Yes, online banking fraud can be a criminal offence in India. Fraudulent activities such as unauthorised access to bank accounts, identity theft, phishing, impersonation, fraudulent transfers and misuse of banking credentials can attract criminal liability under the Information Technology Act, 2000, the Bharatiya Nyaya Sanhita, 2023 (BNS), and other applicable laws. The exact offence depends on how the fraud was committed and what evidence is available.
At the same time, a victim’s financial liability to the bank is a separate question. RBI provides a customer-protection framework for unauthorised electronic banking transactions, including rules concerning bank negligence, customer negligence and third-party breaches.
What Is Online Banking Fraud?
Online banking fraud generally involves obtaining money, banking credentials or access to a person’s account through deception or unauthorised digital activity.
Common examples include:
- Phishing emails or messages designed to steal banking credentials
- Fake banking or customer-care websites
- Unauthorised internet-banking transfers
- Identity theft involving passwords or authentication information
- Impersonation of bank officials
- Malware or other unauthorised access to banking systems
- Fraudulent electronic transactions
- Manipulation or misuse of digital banking information
The fact that a fraud occurs online does not make it merely a private banking dispute. Depending on the conduct involved, it can constitute a criminal offence.
Can Online Banking Fraud Amount to Cheating?
Yes.
Section 318 of the Bharatiya Nyaya Sanhita, 2023 defines cheating in terms of deception and fraudulent or dishonest inducement that causes or is likely to cause harm or induces delivery or retention of property. Section 319 separately deals with cheating by personation.
For example, if a fraudster falsely represents themselves as a bank employee and deceives a customer into revealing information or transferring money, the facts may support an allegation of cheating or cheating by personation.
The applicable punishment depends on the specific form of cheating established by the evidence.
Does the Information Technology Act Apply?
Yes.
The Information Technology Act, 2000 contains several provisions that can apply to online banking fraud. Section 66 deals with computer-related offences where acts covered by Section 43 are committed dishonestly or fraudulently.
Section 66C specifically addresses identity theft, including fraudulent or dishonest use of another person’s electronic signature, password or other unique identification feature. Section 66D deals with cheating by personation using a computer resource or communication device.
Therefore, a single online banking fraud may potentially involve provisions of both the IT Act and the BNS, depending on the facts.
Is Using Someone Else’s Banking Password a Criminal Offence?
Potentially, yes.
A password or other unique authentication feature belonging to another person can fall within the identity-theft provision of Section 66C of the IT Act when it is fraudulently or dishonestly used.
For example, accessing another person’s online banking facility using their stolen password or authentication information can potentially raise issues under the IT Act in addition to other applicable criminal provisions.
However, the precise offence depends on the evidence, including how the credentials were obtained and how they were used.
What If Someone Impersonates a Bank Official?
Impersonating a bank employee to obtain money or confidential information can potentially attract criminal liability.
Such conduct may involve cheating by personation under Section 319 of the BNS, and where a computer resource or communication device is used for the impersonation, Section 66D of the IT Act may also become relevant.
For instance, a fraudster may call a customer pretending to be from a bank’s fraud department and persuade the customer to disclose confidential information or authorise a fraudulent transaction.
The exact legal provisions depend on the method used and the facts established during investigation.
Is the Bank Financially Responsible for the Fraud?
Criminal liability of the fraudster and financial liability for the unauthorised transaction are separate issues.
RBI’s customer-protection framework provides that where an unauthorised electronic transaction is attributable to the bank’s negligence, deficiency or fraud, the customer’s liability can be zero. Certain third-party breach situations can also result in zero liability when the customer reports the transaction within the prescribed period.
On the other hand, where the customer’s own negligence contributed to the loss—for example, sharing payment credentials—the customer may bear the loss until the transaction is reported to the bank.
Therefore, proving that a fraudster committed a crime does not automatically determine who bears the financial loss.
What Should You Do After Online Banking Fraud?
A victim should act immediately rather than waiting for the next bank statement.
Important steps include:
- Immediately notify the bank through its official channel.
- Ask the bank to block affected cards or digital banking facilities where necessary.
- Obtain a complaint or reference number.
- Report the incident through the appropriate cybercrime or law-enforcement channel.
- Preserve transaction IDs, screenshots, messages, emails and phone numbers.
- Change compromised passwords and credentials.
- Monitor the account for additional unauthorised transactions.
- Follow up with the bank in writing.
RBI advises customers to report unauthorised electronic transactions immediately because delay can increase potential losses.
What Evidence Is Useful in a Criminal Case?
Digital evidence can be particularly important in online banking fraud cases.
Victims should preserve:
- Bank statements
- Transaction reference numbers
- UPI IDs or beneficiary details
- SMS and email alerts
- Screenshots
- Fraudulent website or link details
- Phone numbers and email addresses used by the fraudster
- Chat records
- Details of when the bank was notified
- Bank complaint/reference numbers
Investigators may use such information to trace transactions, devices, accounts and communications connected with the alleged fraud.
Can the Stolen Money Be Recovered?
Recovery may be possible, but it is not guaranteed.
The victim should report the transaction immediately to the bank and appropriate authorities. Prompt reporting can help initiate measures concerning the fraudulent transaction and, where possible, trace or restrict movement of the funds.
RBI’s framework also provides specific customer-liability protections for qualifying unauthorised electronic transactions.
The eventual recovery of money depends on factors such as the reporting time, nature of the fraud, location of the funds, investigation and applicable banking rules.
Is Every Online Banking Dispute a Criminal Case?
No.
A transaction dispute does not automatically establish criminal fraud. There must be facts supporting the ingredients of a specific offence.
For example, a genuine contractual disagreement with a bank, an incorrect charge or a failed transaction may require a banking or civil remedy rather than criminal prosecution.
Criminal liability generally depends on evidence of conduct satisfying the requirements of the applicable offence.
Conclusion
Online banking fraud can be a criminal offence in India. Depending on the circumstances, fraudulent online banking activity can involve cheating or personation under the BNS and identity theft, computer-related offences or online personation under the Information Technology Act.
However, criminal liability and bank liability for the financial loss are separate questions. RBI provides protections for customers facing unauthorised electronic transactions, while customer negligence can affect the amount the customer is required to bear.
The most important practical step after discovering online banking fraud is immediate reporting. The victim should notify the bank, preserve digital evidence, secure the affected account and report the incident to the appropriate cybercrime or law-enforcement authority.
Ultimately, whether a particular incident constitutes a criminal offence depends on the method of fraud, evidence of deception or unauthorised access, use of digital credentials, financial loss and the specific legal provisions applicable to the facts.
