the institutional side, the government has built a dedicated ecosystem. The Indian Cyber Crime Coordination Centre (I4C), set up by the Ministry of Home Affairs, acts as the national nodal point. It runs the National Cyber Crime Reporting Portal (cybercrime.gov.in) and the helpline number 1930 for reporting financial cyber fraud. The Cyber Fraud Mitigation Centre brings banks, telecom operators, and law enforcement onto a single platform for rapid response.

Where enforcement struggles

Despite this architecture, enforcement remains the weak link. NCRB data for 2022 showed that the conviction rate in cybercrime cases stood at just 31.1%. That means roughly two out of three cases that do reach court fail to secure a conviction.

Several factors explain this. Many local police stations still lack the technical training to investigate digital evidence. Forensic laboratories are overburdened. Victims often delete messages or reformat their devices before a complaint is filed, destroying vital evidence. And because cybercriminals operate across state and national boundaries, co-ordination across jurisdictions is a constant bottleneck.

High-profile cases that shook public confidence

Some incidents have forced the country to pay attention. The AIIMS ransomware attack of November 2022 is perhaps the most well-known. On 23 November 2022, the premier medical institute in the country was crippled by a major cyberattack that brought down servers and the eHospital network, forcing emergency, OPD, in-patient, and laboratory services to shift to manual management. Attackers reportedly demanded around Rs. 200 crore in cryptocurrency. Investigators invoked Section 66F of the IT Amendment Act, treating it as cyber terrorism.

A follow-up investigation by global cybersecurity firms later suggested the attack was linked to an Advanced Persistent Threat group called ChamelGang, which operates in regions of strategic interest to China. The incident exposed how even the country’s most prestigious institutions could be brought to a halt by a single breach.

The AIIMS episode was not isolated. The Indian Council of Medical Research faced thousands of brute-force attempts shortly after. Banks, too, have been under steady attack. Parliamentary data revealed that between June 2018 and March 2022, Indian banks recorded 248 successful data breaches by hackers and criminals, with the majority affecting private sector banks.

The awareness gap

Laws and task forces can only go so far. The biggest vulnerability in India’s digital ecosystem is not technical – it is human. People still click on suspicious links, share OTPs over phone calls, download unverified apps, and store passwords in notes apps. Cyber hygiene simply is not taught widely enough, in schools, workplaces, or community spaces.

The I4C has been running awareness drives through the CyberDost social media handles, radio campaigns, and cinema halls. These efforts are important, but they need to reach deeper into semi-urban and rural regions where first-time internet users are most exposed.

The road ahead

Fixing cybercrime in India is not a one-step problem. It needs simultaneous progress on several fronts. The legal framework must evolve to address emerging threats like deepfakes, AI-powered phishing, and cryptocurrency-enabled fraud. Police forces need specialised cyber cells in every district, not just in metros. Judicial capacity must grow so that cases are disposed of quickly enough to serve as real deterrents. And most importantly, every citizen needs basic digital literacy, the same way we teach road safety.

The Digital Personal Data Protection Act, 2023 is a step forward on the data protection side, but its real test will be in implementation. Similarly, agreements like the MoU signed between I4C and the US Department of Homeland Security in January 2025 for cooperation in cybercrime investigations show that international collaboration is finally being taken seriously.

What do you think? If you had to design a cyber-safety lesson for a first-time internet user in your own family, which three habits would you insist they build first? And do you believe stricter laws alone can fix this problem, or is community-level awareness the missing piece that no government scheme can replace?

References

PDF 📄

Table of Contents

A sharp rise that cannot be ignored 🔗

The many faces of cybercrime 🔗

Financial fraud and online scams 🔗

Sexual exploitation and online harassment 🔗

Defamation and identity theft 🔗

Hacking, ransomware, and data breaches 🔗

Why India is so vulnerable 🔗

Rapid economic and technological growth 🔗

The world’s largest base of new internet users 🔗

The professionalisation of cybercriminals 🔗

Cross-border complications 🔗

The legal framework: strong on paper 🔗

Where enforcement struggles 🔗

High-profile cases that shook public confidence 🔗

The awareness gap 🔗

The road ahead 🔗