A new national report on cybercrime has found that fear of authority, mistrust in public institutions and misplaced confidence in digital payments are combining to make ordinary Indians more vulnerable to online fraud. The findings, released on Thursday by Lokniti-CSDS and Common Cause in the Status of Policing in India Report 2026: Cybercrime—Victim Perspectives and Systemic Responses, suggest that cybercrime in India is no longer simply a story of poor digital literacy. It is also a story of how people assess risk, whom they trust, and how weak institutional responses leave victims stranded after the money is gone.
The report builds on earlier editions that examined public trust in police and lived experiences with law enforcement. This latest edition looks closely at the methods used by cybercriminals, the everyday digital habits that expose citizens to fraud, and the preparedness of police and banks to respond when complaints are filed. Its conclusions are drawn from a survey across 16 Indian states involving 8,306 respondents, along with one-on-one interviews and focus group discussions with 37 cybercrime experts, victims and family members of those accused.
One of the report's more striking findings is that lack of digital exposure is not the only factor behind victimisation. A significant number of cybercrime victims, it says, are people who believe digital modes of payment are safer than other forms of transaction. That confidence, the report suggests, can be exploited by criminals who use deception, urgency and impersonation to push victims into handing over sensitive information or authorising transfers.
At the launch, digital rights activist and Medianama founder Nikhil Pahwa warned that public data itself has become a vulnerability. He described an experiment in which he asked artificial intelligence to scan publicly available voters' data released by the Election Commission of India. According to him, the system was able to identify people with the same name, map family relationships, locate residences and even infer neighbourhood connections, producing what he called "relationship graphs" of individuals.
"I asked AI to scan the publically available voters' data. It could tell there are 20 voters in India with the same name as mine, 12 in my own state, who my parents and relatives were, where I lived, who were my neighbours and give it to me in the form of 'relationship graphs' of each person, like nodes of a wider network," Pahwa said. He argued that such data is not only falling into the hands of cybercriminals but is also helping the state build a surveillance structure, including the recording of private data of children.
Retired IPS officer and cyber security expert Sanjay Sahay said the social conditions around policing are also part of the problem. He argued that people's fear of authority and deep distrust of public governance make them easier targets for scams such as digital arrest frauds, where criminals impersonate officials and pressure victims into compliance.
"People are more afraid of what authority can do rather than what they can deliver," Sahay said, capturing a central tension identified by the report: victims often hesitate, delay reporting or comply with fake demands because the impersonated authority feels more threatening than the possibility of fraud.
Radhika Jha, lead researcher of the SPIR series, said cybercrime gangs rely heavily on social engineering — the manipulation of trust rather than technical hacking alone. In some cases, she said, criminals use coercion and threats to gain access to devices or sensitive information. She also described the networks as highly organised, with both financial and non-financial crimes operating alongside the trade in leaked data, mule accounts and fake SIM cards that function as ready-made kits for fraud.
The report is especially critical of the response system after a crime occurs. It says there is no effective mechanism to hold banks accountable in cybercrime cases. About three out of four victims, or 72%, could not recover any of their lost money. Only one in ten victims managed to recover the full amount. The report also found that victims are less likely than non-victims to believe police are equipped to handle cybercrime: only 23% of financial cybercrime victims said police were well prepared, compared with 31% of non-victims.
Dr. Ranjana Kumari, director of the Centre for Social Research, said women and rural victims face additional barriers, including difficulty accessing police stations, getting FIRs registered and allegations of bribe demands by police. She called for digital awareness to begin in childhood and urged educated women to come forward and report such crimes. She also said banks, institutions and major digital companies must be forced to take responsibility for the harms that unfold on their platforms.
Taken together, the report and the remarks at its launch paint a troubling picture of India's cybercrime landscape: one in which criminals exploit trust, institutions fail to respond quickly enough, and victims often discover that the systems meant to protect them are the least reliable part of the chain. As digital payments deepen across the country, the report argues, the real challenge is not just teaching people to use technology, but building a system worthy of their trust.