TRUST AND VULNERABILITY ONLINE

TRUST AND VULNERABILITY ONLINE

How Competent Are Our Institutions?

Chapter 9 of the SPIR 2026 unpacks vulnerabilities in digital trust, security, and privacy, while also identifying opportunities to strengthen the digital ecosystem. Easier digital transactions and other online financial services have empowered people. But it comes with routine encounters with scams, identity theft and privacy violations.

In such a context, effective redressal mechanisms have become essential. India has developed a range of institutional systems to address cybercrime, and these have expanded over time. It includes Indian Computer Emergency Response (CERT-In), Indian Cyber Crime Coordination Centre (I4C), National Cybercrime Reporting Portal (NCRP), and Cyber Crime Prevention against Women and Children (CCPWC) scheme. These bodies act on a spectrum of monitoring cybercrimes, co-ordinating amongst different agencies and providing funds for capacity-building and training of the personnel.

However, an important question is: Are these systems truly accessible and effective in practice? Cybercrime redressal mechanisms involve different stakeholders, including police, bank officials, judges and magistrates. While these mechanisms offer formal accessibility via helplines, portals, complaint registration processes and investigations, data shows that their functioning is uneven. Issues such as procedural complexities, significant delays, failures in timely account freezing, limited financial recovery, and, in some cases, reliance on personal networks to exert pressure on authorities continue to affect perceptions. Although the government aims to strengthen coordination through various mechanisms and address these gaps, only a small proportion of such cases reach courts, and even fewer are resolved. Such a condition reflects a clear gap between formal access to the redressal mechanism and citizens’ actual experience, which ends up shaping public evaluation of these institutions.

Against this background, we aimed to analyse public perceptions of the police, banks and courts and to assess whether they are perceived as capable enough to fight cybercrimes. In a similar vein, we examined the likelihood of citizens reporting cybercrime in the future. Also, how people assign responsibility for data protection – whether they view it as primarily the responsibility of individuals, or of governments and banks. Lastly, it seeks to understand what citizens expect from the government when it comes to ensuring digital safety in a risk-prone digital environment.

Institutional Capacity

The respondents were asked about their perceptions of how well equipped they think the police are to deal with financial cybercrimes. Overall, nearly three quarters (73 per cent) perceived the police to be either very well or somewhat equipped to handle financial cybercrimes. While over four in every ten (44 per cent) thought police are ‘somewhat equipped’, less than three in every ten (29 per cent) considered them very well equipped (Figure 12). On the other hand, about a quarter (24 per cent) reported that the police are not equipped to deal with financial cybercrimes Seventeen per cent said that the police are “not much equipped” and 7 per cent said they are “not at all equipped”.

We analysed and compared the perceptions of victims and those who aided the victim against the perceptions of those who were not victims of cybercrimes. It was found that victims were slightly less likely to believe that the police are well equipped to deal with cybercrimes. While 31 per cent of the respondents who were not victims of cybercrimes said that the police are well equipped to deal with financial cybercrimes, the proportion drops to 23 per cent amongst those who have been victims of cybercrimes or have aided the victims of cybercrimes. Simultaneously, victims and those who assisted cybercrime victims are relatively more likely to perceive that the police are not much equipped (21 per cent versus 15 per ent) and not at all equipped (10 per cent versus 6 per cent) to deal with financial cybercrimes compared to non-victims.

As seen above, victims are relatively less likely to believe that the police are well equipped to deal with financial cybercrimes. However, among the victims, those who complained to the police are slightly more likely to believe that the police are well equipped to deal with financial cybercrimes, compared to those who did not do so (Figure 13). This indicates that while the overall perceptions regarding police capacity to deal with cybercrimes is not very positive amongst the victims, there is a higher likelihood for those who engage with the police to have a more positive opinion about their capacity to deal with financial cybercrimes. However, the difference in these opinions is only marginal, and not very sharp.

Amongst those who complained to the police, a quarter of the respondents (25 per cent) were likely to report that the police are “well equipped”, compared to nearly one in five (18 per cent) among those who did not complain. Conversely, the perception that the police are “not at all equipped” is marginally higher among those who did not complain (12 per cent), compared to those who complained to the police (10 per cent) (Figure 13). These findings suggest that first-hand experience with police tends to have a slightly more favourable assessment of their competence.

Since bank officials, judges and magistrates, along with police personnel, have a role in the cybersecurity ecosystem, the respondents were asked about their perceptions of whether the police, banks, and judges/magistrates are trained to deal with cybercrimes. Over seven in ten respondents (72 per cent) report that the police are well-trained (combining ‘very much’ 36 per cent and ‘somewhat’ 36 Per cent).

At the broader level, perceptions about the police show a clear divide among the victims (including respondents who assisted victims) and non-victims. Non-victims (38 per cent) hold a more favourable view of the police than the victims (28 per cent), with a greater proportion citing them as “very well trained”. Victims (12 per cent), in turn, are relatively more likely to report that police are “not at all trained” to deal with cybercrime than the non-victims (8 per cent).

This pattern becomes more nuanced when the victims or those who assisted cybercrime victims are further disaggregated by whether they filed a complaint. Among those victims who complained to the police about the cybercrime, about one- third (32 per cent) reported that the police are very much trained’, as compared to about a quarter (22 per cent) who did not complain. While cybercrime victimisation appears to lower confidence in the police’s ability to deal with cybercrime relative to non-victims, engagement through complaint appears to partially restore it.

Broadly, a similar pattern is also observed when it comes to bank officials. Non-victims were more likely to report banks as ‘very much trained’ (27 per cent versus 22 per cent among victims), while victims were marginally more likely to view banks as ‘not at all trained’ (11 per cent versus 8 per cent among non- victims). However, among victims who separately complained to their bank, 26 per cent reported officials as very much trained, compared to 18 per cent among those who did not. This again shows a moderating effect of direct interaction with the institution.

The perception about the competence of judges or magistrates is also not very different. Non-victims (32 per cent) were more likely to view judges as ‘very much trained’ to deal with cybercrime compared to victims or those who assisted them (27 per cent). The latter group is also more inclined to perceive judges as not much trained (18 per cent versus 15 per cent) among non-victims. Among those whose cases reached court, 31 per cent of the victims said judges are very much trained, as opposed to 26 per cent of those whose cases did not go to court.

Likelihood of Reporting in the Future

Having examined perceptions about institutional police, bank officials and judges’ competence, it is equally important to understand how these experiences and perceptions translate into future behaviour. Specifically, whether victims or the general public would choose to report a cybercrime if they encountered one.

To understand future reporting behaviour, a scenario was presented to the respondents. They were asked about their likelihood of reporting a case of cybercrime to the police if they become a victim in the future. Approximately half the respondents (48 per cent) reported a high likelihood. Thirty-five per cent said they are somewhat likely”. Fourteen per cent say they are not likely to report in the future (11 per cent said “not much likely” and 3 per cent said “not at all likely”).

When the respondents are asked about their likelihood of reporting cybercrime to the police in the future, there is a notable variation across different socio-economic groups. The most economically advantaged groups show the highest likelihood (58 per cent) of reporting future instances as opposed to those belonging to the poor category (40 per cent), with a difference of 18 percentage points between the two groups.

Steps Towards Digital Safety

Studying people’s perceptions about who is responsible for data security and protection is important to hold institutions accountable. Responsibility for data protection is often shared between the individual and institutions, but how this balance is perceived by the public can influence people’s behaviour.

While individuals protect their own information through everyday practices like using strong passwords, verifying app permissions and staying alert to risks, government or financial institutions, on the other hand, are expected to create secure systems that enforce systematic regulations and ensure that people are informed about how their data is used and protected.

To understand this balance and how it shapes perceptions about data regulation, respondents were presented with two statements and asked which one they agreed with the most. The data indicates that perceptions are relatively divided, with nearly half (45 per cent) saying it is the responsibility of the individual to protect their data, whereas another half (51 per cent) thought it to be the responsibility of the government or the bank authorities to ensure data protection and build public awareness.

While understanding where people place the burden of responsibility for digital safety offers valuable insight into public expectations, it raises a follow-up question: What do citizens expect the government to do? To this end, the respondents were asked what the most important step the government authorities can take to ensure the citizens’ digital safety. The majority (34 per cent) said awareness campaigns on cybersecurity are the most important step that the government should undertake (Figure 14). This was followed by the need for the implementation of data protection regulations (18 per cent) and improving the effectiveness of cybercrime reporting portals (14 per cent). Only 7 per cent of the respondents felt that better training of cybersecurity personnel is the most important step that the government can undertake to ensure digital safety.

Conclusion

Trust in digital financial infrastructure has emerged as a significant factor. As perceived safety with online banking channels declines, the burden of responsibility shifts decidedly from the individual towards the state. In terms of what citizens want for their digital safety, awareness campaigns are the most important step cited by a third of the respondents. This is followed by the implementation of data protection regulations and the improvement of the effectiveness of cybercrime portals.

Taken together, these findings suggest that confidence in the cybercrime security ecosystem is not at its best. To ensure that, the focus should not only be on strengthening the capacity of institutions that respond to cybercrime, but also on public confidence in those institutions.