Cyber fraud victims dissatisfied with banks over delayed action and poor recovery support: study

1. At a Glance

• A study by Common Cause and Lokniti, CSDS, the Status of Policing in India Report (SPIR) 2026: Cybercrimes — Victim Perspectives and Systemic Responses, looks at how cybercrime victims deal with police and banks. It finds that victims of financial fraud are dissatisfied with how banks respond [1].
• Banks are now part of the criminal justice response. In financial cybercrime, the banking sector is central to reporting and resolving cases. This widens the traditional set of justice institutions beyond police and courts [1].
• The main gap the study points to is speed. Victims mostly report fast, but banks block transactions late, give poor support and are reluctant to accept liability. This weakens the protections that already exist, such as RBI's zero-liability framework and the 1930 helpline / CFCFRMS [1][2][3].
• UPSC relevance: GS-III (cyber security, banking, internal security), GS-II (governance, consumer and victim rights) and Prelims (RBI liability rules, I4C, 1930).

2. Why in the News

• The study was reported in The Hindu (Chennai print edition, page 22, 7 October 2026) by Radhika Jha [1].
• Main findings:
• 13% of respondents faced some cybercrime in the past 2–3 years [1].
• 54% of those victims reported digital financial fraud [1].

• Most victims approached their bank within 24 hours, but many reported delays in blocking unauthorised transactions, poor support and banks' reluctance to accept liability [1].

• Related context: RBI's 2017 customer-liability framework has been under review in 2026, and PIB carries a release titled "RBI Strengthens Framework on Unauthorised Electronic Banking Transactions" [2][3].

3. Background & Evolution

• 2017: RBI issued its framework on Limiting Liability of Customers in Unauthorised Electronic Banking Transactions [2]. A separate circular applies the same idea to co-operative banks [4].
• 2021: The Citizen Financial Cyber Fraud Reporting and Management System (CFCFRMS) was launched under the Indian Cyber Crime Coordination Centre (I4C). Its purpose is immediate reporting of financial fraud so fraudsters cannot siphon off funds [5].
• Toll-free helpline 1930 was set up to help citizens file online cyber complaints [5].
• By 30 June 2026: CFCFRMS had saved more than ₹11,158 crore across more than 32.80 lakh complaints [5].
• 2026: RBI's framework was being reviewed and strengthened [2][3]. SPIR 2026 then gave survey evidence from victims on how banks perform [1].

4. Core Static Facts

Item	Fact	Src
Study	SPIR 2026: Cybercrimes — Victim Perspectives and Systemic Responses	[1]
Authors	Common Cause and Lokniti, CSDS	[1]
Survey sample	8,306 respondents across 16 States/UTs	[1]
Qualitative component	In-depth interviews with 37 stakeholders (victims, cybercrime experts, others)	[1]
Victims among respondents	13% (past 2–3 years)	[1]
Financial fraud share among victims	54%	[1]
RBI zero liability	Customer liability is zero if the customer reports within 3 working days of receiving the bank's communication	[2]
RBI limited liability	If the fault lies with neither bank nor customer but elsewhere in the system, and the customer reports after 4–7 working days, liability is capped at the transaction value or the Table 1 amount, whichever is lower	[2]
Shadow credit	The bank must credit the disputed amount to the customer's account within 10 working days of being notified	[2]
Customer duty	Report unauthorised transactions as early as possible; the longer the delay, the higher the risk of loss	[2]
CFCFRMS	Launched in 2021 under I4C	[5]
Helpline	1930, toll-free	[5]
Recovery so far	More than ₹11,158 crore saved in more than 32.80 lakh complaints (as of 30.06.2026)	[5]

5. Multi-Dimensional Analysis

Economic

• Digital financial fraud is the largest category, at 54% of victims [1]. If victims lose trust, people may use digital payments less.
• The money saved through CFCFRMS (₹11,158 crore or more) shows that speed decides whether funds can be recovered [5]. When banks block transactions late, recoverable money is lost.

Governance / Administrative

• Victims mostly report within 24 hours, which is well inside RBI's 3-day zero-liability window. Yet they still face delays in blocking and reluctance to accept liability [1][2]. The gap is in how banks comply, not in what victims do.
• Several bodies share responsibility: police, banks, I4C/CFCFRMS and RBI. Nobody owns the problem end to end, so victims must navigate "complex systems" on their own [1][5].

Legal / Regulatory

• RBI's 2017 framework puts the burden on banks. The amount must be credited within 10 working days, and liability depends on how quickly the customer reports [2].
• When banks resist accepting liability, they undermine that framework in practice [1][2].

Social

• 13% of respondents had been victims [1], so this is now a mass-scale problem.
• Poor support from banks hurts most those who know least about digital systems. This is an inference; the study's breakdown by demographic group is not available in the retrieved excerpt.

Technological

• CFCFRMS and the 1930 helpline are the main tech tools for freezing funds in real time [5]. They work only if banks act quickly on the alerts.

6. Recent Developments (last 12–18 months)

• 2026: RBI was reviewing and strengthening the unauthorised electronic banking transactions framework (PIB release) [2][3].
• 30 June 2026: CFCFRMS cumulative figures reached more than ₹11,158 crore saved in more than 32.80 lakh complaints [5].
• 7 October 2026: The Hindu reported the SPIR 2026 cybercrime findings [1].

7. Prelims Hooks

• SPIR 2026 was prepared by Common Cause and Lokniti-CSDS, not by NCRB or MHA [1].
• SPIR 2026 surveyed 8,306 respondents in 16 States/UTs [1].
• 13% of respondents faced cybercrime in the past 2–3 years [1].
• 54% of cybercrime victims reported digital financial fraud [1].
• Under RBI rules, customer liability is zero if fraud is reported within 3 working days [2].
• A 4–7 working day delay brings capped (limited) liability: the transaction value or the Table 1 amount, whichever is lower [2].
• Banks must credit the disputed amount within 10 working days of the customer's notification [2].
• RBI's customer-liability framework was first issued in 2017 [2].
• A separate RBI circular covers co-operative bank customers [4].
• CFCFRMS was launched in 2021 under I4C [5].
• 1930 is the national toll-free cyber-fraud helpline [5].
• More than ₹11,158 crore was saved through CFCFRMS by 30.06.2026 [5].

8. Why Reporting Fast Is Not Enough to Get Money Back

• RBI's rule counts days. Fraud money moves in minutes.
• Zero liability needs reporting within 3 working days [2]. Most victims in the survey reported within 24 hours [1].
• But zero liability only decides who bears the loss. It does not bring back the stolen money.

• Money comes back only if it is frozen before it leaves the system. That is the job of CFCFRMS and 1930 [5].

• Stolen money is passed through mule accounts within hours

• A money mule is a person whose bank account receives stolen money and passes it on to others, for a commission [12].
• I4C has warned that organised cybercriminals, including foreign gangs, use mule accounts to build illegal payment gateways. In effect, they sell money laundering as a service [11].

• Each hop to a new account makes the money harder to freeze. So when a bank blocks late, as victims told SPIR [1], it loses the one chance to recover the money.

• The 10-day shadow credit does not get money back from the fraudster

• The bank must credit the disputed amount within 10 working days [2]. This is a temporary credit while the bank checks the case.
• It decides who pays: the bank or the customer. The fraudster still keeps the money unless it was frozen early.
• This is why banks resist accepting liability. Each case they accept is a direct loss from their own books.

9. Why Today's Scams Fall Outside the 2017 Rule

• The rule was written for 'unauthorised' transactions
• The 2017 framework covers unauthorised electronic transactions [2]. Think of a cloned card or a hacked account.

• Where the loss comes from the customer's own negligence, such as sharing payment credentials, the customer bears the whole loss until they report it to the bank [2].

• Most new scams trick the victim into paying, or into sharing an OTP

• In 'digital arrest' and similar scams, the victim is pressured into making the transfer or giving out the OTP (the one-time password sent to their phone).
• The bank can then call the case 'customer negligence', and the zero-liability protection falls away.

• This explains the 'reluctance to accept liability' in SPIR [1]. The bank can be following the letter of the rule and still leave the victim with nothing.

• The proof burden is on the bank, but victims rarely know this

• Under the circular, the bank has to prove that the customer is liable [2].
• A first-time victim who does not know this simply accepts the bank's refusal. Victims having to find their way through 'complex systems' alone [1] is how a protection that exists on paper ends up unused.

10. The Banks' Side of the Argument, and Where It Falls Short

• The strongest case for the banks
• If banks had to repay every scam, people might take less care with OTPs and PINs.
• Some 'victims' might also be working with the fraudsters and file false claims.

• Banks also say that the customer, not the bank, pressed 'pay'.

• What is fair in this argument

• Customers do have a duty. RBI itself says the longer a customer delays reporting, the higher the risk of loss [2].

• Making banks pay for everything with no conditions would be unfair to them and could be misused.

• Where it falls short

• Stolen money has to land in some bank account. That account was opened and checked (KYC, or Know Your Customer checks) by a bank.
• Mule accounts exist because KYC and monitoring at the receiving bank failed [11][12]. So the banking system is not a neutral bystander.

• Banks can spot mule accounts. RBI's MuleHunter.AI, an AI tool built by the Reserve Bank Innovation Hub (RBIH) and launched in December 2024, spots them from patterns in transactions. Its spread across banks is still partial [10].

• Fair conclusion: liability should be shared according to who could have stopped the fraud. The sending bank and the receiving bank both share that role, not only the victim.

11. An Old Complaint That Redress Has Not Fixed

• Digital complaints have been at the top for years
• Even in 2019-20, complaints about digital transactions were the largest group: 44.66% of all complaints to RBI's ombudsman (an independent officer who handles customer complaints against banks) [6].
• RBI had already set up a separate Ombudsman Scheme for Digital Transactions in 2019 [7]. It was later merged into the Integrated Ombudsman Scheme, 2021 [8].

• SPIR 2026 shows victims are still unhappy [1]. Changing the forum for complaints has not changed how banks behave.

• The ombudsman acts after the damage is done

• The ombudsman can order compensation after a complaint [8]. It cannot make a bank freeze money in the first hour.

• The real failure SPIR points to, delay in blocking [1], happens before any redress body is involved.

• No one sees bank-by-bank response times

• CFCFRMS reports total money saved (₹11,158 crore or more) [5]. It does not publish how quickly each bank acted on 1930 alerts.
• Without that data, a slow bank faces no public pressure. A victim cannot pick a safer bank either.

12. What the Survey Can and Cannot Prove

• It measures what victims experienced, not bank records
• SPIR is based on 8,306 survey respondents and 37 interviews [1]. 'Dissatisfied' is the victim's view.

• It does not check bank logs. So it cannot say how many hours each bank actually took to block a transaction.

• It covers 16 States/UTs, not all of India [1]

• Use the numbers as strong evidence of a pattern, not as national totals.
• For Mains, pair SPIR (what victims experience) with official data such as CFCFRMS figures [5] and RBI ombudsman reports [6]. That gives a balanced answer.

13. Who Should Do What Next

• RBI: set a deadline in hours for acting on 1930 alerts
• The 2017 rule sets day-based limits for customers and banks [2]. It sets no clock for freezing money after a CFCFRMS alert.

• A deadline in hours, with a penalty for missing it, would target the exact delay victims reported [1].

• RBI: clearly cover scams where the victim is tricked into paying

• Today 'customer negligence' can wipe out protection in social-engineering scams (scams where the fraudster tricks the victim into acting) [2].

• The framework under review in 2026 [3] should state when such scams still qualify for shared or capped liability.

• Receiving banks should share the loss when a mule account is proved

• If the money landed in an account that failed KYC, the bank that opened it should bear part of the loss.

• This gives banks a reason to clean up mule accounts, which I4C has flagged as the backbone of fraud networks [11].

• I4C and RBIH: put mule-account detection in every bank

• I4C and RBIH have signed an MoU to use AI to detect mule accounts [9]. MuleHunter.AI is not yet in every bank [10].

• Every bank, including co-operative banks covered by a separate liability circular [4], should run it. A fraudster will simply move to the weakest bank.

• I4C: publish bank-wise data on 1930 response times

• Publishing each bank's average freeze time and recovery rate from CFCFRMS [5] would expose slow banks. It would also give customers and the ombudsman [8] hard evidence.

14. Anchors for Answers

• Data: 13% of respondents were cybercrime victims, and 54% of those victims faced digital financial fraud (SPIR 2026, 8,306 respondents, 16 States/UTs) [1]
• Data: Digital transaction complaints were 44.66% of all complaints to the RBI ombudsman in 2019-20 [6]
• Data: CFCFRMS saved more than ₹11,158 crore across more than 32.80 lakh complaints (as of 30.06.2026) [5]
• Report/Committee: Status of Policing in India Report 2026 (Common Cause and Lokniti-CSDS) [1]; RBI Annual Report of Ombudsman Schemes, 2019-20 [6]
• Law/Case: RBI circular on Limiting Liability of Customers in Unauthorised Electronic Banking Transactions, 2017: zero liability within 3 working days, shadow credit within 10 working days, burden of proof on the bank [2]; RBI Integrated Ombudsman Scheme, 2021 [8]
• Scheme: CFCFRMS and the 1930 helpline under I4C, for real-time freezing of stolen money [5]; MuleHunter.AI by RBIH, plus the I4C–RBIH MoU, for AI-based mule-account detection [9][10]

15. Mains Relevance

• GS-III: Challenges to internal security through communication networks; basics of cyber security; the banking sector and money laundering.
• GS-II: Governance, transparency and accountability; mechanisms for protecting vulnerable sections; the role of regulators.
• GS-IV (case-study angle): Institutional accountability and service ethics in banks.
• Question stems: 1. Financial cybercrime has made banks an integral part of the criminal justice system. Examine the adequacy of banks' preparedness in light of recent evidence. (250 words) 2. Despite a zero-liability regime and a national helpline, victims of digital financial fraud continue to face poor recovery outcomes. Analyse the institutional gaps and suggest reforms. (250 words) 3. Speed is the essence of recovery in cyber-enabled financial fraud. Discuss with reference to CFCFRMS and RBI's customer liability framework. (150 words)

16. Related Topics to Study Next

• I4C and its verticals: I4C is the parent body of CFCFRMS and the 1930 helpline.
• National Cyber Crime Reporting Portal: the complaint-filing side of the same ecosystem.
• RBI Integrated Ombudsman Scheme: the redress route when a bank refuses liability.
• "Digital arrest" scams and mule accounts: the current methods behind financial fraud.
• IT Act, 2000 and the cheating/impersonation provisions of the Bharatiya Nyaya Sanhita: the criminal law framework.
• NCRB Crime in India, cybercrime chapter: official data to set against survey findings.
• Police as a State subject, and earlier SPIR editions: context for the federal and capacity limits on policing cybercrime.
• Digital Personal Data Protection Act, 2023: data leaks make targeted fraud possible.

17. NCERT Concepts to Revise

• Financial fraud (Economy): This is the crime the study is about: victims lose money to scams, and helpline 1930 is the reporting route.
• Commercial banks (Economy): Banks are the institutions whose slow blocking of transactions and reluctance to accept liability the study criticises.
• Criminal justice system (Polity): The note argues banks now join police and courts as part of the justice response to cybercrime.
• Digital payments (Economy): Digital financial fraud is the largest cybercrime category, and victims' loss of trust could reduce use of digital payments.
• Ombudsman (Polity): The RBI Integrated Ombudsman is the redress route when a bank refuses to accept liability for a fraud.
• Accountability (Polity): The gap is banks not complying with liability rules, so the question is who answers to victims for delays.

18. Common Errors / Trap Areas

• Who made the study: SPIR is by Common Cause and Lokniti-CSDS, not NCRB, MHA or RBI [1].
• 3 working days vs 24 hours: RBI's zero-liability window is 3 working days [2]. The "24 hours" in the news is how fast victims reported, not a regulatory deadline [1].
• 10 working days is the deadline for the bank to credit the amount. It is not a reporting window [2].
• CFCFRMS (2021) is a separate thing from I4C, its parent body under MHA. Do not mix up their launch years [5].
• 54% is a share of victims, not of all respondents. 13% is the share of all respondents who were victims [1].