Definition — Cyber Fraud: Cyber fraud encompasses any fraudulent activity that uses a computer, network, or digital device as a tool, target, or means of perpetration. In the Indian legal context, cyber fraud includes offences such as phishing, vishing, identity theft, ransomware attacks, CEO fraud (business email compromise), UPI fraud, net banking fraud, credit/debit card fraud through skimming or cloning, cryptojacking, and fraudulent online transactions. These offences are prosecutable under the IT Act, 2000, the IPC/BNS, and, where proceeds of crime are involved, the PMLA, 2002.
Definition — Digital Evidence (Section 65B): Digital evidence, also termed electronic record under the IT Act, is any information stored or transmitted in electronic form that is relevant to a case. Under Section 65B of the Indian Evidence Act (Section 63 BSA), electronic records — including emails, server logs, CCTV footage, database extracts, social media posts, and mobile phone data — are admissible as evidence only when accompanied by a certificate issued by a person occupying a responsible position, confirming that the electronic record was produced by a computer during regular use, the information was regularly fed into the computer, the computer was operating properly, and the contents of the electronic record reproduce the information fed into the computer.
The legal framework for addressing cyber fraud in India rests on multiple statutes that work in conjunction. Understanding this layered framework is essential for both investigation and prosecution.
The IT Act is the primary legislation governing cyberspace in India. The key provisions relevant to cyber fraud are:
In addition to the IT Act, several IPC provisions (now corresponding BNS provisions for offences committed after 1 July 2024) apply to cyber fraud:
The Reserve Bank of India has issued comprehensive guidelines on cybersecurity for banks, including the Cyber Security Framework for Banks (2016), guidelines on electronic banking transactions, and the framework for limiting liability of customers in unauthorised electronic banking transactions. Under the RBI’s customer liability framework, the customer’s liability in cases of unauthorised transactions depends on who reported the fraud and the time taken to report — if the customer reports within three working days, the customer’s liability is zero (for third-party breaches).
Based on our forensic investigation practice, the most prevalent types of cyber fraud in India include:
In BEC fraud, the attacker gains access to (or spoofs) a senior executive’s email account and sends instructions to the finance team to transfer funds to a fraudulent account. The emails are carefully crafted to appear legitimate, often mimicking the executive’s writing style and referencing ongoing transactions. BEC fraud has caused losses of hundreds of crores to Indian companies. Our investigations typically involve email header analysis, IP address tracing, and fund flow tracking.
Phishing involves fraudulent emails, SMS messages, or websites that trick victims into revealing sensitive information (login credentials, OTPs, card details). Vishing is the voice-based variant, where fraudsters impersonate bank officials or government authorities over phone calls. These methods are the entry point for a vast majority of individual-level cyber frauds in India.
With the explosive growth of UPI transactions in India, UPI-related fraud has surged. Common methods include fraudulent collect requests (where the victim unknowingly approves a debit), QR code scams (where a malicious QR code initiates a debit instead of a credit), and SIM swap fraud (where the attacker takes over the victim’s mobile number to intercept OTPs).
Ransomware attacks encrypt an organisation’s data and demand payment (typically in cryptocurrency) for the decryption key. Indian businesses, hospitals, and government agencies have been targeted. The forensic investigation involves identifying the attack vector (often a phishing email or unpatched vulnerability), determining the extent of data compromise, and tracing any ransom payments.
Fraudulent investment platforms — offering unrealistic returns on stock trading, forex, or cryptocurrency — have proliferated online. Victims are lured through social media advertisements, messaging apps, and fake testimonials. The forensic investigation involves analysing the platform’s architecture, tracing fund flows, and identifying the persons behind the operation.
This includes fraudulent sellers on e-commerce platforms, fake product listings, and payment manipulation. It also includes refund fraud, where fraudsters exploit return policies using counterfeit products.
Section 65B of the Indian Evidence Act, 1872 (now Section 63 of the Bharatiya Sakshya Adhiniyam, 2023) is the cornerstone provision for the admissibility of digital evidence in Indian courts. Every forensic investigator and legal practitioner must have a thorough understanding of this provision.
Under Section 65B(2), electronic evidence is admissible if:
Critically, under Section 65B(4), the electronic record must be accompanied by a certificate that:
The Supreme Court has addressed the requirement of the Section 65B certificate in several landmark decisions:
In our forensic practice, we ensure that all digital evidence collected during an investigation is accompanied by a properly drafted Section 65B certificate, prepared in coordination with the IT personnel responsible for the relevant systems. For more on our forensic capabilities, visit our forensic accounting page.
Our approach to cyber fraud investigation follows a structured methodology designed to ensure thoroughness, evidentiary integrity, and compliance with legal requirements.
Upon engagement, we conduct an initial assessment to understand the nature and extent of the cyber fraud. This involves interviewing the affected persons, reviewing available logs and records, understanding the IT infrastructure, and defining the scope of the investigation. We work closely with the client’s IT team and legal counsel to ensure alignment on objectives and legal constraints.
This is the most technically critical phase. Digital evidence must be acquired in a forensically sound manner to ensure its admissibility in court. Key principles include:
The analysis phase involves examining the acquired evidence to reconstruct the fraud, identify the perpetrators, and quantify the loss. Common analytical techniques include:
The investigation culminates in a comprehensive forensic report that documents the methodology, findings, and evidence. The report is prepared with the understanding that it may be presented in court proceedings, and all findings are supported by documentary and digital evidence. We also assist clients in filing FIRs with the cybercrime police, complaints with the Cyber Crime Investigation Cell, and notifications to the Indian Computer Emergency Response Team (CERT-In) where required.
Victims of cyber fraud have several avenues for reporting and seeking redress:
The Ministry of Home Affairs operates the National Cyber Crime Reporting Portal (cybercrime.gov.in), where victims can file online complaints. Financial cyber fraud complaints filed through this portal are routed through the Indian Cyber Crime Coordination Centre (I4C) to the relevant bank for immediate fund freezing.
Most states have dedicated Cybercrime Police Stations or Cyber Crime Investigation Cells. An FIR can be filed at the nearest cybercrime police station or at the jurisdictional police station under the relevant provisions of the IT Act and IPC/BNS.
Under the IT Act, certain cyber security incidents must be reported to CERT-In within six hours of detection. These include targeted scanning or probing, compromise of critical systems, data breaches, and ransomware attacks.
For cyber fraud involving banking transactions, a complaint should be filed with the bank immediately (within the timeframe specified by the RBI for zero liability protection). If the bank does not resolve the complaint, the customer can escalate to the RBI’s Banking Ombudsman.
For practical guidance on corporate fraud detection, see our article on employee fraud detection and prevention in Indian SMEs and our guide on forensic audit process and methodology.
While investigation is necessary after a cyber fraud occurs, prevention remains the most effective strategy. We advise our clients to implement the following measures:
Implement MFA for all critical systems — email, banking, ERP, and cloud services. MFA significantly reduces the risk of account takeover, which is the entry point for most BEC and phishing attacks.
Conduct regular cyber awareness training, including simulated phishing exercises. Employees — particularly those in finance, HR, and IT — are the first line of defence against social engineering attacks.
Establish independent verification protocols for all significant fund transfers. Any change in beneficiary account details must be verified through a call-back to a known number (not the number provided in the email). This simple measure can prevent most BEC fraud losses.
Develop and periodically test a cyber incident response plan that defines roles, responsibilities, communication channels, and escalation procedures. Quick response in the first few hours after a cyber fraud can significantly increase the chances of fund recovery.
Conduct regular vulnerability assessments and ensure timely patching of known vulnerabilities. Many ransomware attacks exploit known but unpatched vulnerabilities.
To discuss your organisation’s cybersecurity posture and fraud investigation needs, contact our team.
The Section 65B certificate is a document that certifies the authenticity and reliability of electronic evidence. It must be signed by a person occupying a responsible official position in relation to the operation of the relevant device or the management of the relevant activities. For example, the IT administrator of a company can issue a 65B certificate for emails stored on the company’s server, and the bank’s authorised officer can issue one for bank transaction records.
Printouts of electronic records are considered “computer output” under Section 65B and are admissible if accompanied by the Section 65B certificate. However, screenshots taken on a mobile phone and then printed may face additional admissibility challenges — the chain from the original electronic record to the printout must be established through the certificate.
Immediate steps include: (a) Isolate the compromised systems to prevent further damage; (b) Preserve all digital evidence — do not shut down, reformat, or modify compromised systems; (c) Notify the bank and request fund freezing if financial fraud is involved; (d) File a complaint on the National Cyber Crime Reporting Portal (cybercrime.gov.in); (e) Engage forensic investigators for evidence acquisition and analysis; (f) Report to CERT-In if required; (g) Notify legal counsel for FIR filing and regulatory compliance.
Yes, contrary to the popular misconception that cryptocurrency is anonymous, most blockchain transactions are pseudonymous and can be traced using blockchain analytics tools. Forensic investigators can trace the flow of cryptocurrency through wallet addresses, identify exchanges where the cryptocurrency was converted to fiat currency, and work with exchanges (which are now reporting entities under the PMLA) to identify the account holders. However, tracing becomes more difficult when mixing services, privacy coins, or decentralised exchanges are used.
Under Section 75 of the IT Act, offences committed outside India by any person (irrespective of nationality) are covered if the act involves a computer, computer system, or computer network located in India. The complaint can be filed where the victim is located, where the offence was committed (the location of the computer used), or where the consequences of the offence occurred. The National Cyber Crime Reporting Portal allows filing from any location.
Under Section 85 of the IT Act, if an offence is committed by a company, every person who was in charge of and responsible for the conduct of the business at the time of the offence is deemed guilty, unless they can prove that the offence was committed without their knowledge or that they exercised all due diligence to prevent it. This places significant responsibility on directors and senior management to ensure adequate cybersecurity measures and controls are in place.
Virtual Auditor — AI-Powered CA & IBBI Registered Valuer Firm
Valuer: V. VISWANATHAN, FCA, ACS, CFE, IBBI/RV/03/2019/12333
Chennai (HQ): G-131, Phase III, Spencer Plaza, Anna Salai, Chennai 600002
Bangalore: 7th Floor, Mahalakshmi Chambers, 29, MG Road, Bangalore 560001
Mumbai: Workafella, Goregaon West, Mumbai 400062
Phone: +91 99622 60333 | Email: support@virtualauditor.in
Book a Consultation
The legal framework for addressing cyber fraud in India rests on multiple statutes that work in conjunction. Understanding this layered framework is essential for both investigation and prosecution.
Based on our forensic investigation practice, the most prevalent types of cyber fraud in India include:
Section 65B of the Indian Evidence Act, 1872 (now Section 63 of the Bharatiya Sakshya Adhiniyam, 2023) is the cornerstone provision for the admissibility of digital evidence in Indian courts. Every forensic investigator and legal practitioner must have a thorough understanding of this provision.
Our approach to cyber fraud investigation follows a structured methodology designed to ensure thoroughness, evidentiary integrity, and compliance with legal requirements.
Victims of cyber fraud have several avenues for reporting and seeking redress: