Digital India Insurance: A Compensation Pool for Cyber Fraud Victims

By Adv. (Dr.) Prashant Mali · Working Paper v1.0 · First published 26 October 2026 DOI: 10.5281/zenodo.23656760

The problem: a digital republic without a safety net

India invited 1.4 billion people into a digital republic, and they accepted. Aadhaar, UPI, Jan Dhan and Direct Benefit Transfer moved pensions, subsidies and savings onto digital rails. Citizens did what the State asked.

The cost of that success is now visible:

• Indians reported losing ₹19,812.96 crore to cyber fraud in 2025 on the National Cyber Crime Reporting Portal, and ₹22,849.49 crore in 2024 (I4C data).

• Senior citizens alone reported losses of ₹4,005.12 crore in 2025.

• Investment scams caused 76% of the money lost in 2025.

• Victims get back only about 2% of what they report losing.

When a 71-year-old is held on a video call for 30 hours by a fake “CBI officer” and transfers his life savings, the system tells him one thing: you authorised it. The bank says the OTP was his, the telecom operator says the SIM was verified, the platform says it is only an intermediary, and the police say the fraudster is in Cambodia. Everyone is compliant, and the citizen is poorer.

The gap in Indian law

Indian law protects the victim of an unauthorised transaction reasonably well. Under the RBI’s 2017 circular, a customer who reports a third-party breach within three working days bears zero liability. The Supreme Court upheld this in State Bank of India v. Pallabh Bhowmick (2025).

But most fraud today is authorised push payment fraud: the victim, deceived, presses “Pay” himself. The RBI’s own April 2026 discussion paper says these now make up most frauds. For these victims, the law offers almost nothing:

• The 2017 RBI circular does not cover them.

• The RBI’s 2026 small-value compensation scheme gives a one-time maximum of ₹25,000.

• DPDPA penalties of up to ₹250 crore go to the Consolidated Fund of India, not to the victim.

• State victim compensation schemes are built around bodily harm.

India already insures depositors up to ₹5 lakh if a bank collapses (DICGC). It does not insure them when their money vanishes through a payment rail the State built and promoted.

The idea: India has solved this once before

When India licensed millions of vehicles, it accepted that some harm was statistically certain. So the Motor Vehicles Act, 1988 made third-party insurance compulsory (Section 146), pays hit-and-run victims without proof of fault (Section 161), and created a Motor Vehicle Accident Fund (Section 164B). The State does not drive the truck, but it built the road.

Digital payment rails are today’s highways. Fraudsters are the hit-and-run drivers. The Digital India Insurance Pool applies the same logic.

Who pays in

Every entity that earns from the digital rails contributes, weighted by the risk it creates:

• Banks (sending side): a micro-levy per outward digital transaction.

• Banks, wallets and NBFCs (receiving side): a levy weighted by fraud money flowing into accounts they opened. Mule accounts are a KYC failure, so the heaviest weight sits here.

• Payment aggregators, gateways and UPI apps: a share of fees or a per-transaction levy.

• Telecom operators: a levy per SIM, weighted by scam-call reports.

• Digital platforms: a levy on financial-product ad revenue and a charge per flagged scam ad.

• Union Government: seed capital and a backstop guarantee.

• Other sources: DPDPA penalties, confiscated proceeds of cyber fraud and unclaimed recovered funds.

What victims receive

• Tier 1, fault-free floor: 90% of losses up to ₹1 lakh, within 30 days, for any verified victim who reports on 1930 or the NCRP within 7 days.

• Tier 2, shared liability: 75% of losses between ₹1 lakh and ₹10 lakh, within 90 days.

• Tier 3, vulnerable victims and State impersonation: 90% up to ₹25 lakh for senior citizens, persons with disabilities, first-time Jan Dhan users, and anyone defrauded by someone impersonating a public authority.

• Investment fraud: 50% up to ₹5 lakh, only where the scheme was unregistered with SEBI or the RBI.

Tier 3 rests on a simple point. When a fraudster impersonates the CBI, the RBI or the Supreme Court, the weapon is the authority of the State itself. A State that cannot protect its own seals and uniforms from forgery owes the highest duty of compensation.

Who pays back

After paying the victim, the pool recovers from those at fault, using the “pay and recover” principle the Supreme Court approved in National Insurance Co. v. Swaran Singh (2004):

• the receiving bank that opened the mule account: up to 50%;

• the sending bank that skipped mandated fraud checks: up to 25%;

• the telecom operator that carried a spoofed or reported number: up to 15%;

• the platform that kept a scam ad up after notice: up to 10%;

• untraceable and cross-border losses: absorbed by the pool.

Safeguards against misuse

• Mule account holders and colluding “victims” are excluded and prosecuted.

• Victims who override an explicit bank warning get half the Tier 1 payout (except vulnerable victims).

• A second claim within three years is paid at 50%.

• A small excess of ₹500 keeps everyone careful.

The UK’s mandatory reimbursement scheme, introduced in October 2024, returned about 88% of money lost in its first year, and fraud fell, because banks finally had skin in the game.

What it would cost

On 2025 figures, and assuming recoveries, caps and exclusions bring net payouts to 25–40% of reported losses, the pool would pay out roughly ₹5,000 to ₹8,000 crore a year before recoveries. This is an illustrative estimate, not an actuarial one. As institutions start bearing losses, fraud should fall, and so should the cost.

The laws that would need to change

The paper proposes amendments to ten statutes and two RBI instruments:

• Payment and Settlement Systems Act, 2007: a new chapter creating the pool (the anchor statute).

• Banking Regulation Act, 1949: risk-weighted contributions by banks.

• DICGC Act, 1961: allow DICGC to administer the pool.

• Insurance Act, 1938: enable a cyber-fraud insurance pool.

• IT Act, 2000: restore victim compensation after DPDPA omits Section 43A, and tie platform safe harbour to removing scam ads.

• DPDPA, 2023: send a share of penalties to victims.

• Telecommunications Act, 2023: loss-sharing for operators.

• Consumer Protection Act, 2019: treat failed fraud controls as a deficiency in service.

• BNSS, 2023: include cyber fraud losses in victim compensation schemes.

• Income-tax law: make contributions deductible and payouts tax-free.

• RBI’s 2017 liability circular and 2024 fraud directions: cover authorised push payment fraud, and record frauds on customers, not only on banks.

Why it matters now

On 4 August 2026, the Supreme Court, in its suo motu digital arrest proceedings, asked the Inter-Departmental Committee to examine a shared-liability and victim-compensation framework. This proposal offers one.

Every unrecovered loss produces neighbours who switch off UPI and first-generation account holders who return to cash. Financial inclusion is a flow, and fraud drains it. If the State can give fintech start-ups tax holidays to bring citizens onto digital rails, it can give citizens an insurance policy to keep them there.

Digital India was the slogan. Trusted India should be the promise.