Between 2022 and May 2026, one scam type alone cost Indians over ₹4,000 crore. It’s called a “digital arrest,” and it doesn’t involve any real police. This article covers India’s cyber crime landscape and the institutions built to fight it.
Timeline
Building the Response
2019-2020: I4C Established, NCRP Dedicated
- 2019The Ministry of Home Affairs establishes the Indian Cyber Crime Coordination Centre (I4C).
- 20 Jan 2020The National Cyber Crime Reporting Portal is dedicated to the nation.
2021-2026: Helpline Becomes 1930, Digital Arrest Losses
- 2021The cybercrime helpline is renamed 1930, from the earlier 155260, for easier recall.
- 2022-May 2026Digital arrest scams alone cause ₹4,057.7 crore in losses across 297,727 reported cases.
Must Know
I4C, the 1930 Helpline, and Digital Arrest Losses
I4C Basics, and the 1930 Helpline
- StructureThe Indian Cyber Crime Coordination Centre (I4C), under the Ministry of Home Affairs, was established in 2019 to coordinate India’s response to cybercrime.
- DetailThe National Cyber Crime Reporting Portal, run under I4C, was dedicated to the nation on 20 January 2020. India’s cybercrime helpline is 1930, renamed from 155260 in 2021, run 24/7 by I4C with the RBI and banks.
Digital Arrest Scale
- ScaleBetween 2022 and May 2026, “digital arrest” scams alone caused ₹4,057.7 crore in losses across 297,727 reported cases.
Good to Know
Scam Mechanics and the CERT-In/I4C Split
Digital Arrest Mechanics, and Enforcement Numbers
- MechanismIn a digital arrest scam, criminals impersonate police, CBI, ED, or RBI officials, falsely accuse victims of crimes, and pressure them into transferring money.
- ScaleIn 2025 alone, the government deactivated 1.2 million SIM cards and froze 1.33 million “mule” bank accounts, recovering ₹5,489 crore. I4C data show nearly 46% of scam operations originate from Cambodia, Myanmar, and Laos.
CERT-In’s Separate Role, and Platform-Level Obligations
- StructureCERT-In (Indian Computer Emergency Response Team) operates under Section 70B of the IT Act 2000. It handles cybersecurity incident response and network protection, a separate role from I4C’s focus on crime against citizens.
- RuleA separate platform-obligation track, under the IT Rules 2021, requires intermediaries to police unlawful content, including deepfakes and AI-generated material since a 2026 amendment. See Polity0161 — IT Rules 2021 and Deepfake/AI Content Regulation.
Current Affairs
📰 Current Affairs
The Boss Scam, Money Recovered at Scale, and the Suspect Registry
- StoryI4C issued an advisory warning about the “Boss Scam,” a CEO-impersonation fraud spreading through WhatsApp. Attackers pose as regulators like the RBI, message an executive claiming an urgent compliance issue, and attach malware disguised as a compliance document.
- HowThe malware hijacks the executive’s Web WhatsApp session, letting attackers instruct finance staff to wire funds to mule accounts, using the executive’s real account and chat history. Some cases add AI-generated deepfakes or voice cloning.
- SourceBusiness Standard.
- 28 Jul 2026The government’s CFCFRMS platform has saved over ₹11,158 crore across more than 32.80 lakh complaints, as of 30 June 2026, with 1,586 entities, including 40 foreign banks, onboarded.
- SourcePIB.
- ScaleUnder I4C’s Suspect Registry, launched September 2024, banks have shared over 30.48 lakh suspect identifiers, flagged 32.08 lakh “mule” accounts, and blocked transactions worth ₹25,698 crore.
- SourcePIB.
✅ Test Yourself
Question 1 of 1
Great to Know
Enforcement Scale and the Southeast Asia Scam Crisis
Two Jobs, Often Confused, and From Reactive to Active
- ReframeI4C and CERT-In split the problem in two. I4C handles crime against individuals: scams, fraud, financial theft. CERT-In handles systemic threats to networks and infrastructure. Different bodies, different jobs, often confused as one.
- ShiftThe scale of enforcement shows a real shift. Over 83,000 WhatsApp accounts, 7.81 lakh SIM cards, and 2 lakh IMEI numbers have been blocked. This marks a move from reactive complaint-taking to active network-level disruption.
A Regional Crisis, Not Just India’s
- ContextThe concentration of scam operations in Cambodia, Myanmar, and Laos reflects something bigger. It is part of a broader Southeast Asian scam-compound crisis, not one unique to India. This cross-border, organised pattern has only recently been understood at this scale.
PYQ
Exam Point of View
CERT-In’s Rules Are a Numbers Trap
- QuestionUPSC CSP 2017 (Q85) asked who must legally report cyber security incidents. CAPF ACS 2022 (Q95) tested the exact reporting deadline and VPN data-retention period under CERT-In’s rules.
- WhyService providers, data centres, AND body corporate are all covered, not just one category. And the real reporting deadline is 6 hours, not 24 as one option claims. VPN providers must retain user records for 5 years, which is correct.
- LinkUPSC CSP 2017, Q85 and CAPF ACS 2022, Q95.
Was this helpful?
Leave a Reply