Online fraud in India: types, where to report and what the law says

What online fraud means

Online fraud is deception carried out through the internet or a phone in order to take money, data or access from a victim. The older phrase internet fraud means the same thing, and the term online frauds is used for the whole family of cases, so a search for online frauds in India returns the same ground that this page covers. What they have in common is a false statement or a false identity: the victim is persuaded that a message, a call or a page is genuine and acts on it.

The law treats the conduct in two ways at once. The Information Technology Act 2000 contains offences written for exactly these cases, and the general criminal law punishes cheating in whatever medium it is done. The sections that matter are explained in the guide to the IT Act 2000. The wider picture of how these offences are recorded and why they are hard to investigate is in the page on cyber crime in India.

Common types of online fraud

The patterns change quickly, but a small number of types account for most of what is reported. The table describes six of them in general terms.

Two features recur. The offender creates urgency, with a deadline, a threat to block an account or an offer that will vanish, so that the victim acts before thinking. And the offender needs the victim to do the last step, whether that is entering a code, approving a request or typing a password into a copied page. Because the victim performs the final act, the fraud depends on persuasion more than on any technical weakness, and it is the reason that awareness is the main defence. A bank or a payment provider can add warnings and limits, but it cannot stop a customer who has been convinced to authorise the payment, which is why the same fraud is so often repeated against many people with only small changes in the story.

Online fraud in numbers

The National Crime Records Bureau counts cyber crimes involving fraud under a separate head. The all-India figures given by the Ministry of Home Affairs in a reply to Parliament are in the table.

The number rose by about a third between 2020 and 2021 and by about a quarter between 2021 and 2022, and 2022 was 68 per cent above 2020. The distribution between States is very uneven. In 2022 Telangana registered 9,581 of the 17,470 cases, more than half the national figure, and the next two States, Maharashtra and Bihar, registered 2,202 and 1,441.

The official data also breaks the 2022 total down by kind. Of the 17,470 cases, 6,491 were online banking frauds, 2,910 were one-time password frauds, 1,690 involved ATMs, 1,665 involved credit or debit cards, and 4,714 were recorded under other fraud. Online banking fraud and one-time password fraud together make up more than half of the total, which is consistent with the pattern described above, in which the victim is persuaded to authorise the payment.

A figure like this measures registered cases, not victims. A State that registers a very large number of fraud cases may do so because its police convert complaints into cases more readily, and the table should not be read as a ranking of how dangerous a State is. The latest year in the series published at the time of the ministry’s reply was 2022, so the statistics describe an earlier period than the present.

What the law says about online fraud

Two sections of the Information Technology Act 2000 deal with the core conduct. Section 66D punishes whoever, by means of any communication device or computer resource, cheats by personation, with imprisonment of either description for a term which may extend to three years and a fine which may extend to Rs 1 lakh. Section 66C punishes whoever fraudulently or dishonestly makes use of the electronic signature, password or any other unique identification feature of any other person, with imprisonment of either description up to three years and a fine up to Rs 1 lakh. A phishing page that collects a password and then uses it to empty an account is a typical case that engages both.

Where the offender gains access to an account or system without permission, section 66 applies as well, since it punishes a person who dishonestly or fraudulently does any act listed in section 43. In practice a charge sheet may name two or three IT Act sections together with the general offence of cheating. Under section 78 of the Act, the investigation is carried out by a police officer not below the rank of Inspector. Which section the police finally invoke is a matter for the investigating officer and the court, and this page describes the provisions, not the outcome of any case.

Where to report online fraud

Anyone asking where to report online fraud has three routes, and they are not alternatives: the quickest and the most complete use all of them. First, the National Cyber Crime Reporting Portal at cybercrime.gov.in, launched under the Indian Cyber Crime Coordination Centre so that the public can report all types of cyber crime. An incident reported there is handled by the State or Union Territory police as the law provides, which includes conversion into an FIR. Second, the toll-free helpline 1930, which was set up to give assistance in lodging online cyber complaints. Third, the bank or payment provider whose system carried the money, which has to be told at once so that it can act on its side.

Speed is the central point where money has been taken. The Citizen Financial Cyber Fraud Reporting and Management System, launched in 2021 under the Indian Cyber Crime Coordination Centre, exists for the immediate reporting of financial frauds so as to stop the siphoning of funds. The Ministry of Home Affairs stated in March 2025 that more than Rs 4,386 crore had been saved in more than 13.36 lakh complaints. The figure shows that early reporting is worth doing, and it is the reason that a delay of a day or two can decide whether money is recovered. Where to report online fraud is therefore a practical question with a time limit attached. The steps are set out on a separate page on how to file a cyber crime complaint online.

The first hour after an online fraud

The order of actions matters more than any one of them. The first call goes to the bank or payment provider, to block the card or the account and to tell it which transaction was fraudulent, because the money is still in the system for a short time. The second is to report on the helpline 1930 or on the national portal, so that a complaint exists in the system that is designed to follow the money. The third is to secure what is left: change the passwords of the accounts that may have been exposed, starting with e-mail, and remove access that the offender may have obtained, such as an app that was installed on request.

Only after those steps should the person assemble the evidence described below and file the fuller complaint. A victim who spends the first hour searching for the best way to write the complaint may lose the window in which the funds could be stopped. Where a person is unsure which step comes first, the answer is the one that stops the loss.

What happens after a report

A report on the national portal is not itself the investigation. The Ministry of Home Affairs describes the portal as the channel through which incidents are reported, and says that their conversion into FIRs and the action that follows are handled by the State or Union Territory law enforcement agency concerned, as the law provides. The complainant should therefore expect to be contacted by the local police, to give a statement and to produce the evidence kept. The police may ask the bank to hold funds and may seek records from the platforms involved, and the speed of those steps varies.

It helps to know what the official data does not show. The National Crime Records Bureau does not keep separate data on complaints from particular groups, such as elderly people, and its published tables count cases registered, not the amounts lost. Anyone who wants to understand the size of the problem for a particular group should therefore treat the official series as a partial picture. The report to Parliament on steps taken lists the central measures, the portal, the helpline and the financial fraud reporting system, but it does not give a recovery rate for fraud cases, and no such rate is claimed here.

What to keep when reporting online fraud

A report is stronger when it comes with the facts an investigator needs. Screenshots of every message, the exact web address of any fake page, the phone numbers and account numbers used, the transaction reference numbers and the times of calls should be saved before anything is deleted. The device used should not be wiped or reset. Evidence of this kind is digital and fragile, which is why the handling of it is described in the page on computer forensics. A person who has lost money should also keep the bank statement that shows the transaction.

Practical protection is mostly a matter of habits. A genuine bank does not ask for a one-time password or a password over the phone. A payment request is not a way of receiving money. A link received in a message should be checked by going to the service directly. And a call that demands immediate action should be ended and checked through a number the person already knows. The decisions of the courts on these offences are gathered under case reports.

Frequently asked questions