Cyber fraud victims face delays and little accountability from banks

Cybercrimes have disrupted our conventional understanding of both how crimes take place and how the systems responding to them function. While there is much to be said about the non-financial cybercrimes that may be just as prevalent as financial cybercrimes, the latter have captured the public’s imagination and fears in unprecedented ways.

A recent study by Common Cause and Lokniti, CSDS, the Status of Policing in India Report (SPIR) 2026: Cybercrimes — Victim Perspectives and Systemic Responses, brings out the perspectives of the common public, victims, and domain experts on this issue, focusing on how victims navigate through the complex systems. The study is based on a survey of 8,306 respondents from across 16 States/U.T.s, along with in-depth interviews with 37 stakeholders, including victims, cybercrime experts, and others.

In financial cybercrime cases, the banking sector becomes an integral part of the reporting and resolution process, widening the traditional understanding of the core criminal justice institutions such as the police and courts. In this context, the study explores, among other things, whether banks as an institution are prepared to deal with these cases and to take accountability for security lapses.

According to the survey data, 13% of the overall respondents were victims of cybercrimes in the last 2-3 years. Among the victims, more than half (54%) were victims of digital financial frauds.

One of the first actions taken by the victim after the incident was complaining directly to the banks. More than half of the victims of digital financial fraud (52%) who were surveyed said that they had complained to the bank separately after the incident. A majority, 63%, complained within the first 24 hours.

Banks’ response

Despite the promptness in reporting shown by many victims, the response by the banks leaves much to be desired. A 2017 RBI guideline states that in cases of third-party breach due to no deficiency by either the bank or the customer, and if the customer notifies the bank within three days, the loss must be borne by the bank entirely. This was extended on a pilot basis in 2026 to include those cases wherein the customer had been tricked or coerced into making scam payments, with limited liability being placed on the bank in such cases.