Authored By: Ronak Sharma
Asian Law College
Introduction
Most of us now do our banking on a phone screen. Bills get paid over UPI, loans get approved through an app, and shopping happens without ever touching cash. That shift has made life easier in a hundred small ways, but it has also given fraudsters an entirely new playground. Phishing calls, fake banking apps, bogus investment schemes, SIM-swap attacks, stolen login credentials — these aren’t rare occurrences anymore, they’re routine. And the people caught out by them are rarely careless in any meaningful sense. They’re just up against scams that have gotten far more convincing than most people expect.
This article makes the case that Indian law on digital fraud isn’t broken, exactly, but it is patchy, and it mostly reacts after the fact rather than getting ahead of the problem. Victims usually find that the law can punish a fraudster once caught, but it does very little to stop the fraud in progress or to get stolen money back in time. The fix probably isn’t a brand-new statute. It’s tighter coordination between the laws, regulators, and enforcement bodies that already exist, paired with preventive safeguards rather than remedies that only switch on once the damage is done.
The Legal Framework as It Stands
There’s no single law that governs digital fraud in India. Instead, it’s handled through a combination of criminal statutes, banking regulation, and consumer protection law. The Information Technology Act, 2000[1] criminalises unauthorised access to computer systems, identity theft, and cheating by personation carried out online. In practice, this is the go-to statute whenever someone loses money to a fraudulent website, a cloned banking app, or credentials that were tricked out of them.
The Bharatiya Nyaya Sanhita, 2023[2] covers what the IT Act doesn’t, penalising cheating, criminal breach of trust, forgery, and dishonest inducement of property — offences that show up again and again in fraud cases, whether it’s a fake investment platform or a predatory loan app. In most prosecutions, both statutes get invoked together rather than one being treated as sufficient on its own.
The Reserve Bank of India has its own way of addressing the problem, though it works through regulation rather than criminal punishment. Its Master Direction on Digital Payment Security Controls[3] requires banks and payment providers to run fraud-monitoring systems, enforce multi-factor authentication, and flag suspicious transactions. Given how often digital fraud comes down to stolen banking credentials or leaked financial data, this regulatory layer ends up doing a lot of the real protective work, even though it was never built as a criminal enforcement tool.
Put together, these laws aren’t nothing — they offer genuine protection. But most of them were written before fraud became this automated, this AI-assisted. Voice-cloning scams and mass phishing campaigns weren’t really on anyone’s radar when these provisions were drafted. The result is a framework that copes reasonably well with older, simpler forms of fraud, but starts to strain when the fraud gets newer and faster.
Where the System Comes Up Short
Jurisdiction is the first real obstacle. Fraud rings hardly ever operate out of one traceable location. They deliberately route their activity through VPNs, mule accounts, and servers based abroad, precisely to make tracing them harder. Because Indian policing is organised state by state, getting one coherent investigation moving across several jurisdictions takes time — and stolen money doesn’t sit around waiting for that process to catch up.
Speed is the second problem, and arguably the more damaging one. Once a fraudster gets into an account, the money can move through several intermediary accounts within minutes. By the time a victim even notices the loss, let alone reports it, recovery is often already close to impossible. However well drafted, legal remedies tend to activate only after the harm has already occurred — they’re designed to punish, not to intercept.
There’s also a real imbalance in who gets targeted. Elderly users and people newer to digital financial services bear the brunt of it, mostly because they’re less familiar with what a phishing call or a suspicious link looks like. The Consumer Protection Act, 2019 does recognise unfair trade practices and provides a route for grievance redressal, but its machinery simply wasn’t designed for the urgency an active, ongoing fraud actually demands.
Then there’s the practical problem of freezing money quickly enough for it to matter. The National Cyber Crime Reporting Portal is a genuine step forward compared to what existed before, and victims can now report incidents through it. But there’s still no fast, standardised protocol between banks for freezing a suspect account — particularly once the funds have been split across several accounts or converted into cryptocurrency. Every hour lost makes recovery that much less likely.
What Would Actually Help
India probably doesn’t need more law so much as better-connected law. A more coordinated framework would streamline cooperation between cybercrime cells across states, set firm deadlines for freezing suspect accounts, and lay down penalties specific to phishing, identity theft, fraudulent digital lending, and cryptocurrency scams — rather than folding all of it into general cheating provisions after the fact.
Banks and payment intermediaries have a part to play as well. Real-time fraud detection, along with faster mechanisms for flagging and reversing unauthorised transactions, would narrow the gap between when a fraud happens and when it actually gets caught. Public awareness matters just as much as the technology — an informed user is still the first and often best line of defence. The Reserve Bank’s Working Group on Digital Lending[4] has already called for tighter oversight of unregulated lending apps, which suggests the regulator sees this coming even where legislative reform has been slower to follow.
Investigators need training that actually keeps pace with the crime itself. Financial forensics, blockchain tracing, and digital evidence collection can’t stay specialist skills held by a handful of officers — they need to become standard competencies across cybercrime units generally.
None of this works in isolation, though. Digital fraud crosses borders constantly, through offshore servers, foreign-registered platforms, and anonymous intermediaries, so international cooperation and mutual legal assistance treaties will end up mattering just as much as anything India does within its own borders.
Conclusion
Digital fraud isn’t some niche concern sitting at the margins of India’s criminal justice system — it’s one of the more persistent, fastest-moving problems the system currently faces. The Information Technology Act, the Bharatiya Nyaya Sanhita, and the Reserve Bank’s regulatory directions together do offer real, usable remedies. But none of them were built with the speed or the cross-border reach of modern fraud in mind. What’s still missing — coordination between agencies, timely recovery of stolen funds, and protection for vulnerable users before the fraud happens rather than after — is exactly what matters most to the people actually affected by it.
A more joined-up legal framework, stronger technological safeguards, real accountability for financial institutions, and sharper investigative capacity would put India in a considerably better position to deal with this threat. As digital financial services keep expanding, the law can’t afford to trail too far behind — not if it wants to protect consumers, keep trust in digital payments intact, and hold onto public confidence in the financial system more broadly.
Bibliography
Legislation
Bharatiya Nyaya Sanhita 2023.
Consumer Protection Act 2019.
Information Technology Act 2000.
Cases
Justice KS Puttaswamy (Retd) v Union of India (2017) 10 SCC 1.
Government and Regulatory Documents
Reserve Bank of India, Master Direction on Digital Payment Security Controls (2021).
Reserve Bank of India, Report of the Working Group on Digital Lending (2021).
Books
Avtar Singh, Introduction to Cyber Law (4th edn, Lexis Nexis 2023).
Journal Articles
Apar Gupta, ‘Digital Fraud, Financial Technology and the Future of Indian Cyber Law’ (2024) Indian Journal of Law and Technology.
[1]Information Technology Act 2000, ss 43, 66, 66C and 66D.
[2]Bharatiya Nyaya Sanhita 2023, ss 316, 318, 336 and 338.
[3]Reserve Bank of India, Master Direction on Digital Payment Security Controls (2021).
[4]Reserve Bank of India, Report of the Working Group on Digital Lending (2021).
