Cyber Fraud — Digital Crisis Desk (India 2026)
This is the cyber-fraud command desk for India 2026. You will find 41+ citizen-tested guides spanning UPI / AutoPay / AEPS / QR / SIM-swap fraud, WhatsApp-OTP and deepfake attacks, fake APKs and fake KYC, “digital arrest” calls, sextortion and revenge porn, account-hack recovery, and the National Cybercrime Reporting Portal route. Every guide is free, no login, no payment. The legal spine is the IT Act 2000 Sections 66C (identity theft) and 66D (cheating by personation using a computer resource), the BNS 2023 Section 318 for cheating, the RBI Limited Liability Circular for unauthorised electronic transactions, and the NCRP at cybercrime.gov.in / helpline 1930 as the central freezing channel.
Quick Answer — the 4-minute citizen drill if you have just been scammed online: (1) Dial 1930 within 30 minutes — this triggers the NCRP “money-mule” freeze across banks. (2) File a complaint at cybercrime.gov.in with screenshots of UPI ID / URL / chat / SMS. (3) Email your bank within 3 working days under the RBI Limited Liability Circular to reset your liability to zero. (4) FIR + IT Act 66D + BNS 318 — under Lalita Kumari (2014) the police cannot refuse. Never share OTPs, never run a screen-share app on a stranger's instruction.
In this hub
- UPI and payment fraud
- OTP, SIM-swap and Aadhaar-linked attacks
- AEPS, fingerprint and biometric fraud
- QR code, fake-app and APK attacks
- Fake KYC, fake customer care and impersonation
- Deepfake, AI voice and “digital arrest”
- Social-media account hack and online harassment
- Online-payment, e-commerce and OTP-refund scams
- Report and recover — the NCRP playbook
UPI and payment fraud
UPI scams are IT Act 66D + BNS 318 + RBI Limited Liability Circular — the trifecta lets you trigger NCRP freeze, criminal action, and a bank refund within 10 working days.
OTP, SIM-swap and Aadhaar-linked attacks
SIM-swap exploits TRAI's portability rules. The Sanchar Saathi portal (sancharsaathi.gov.in) lets you check active SIMs against your Aadhaar — a 3-minute audit every citizen should run.
AEPS, fingerprint and biometric fraud
UIDAI's biometric-locking feature (mAadhaar) is the single most effective citizen defence; lock by default, unlock only for live transactions.
QR code, fake-app and APK attacks
Never scan a QR to “receive” money — the QR carries a debit request, not a credit. Section 66C IT Act covers the resulting identity theft.
Fake KYC, fake customer care and impersonation
The single most effective rule: no bank, telco or UIDAI will ever ask for an OTP or screen-share. Anything claiming otherwise is IT Act 66D.
Deepfake, AI voice and "digital arrest"
“Digital arrest” is not a legal concept in BNSS. Any caller demanding cash to “clear a parcel” or “release a relative” is committing IT Act 66D + BNS 308 (extortion).
Social-media account hack and online harassment
Online-payment, e-commerce and OTP-refund
Report and recover — the NCRP playbook
Run the tools
- AI RTI Drafter — generate a working RTI in 90 seconds
- First Appeal Builder — when the PIO ignores your RTI
- PIO Reply Checker — paste a PIO reply, get the loopholes
- AwaazRTI — voice-first RTI in 22 Indian languages
Fake documents and fake government communications
Under BNS Section 336 (forgery) and IT Act Section 66D, anyone fabricating a government notice, e-challan or KYC form attracts up to 7 years in jail. The citizen drill: never click the PDF, verify on the matching .gov.in portal, screenshot, then file at cybercrime.gov.in.
Fake identities — recruiters, customer care, lawyers, police
Impersonation is the single largest scam vector in India 2026. The Supreme Court in Lalita Kumari v. State of U.P. (2014) made FIR-registration mandatory for cognisable offences like impersonation under BNS 319.
Fake investments — Ponzi, MLM, chit funds, demat, gold
A scheme promising guaranteed returns above bank FD rates without a SEBI / RBI licence is presumed illegal under the Banning of Unregulated Deposit Schemes Act 2019. SEBI advisories cover demat and Telegram tip operators.
Fake gigs and fake job traps
The “work-from-home like-and-earn” pattern is treated as cheating under BNS 318 plus IT Act 66D because it weaponises a computer resource. NCRP 1930 is the first call.
Online betting, gambling and gaming traps
State-by-state gambling laws differ; Public Gambling Act 1867 plus state amendments govern most physical operations, while the IT Rules 2023 police online “real-money games of chance”. Tax kicks in under Section 115BBJ of the Income Tax Act.
Romance, matrimonial and sextortion
These attract BNS 318 / 319 plus IT Act 67 (publishing obscene material). NCW and cybercrime.gov.in run separate fast-tracks for women victims.
Recovery, lottery and "you have won"
A second payment to “release” a first prize is the canonical advance-fee fraud — BNS 318 plus IT Act 66D. Verify on the company's official portal first.
Shop-floor and street-level
Penal hooks: BNS 318 plus Consumer Protection Act 2019 Section 2(11) (deficient service) and Section 35 (district commission).
Cyber and digital payments guides
Quick Reply: Unauthorised AEPS withdrawals, accounts frozen over fraud-linked payments, cybercrime liens and suspended online services. Escalation routes that work.
Reviewed on: 2026-06-12.
A shopkeeper receives a rent payment from a tenant. Three weeks later his account is frozen because that payment traced back to a fraud victim's complaint on the national cybercrime portal. He has done nothing wrong, yet his working capital is locked and the bank will not even name the complaint. Cases like his sit at the heart of this category.
These guides deal with cyber fraud and its fallout on ordinary users. Money pulled out through Aadhaar enabled payments (AEPS) without consent. Debit freezes and liens placed after a report on cybercrime.gov.in or helpline 1930. Banks that refuse to share the lien order or the cyber cell's details. Business lifelines such as cloud hosting, domains and email suspended overnight. The usual ladder runs from the bank's nodal officer to the jurisdictional cyber cell, then the RBI Integrated Ombudsman, with RTI to the police for the action-taken status on your complaint.
Keep the scope straight before you pick a guide. This category is for fraud and its consequences. A payment that failed or was debited twice with no fraud angle belongs in banking, UPI and payment failures. Getting certified copies of police paperwork sits in courts, police and legal documents.
Guides in this category
* AEPS withdrawal from your account that you never made
Other problem areas are on the all practical guides page.
Related hubs
- Middle-class scam defence India - edtech refunds, insurance mis-selling, fake jobs, Ponzi, fake IT/GST calls (40+ guides)