Cyber crime in India: types, challenges and the statistics behind them

What cyber crime in India means

Cyber crime in India covers offences in which a computer, a phone or a network is the tool of the offence, or its target. The word does not name a single law. Some conduct is made an offence by the Information Technology Act 2000, for example the use of another person’s password or the publication of obscene material in electronic form. Other conduct is an old offence in a new setting: a fraud that would once have been committed by letter or in person is now committed through a fake website, a message or a call, and it is recorded as a cyber crime because of the means used.

This distinction explains why the same incident is often described with more than one legal provision, and why the figures published for cyber crimes in India can never be read as a count of one particular offence. Any account of cybercrime in India has to begin with that point. The statistics below follow the definition used by the National Crime Records Bureau, which compiles them for its yearly report, Crime in India: cases registered under cyber crimes, involving communication devices as medium or target.

Responsibility for the response is divided. Police and public order are State subjects under the Seventh Schedule to the Constitution, so a State or Union Territory police force registers and investigates the case. At the centre, the Ministry of Home Affairs set up the Indian Cyber Crime Coordination Centre as an attached office to deal with all types of cyber crime in a coordinated way. The full text of the main statute is explained in the guide to the IT Act 2000.

Cyber crime statistics for India, 2018 to 2023

The figures below are the numbers of cases registered under cyber crimes in each year, as published by the National Crime Records Bureau and given by the Ministry of Home Affairs in its replies to Parliament. The series covers 2018 to 2022 in one reply and 2021 to 2023 in a later one; the two overlap for 2021 and 2022 and agree.

The rise in cyber crime in India is steep. The number of registered cases was more than three times higher in 2023 than in 2018, and the two latest annual changes, 24.4 per cent for 2022 and 31.2 per cent for 2023, are the largest since the jump of 2019. A careful reader should still ask what the figure measures. It counts cases registered by the police, which depends on how many complaints are turned into formal cases as well as on how much crime takes place. Greater awareness of the national reporting portal and of the helpline can raise the count even if the underlying number of incidents were unchanged, and under-reporting can hold it down.

Where the cases are registered

Registration is concentrated in a few States. In 2023 the highest number of cases was registered in Karnataka, followed by Telangana, Uttar Pradesh and Maharashtra. The table shows the four States with the highest counts in that year.

Two cautions apply to a table like this. A State that registers more cases is not necessarily a State with more crime, because the rules and practice for turning a complaint into a case differ between police forces. And the national total is the sum of the State and Union Territory figures, so any change in one force’s practice moves the national series.

How to read the numbers

Three points help a reader avoid the usual mistakes with statistics on cyber crime in India. First, the series counts cases registered, not complaints received. A person who reports an incident on the national portal or through the helpline has made a complaint, and only some complaints are turned into an FIR; the official replies describe the portal as the place where incidents are reported and then handled by the State or Union Territory agency under the law. A rise in registered cases can therefore reflect better conversion of complaints into cases, not only more crime. Measurement is one of the quieter challenges of the whole subject.

Second, the definition is fixed by the Bureau and covers offences involving communication devices as medium or target. It is wider than the offences created by the Information Technology Act 2000 alone, because ordinary offences committed through a computer or phone are included. A comparison with a figure from another country, or with an older figure that used a narrower definition, needs the definition checked first. Third, the latest published year always lags: the replies of 2025 give 2023 as the most recent year of the report, so a statement about the present state of cyber crimes in India based on this series describes an earlier period.

Fraud as a separate head

The National Crime Records Bureau also records a head for cyber crimes involving fraud. In the replies published by the Ministry of Home Affairs the all-India figures are 10,395 cases in 2020, 14,007 in 2021 and 17,470 in 2022. Registration of fraud is even more concentrated than registration of cyber crime as a whole: in 2022 Telangana accounted for 9,581 of the 17,470 cases, more than half, followed by Maharashtra with 2,202 and Bihar with 1,441. Fraud is the category of cyber crime that most people meet in their own lives, and it is the subject of a separate page on internet fraud.

Types of cyber crime and the sections that apply

The table lists the main types of cyber crime in India and the provision of the Information Technology Act 2000 that deals with each. It is a guide to where to look, not a statement of what charge a police officer will frame in a particular case. Each type also brings its own challenges for investigators, which are taken up in the section after the types.

Phishing, impersonation and online banking fraud

The most common types in daily life are the frauds that rely on deceiving the victim into handing over access: a message that claims to come from a bank, a call that asks for a one-time password, a fake page that copies a payment site. The conduct fits section 66D, cheating by personation using a communication device or computer resource, and section 66C when the offender then uses the victim’s password or other identifier. Both carry imprisonment of up to three years and a fine of up to Rs 1 lakh. The same facts can also be charged as the general offence of cheating.

Unauthorised access and damage to data

Gaining access to a computer or network without permission, copying or damaging data, or introducing a virus is listed in section 43, which provides civil compensation. When the act is done dishonestly or fraudulently, section 66 turns it into a crime. Intrusion into company systems and ransomware attacks belong here, and the harm can be large because the data affected may belong to many people.

Offences against privacy, women and children

Publishing a private image without consent is covered by section 66E. Sexually explicit material is covered by section 67A, and material depicting children in sexually explicit acts by section 67B. The national reporting portal was launched with a special focus on cyber crimes against women and children, which reflects how serious the Ministry of Home Affairs considers this group of offences. A reference on sections 67, 67A and 67B sets out how the three sections relate to each other.

Challenges in investigating cyber crime in India

The challenges are structural, and several of them are visible in the official material itself. They explain why cybercrime in India is harder to investigate than most conventional crime, and why a rising count of cases does not translate into a matching count of convictions. Four of them recur: the division of policing between States, the capacity to examine digital evidence, the speed at which money leaves an account, and a legal framework that has changed in recent years.

Jurisdiction and the State police

Because policing is a State subject, an offence in which the victim lives in one State and the offender in another needs two forces to cooperate. The national portal helps: incidents reported on it are converted into FIRs and acted on by the State or Union Territory agency concerned. The step from a report to a case is the point at which many complaints stall, and it is one reason the registration figures understate what is reported.

Forensic capacity

Cyber crime cases depend on digital evidence, and the capacity to examine it has had to be built. According to the Ministry of Home Affairs, the National Cyber Forensic Laboratory (Investigation) was established as part of the Indian Cyber Crime Coordination Centre at New Delhi on 18 February 2019, with a second at Assam on 29 August 2025, to give early-stage assistance to police investigating officers. A National Cyber Forensic Laboratory (Evidence) was established at Hyderabad in 2018. At the time of the December 2025 reply there were seven Central Forensic Science Laboratories with digital forensics and twenty-four State Forensic Science Laboratories operational. The ministry has also given Rs 116.5 crore under its scheme for the prevention of cyber crime against women and children for forensic and training laboratories, commissioned in 33 States and Union Territories. The subject of computer forensics explains what that work involves.

Speed of financial loss

Money moves in minutes, and a complaint made a day late may be too late. The Citizen Financial Cyber Fraud Reporting and Management System, launched in 2021 under the Indian Cyber Crime Coordination Centre, exists to report financial frauds immediately and stop the funds from being moved on. As of March 2025 the ministry said that more than Rs 4,386 crore had been saved across more than 13.36 lakh complaints. The helpline 1930 is operated to give assistance in lodging cyber complaints online.

Changing law

The legal background has shifted. The Bharatiya Nyaya Sanhita and the Bharatiya Sakshya Adhiniyam came into force on 1 July 2024 in place of the Indian Penal Code and the Indian Evidence Act, so the general offences and the rules on electronic evidence that an investigator or a lawyer relies on now carry new section numbers, while matters already pending continue under the earlier law. One section of the Information Technology Act has also fallen away: section 66A was held unconstitutional in 2015.

What to do after a cyber crime in India

The official channels are the same for every type of cyber crime. An incident can be reported online on the National Cyber Crime Reporting Portal at cybercrime.gov.in, which was launched under the Indian Cyber Crime Coordination Centre to let the public report all types of cyber crime, with special attention to crimes against women and children. A toll-free helpline, 1930, gives help in lodging cyber complaints online. Where money has been taken, the Citizen Financial Cyber Fraud Reporting and Management System is the route for immediate reporting of financial frauds, and the earlier a complaint is made, the better the chance that funds can be stopped before they are moved on.

Some practical points follow from how these cases are investigated. Evidence is digital and easily lost, so screenshots of the messages, the web address of any fake page, the transaction reference numbers and the dates and times of calls should be kept before anything is deleted or an account is closed. The report should name the type of incident in plain terms and include the identifiers of the other party that the victim holds, such as a phone number, an account number or a user name. A complaint made on the portal is picked up by the police of the State or Union Territory concerned, so the contact details given must be correct and reachable. The details of the complaint process are set out on a separate page on filing a cyber crime complaint online.

Related pages

Reported cases that show how courts have applied these sections are collected in the case reports. A separate page deals with internet fraud, which is the largest single category in the statistics, and what cyber law is explains the field in general terms.

Frequently asked questions