Mapping the Cybercrime Experience

Mapping the Cybercrime Experience

Perspectives of Victims and Experts

Public discourse on cybercrime often centres on statistics documenting the proliferation of such offences, particularly digital financial fraud. The focus is often on the scale of cybercrime and the monetary losses it causes to victims and the country as a whole. However, a crucial yet relatively underexplored dimension is the lived experience of those directly affected by these crimes. Amid the dominant technical and financial discourse around cybercrimes, there is an emerging need to examine the experiences of victims of both financial and non-financial cybercrimes. While the crime itself can have far-reaching consequences, the ordeal of navigating the legal system and other procedures in its aftermath is equally important to understand.

Against this backdrop, the Status of Policing in India Report 2026: Cybercrime—Victim Experiences and Systemic Responses examines cybercrime from the perspectives of those most directly affected—victims and the general public. To understand not only the nature and prevalence of cybercrime but also the preparedness of institutions to respond to it, the study combines a large-scale survey of the general public (presented in Chapters 3 to 9 of the report), with in-depth interviews with cybercrime victims and domain experts (presented in Chapters 1 and 2 of the report).

This article presents key findings and excerpts from the qualitative interviews and the focus group discussion (FGD) with cybercrime victims and experts. It draws on qualitative insights gathered through detailed one-on-one interviews and a FGD. It brings together findings from open-ended conversations with 37 respondents, including domain experts, cybercrime victims, individuals who assisted victims, and family members of people accused of cybercrime.

A detailed account of the findings is presented in Chapters 1 and 2 of the report.

Modus Operandi of Cybercrimes

• Cybercrime perpetrators rely heavily on “social engineering” to commit crimes, using deception, manipulation, coercion and threats to gain access to sensitive information or personal devices. Majority of the financial cybercrime victims interviewed unknowingly shared sensitive information or transferred money under threat or deception. Of the 13 financial cybercrime victims who were interviewed, only two claimed that their accounts were accessed/hacked without them sharing any information with a third party or without any known sources of data leaks.
• There are organised networks running both the financial and non-financial cybercrimes. Databases of leaked sensitive information are available for easy purchase, along with “kits” selling mule accounts and fake SIM cards.
• Many of the non-financial cybercrimes, such as cyberbullying, also function in a highly organised setup. The victims described coordinated networks operating multiple fake social media accounts operating from not just across the country, but also internationally. A sting operation conducted by a news agency found that the network relied on multiple “sleeper cells” operating across various locations, where members associated with the network would provide on-ground information.
• In most cases of Non-Consensual Intimate Image (NCII) abuse, such as revenge porn, morphed images and deepfakes, the perpetrator is someone known to the victim, according to experts.

Reporting of Cybercrime Cases

• Many cases of cybercrimes go unreported because of the social stigma and fear of public embarrassment, lack of trust in the authorities, lack of awareness about the redressal mechanisms and the feeling that the case will not be taken seriously by the authorities.
• In a few cases, victims are unwittingly made complicit in the crime, which inhibits reporting. A victim of a betting app fraud, who lost about Rs. 2.5 lakh, did not report the case to the police or any other authority since he had invited his friends and relatives to invest in the app, unaware that it was a fraud. He was afraid that he would also be implicated if he reached out to the authorities.
• Cybercrime experts noted that under-reporting is significantly more common in cases of non-financial cybercrimes, even though they are more pervasive. Cases of defamation, sextortion, impersonation, cyberbullying and NCII abuse are very rarely reported because of the reputational harm to the victim, the anonymity of the perpetrator and lack of adequate redressal mechanism.
• Victims and experts noted that the online police complaint mechanism was cumbersome to navigate and lack of clarity regarding the investigation that followed. Many did not receive any communication from the police other than an automated acknowledgement number.
• Victims also do not have clarity on the steps that should be taken by law enforcement after a complaint has been made on the portal. Of the 16 victims of cybercrimes that were interviewed, about half (nine) reported their case using the online portal or the centralised helpline number. While a majority of these victims got a call back after complaining online, in at least four of these cases, the victims did not receive any call back or update on their cases even after months, and in some cases, years.

Victims’ Experience with the Police

• Most of the victims who visited cyber police stations or units felt that the staff was polite and helpful. However, with victims from poor backgrounds, the police were reportedly rude, dismissive and abusive. One of the victims, son of a domestic worker, recalled the police being abusive towards him and his parents, and refusing to register an FIR.
• FIRs are not commonly registered in cybercrime cases. Of the 15 victims who complained to the police either online or in person, an FIR was registered in six cases. Two of these were automatic FIRs, and in at least two other cases, the victims reached out to persons of influence to get the FIR registered.
• An investigating officer (IO) from a cybercrime police station in Delhi informed the research team that of the approximately 15,000 cybercrime complaints registered in their jurisdiction in the previous year, just about 250 cases were converted into FIRs. He highlighted the lack of human resources and the non-investigative load on IOs as the primary reasons for the low conversion rate.
• Victims had no information about any investigation into the crime being done by the police. The police often cited jurisdiction problems and lack of coordination between state police departments as the primary deterrents against conclusive investigations.
• Victims of financial cybercrimes overwhelmingly felt that there was a lack of proper communication and coordination between the banks and the police. Several victims reported having to act as a liaison between the banks and the police and pass on relevant information from one institution to the other for timely action on their cases.
• In cases of online gender-based violence, experts highlighted the police apathy towards such crimes and their tendency to blame the victims. The focus of the police is often on “settling” the cases, urging victims to come to a compromise with the perpetrators.
• Amongst the ten respondents who rated their experience with the police, the average rating given to the police was 2.4 out of five.

Victims’ Experience with the Banks

• Victims of financial cybercrimes and experts overwhelmingly felt that the banks refused to take accountability, or assist the victim through the recovery process. Barring one case, in all other interviews with financial fraud victims, the banks maintained that the victims “collaborated” with the fraudster.
• In at least two cases of financial frauds interviewed, despite timely reporting by the victim, the banks were negligent in freezing their accounts promptly, which led to further loss to the victim.
• Five of the financial cybercrime victims were of the opinion that banks were complicit in cybercrimes. A few other pointed to the lack of data security and vigilance on the part of the bank, which made the customers vulnerable to cybercrime attacks. The interviewed cybercrime experts, retired and serving police officers, were also strongly of this opinion. Several respondents highlighted the common instances of data leaks in the banks which are not sufficiently addressed. These leaks, they said, are caused both due to inadequate security systems and the direct complicity of some banking officials.
• Amongst the six victims who rated their experience with the banks, the overall rating was a poor one out of five.

Victims’ Experience with the Courts

• Most victims described litigation as a long and uncertain process that requires significant time, financial resources and persistence. Out of the 16 cybercrime victims, only four victims employed legal representation and pursued litigation through the courts. A victim explained that pursuing a court case would involve paying lawyers, attending repeated hearings and spending additional money without any certainty of recovery.
• Older victims may experience additional vulnerabilities when engaging with complex legal and institutional systems. A senior citizen respondent described considerable difficulty navigating legal procedures and assessing the reliability of legal assistance.
• Victims who entered the judicial process consistently spoke about delays. Their frustration stemmed not simply from the passage of time, but from the absence of visible progress despite repeated hearings.

Case Outcomes

• Digital arrest cases: Amongst the three digital arrest victims interviewed, only one suffered an actual financial loss. The victim was able to register an FIR and 11-12 mule account holders linked to the racket were arrested. But he was unable to recover a majority of the amount lost. He recovered only Rs 5 lakh of the Rs 65 lakh lost.
• Other financial fraud cases: Of the ten respondents who lost money through financial frauds (other than digital arrest), five were able to recover a partial amount at either the bank level, or through court or RBI orders, and one was able to recover the full amount through their bank.
• Cyberbullying cases: The two cyberbullying victims interviewed approached a senior-level police officer through a personal connection. A complaint was taken, but FIR was not registered. The offensive social media content was taken down over a six-month period, but no further police investigation or action was taken.

Factors Influencing Case Outcomes

• Bribes to the police: Only one victim suspected that the police-appointed lawyer and the police pocketed the amount paid by him for a court order towards partial release of the lost money. Rest of the victims did not report having to pay any bribe to the police.
• Contacting persons of influence: In both financial as well as non-financial cybercrime cases, informal contacts with persons of influence played a major role in the case being taken seriously at various stages—registration of FIR, police investigation and action, complaint to the RBI ombudsman and recovery of money. Of the six financial fraud victims who recovered money partially or fully, three used personal connections, and one was a high net-worth individual who was assisted by the bank.

Impact of Cybercrimes

• Several victims described facing stress, trauma and depression due to the cybercrime and the complaints procedure that followed. One of the victims had a miscarriage. Another had to leave her profession and move to a different country. One of the victims, a senior citizen, lost financial autonomy and now relies on her children to withdraw cash and manage her financial dealings.
• For some of the victims, the trauma stems not only from the cybercrime incident, but also the mentally and physically taxing legal procedures that follow. A then-minor victim of sextortion reported facing lasting depression and trauma due to the police’s rude behaviour towards him and his family.

Accounts of Families of Accused and Others

• The study includes interviews with family members of two persons who have been accused in separate cases of cybercrimes. In one of the cases, the accused was approached by a bank official with an offer of a low-interest loan. An account was opened under his name in that regard, and unknown to him, was being used as a mule account for cybercrimes. In the other case, an 18-year-old was convinced by a co-worker to open a mule account and supply a fake SIM card in exchange for Rs 5,000 “now and then”. Both the accused were in prison at the time of the interviews.
• Three other respondents reported having their bank accounts frozen due to an on-going investigation, though they were not privy to the details of these cases. These respondents were neither victims nor accused, but had to liaison between the banks and the police to get access to their accounts.
• The three respondents whose bank accounts were frozen and the two accused persons were Muslim.