Top 10 AI Scams Hitting India in 2026 (And the 30 Seconds That Stop Each One)
Indians lost ₹22,495 crore to cyber fraud in 2025. That is the Ministry of Home Affairs' own number, across 28.15 lakh reported cases — a 24% jump in cases over the previous year.
What changed is not that criminals got greedier. It is that AI made the two hardest parts of a scam cheap: sounding like someone you trust, and looking like an institution you fear. A voice clone now takes seconds of audio. A fake police officer on video call now costs nothing to produce.
On 28 July 2026, the Supreme Court told Parliament to make "digital arrest" a standalone criminal offence and to legislate specifically on deepfakes. Chief Justice Surya Kant suggested freezing an accused's assets once a prima facie case appears. The Solicitor General confirmed a draft bill is being prepared. When the country's highest court asks for a new category of crime, the crime has already outgrown the old law.
This is the field guide. Ten scams currently running in India, what each one actually looks like, the single tell that gives it away, and the 30 seconds that stop it. There is an interactive test halfway down — most people get at least one wrong.
What the data actually says
The shape of Indian cyber fraud is lopsided, and knowing the shape tells you where to be careful. Investment fraud is 35% of cases but 76% of the money. Sextortion is 19% of cases but only 4% of the money. Digital arrest sits at 6% of cases and 9% of losses — rare, but ruinous when it lands.
Read that chart once more before you scroll. If you only harden yourself against one thing this year, harden yourself against being sold an investment by a screen.
Test yourself first: would you have caught it?
Six real-world patterns. Decide before you open the answer. No score is kept, nothing is sent anywhere — this is just you and your own reflexes.
1. Your mother calls. Her voice, her number, crying. She says she is at a police station and needs ₹40,000 transferred right now. Scam or safe?
Caller ID is trivially spoofed and a voice clone needs only a few seconds of audio — a reel, a wedding video, a voice note forwarded in a family group. The tell is not the voice. It is the combination of distress plus urgency plus a payment. Hang up, call her back on the number you already have saved, and wait for her to pick up. If a real emergency exists, it survives a two-minute callback.
2. A video call from a uniformed officer. Your Aadhaar, he says, was used in a money-laundering case. He shows a court document with your name on it and tells you to stay on camera until the verification finishes. Scam or safe?
This is a digital arrest, and the giveaway is the instruction itself. No Indian police force, no court, and no agency conducts an arrest, an interrogation or a "verification" over a video call, and none of them will ever tell you to stay on camera or keep it secret from your family. The document is forged; forged documents are the standard prop. Disconnect. Then call 1930.
3. An ad shows a well-known Indian business figure on a news channel backdrop announcing a trading platform that pays 8% a week. The video looks real. Scam or safe?
Investment fraud is 76% of all money lost to cyber crime in India, and deepfaked endorsements are its engine. The tell is arithmetic, not video quality: 8% a week compounds to well over 5,000% a year. No legitimate product produces that. Check whether the entity is SEBI-registered before you check whether the face is real — the registration is easier to verify and it settles the question.
4. A wedding invitation arrives on WhatsApp from an unknown number. It is a file called Invitation.apk. Scam or safe?
An invitation is a PDF, a JPG or a link. An APK is an Android application. Installing it typically grants SMS access, which means your bank OTPs are read before you ever see them. Same trick, different costume: fake e-challan apps, fake courier apps, fake electricity-bill apps. Rule with no exceptions: never install an APK sent in a chat, from anyone, ever.
5. You Google a food-delivery company's helpline, call the first number, and the agent asks you to install a screen-sharing app so he can process your refund. Scam or safe?
Fake customer-care numbers are seeded into search results, listings and comment sections precisely so you will find them at your most frustrated. The tell is universal: no genuine support agent needs to see your screen or your banking app. Refunds are issued to the original payment method without you touching anything. Get helpline numbers only from inside the company's own app.
6. Your bank's app shows a notification: "KYC expiring today. Update to avoid account freeze." You open the app directly and complete it there. Scam or safe?
Opening your bank's own app yourself and acting inside it is the correct behaviour. What makes KYC scams work is the link — an SMS or WhatsApp message with a URL, or a call telling you to click one. The action is fine. The channel is what gets people. If a message pushed you somewhere, that is the scam; if you navigated there yourself, it is not.
If you answered "scam" to all six, you would have been wrong once — number six. That is the point. Constant suspicion is not the skill. Knowing which specific signal matters is.
The 10 scams, in the order they will reach you
1. Digital arrest
Highest loss per victim
How it works. A call claims to be from a courier company: a parcel in your name contains contraband. It is transferred to someone in a police uniform on video, in a room built to look like a station. Over hours — sometimes days — you are kept on camera, told not to contact anyone, shown forged court orders and arrest warrants with your name on them, and eventually told to move your money to a "safe government account" for verification. It is returned after the case closes. There is no case, and it is never returned.
2. The AI voice-clone emergency
Fastest growing
How it works. A few seconds of someone's voice — scraped from a reel, a story, a forwarded voice note — is enough to generate convincing speech. The call comes with a spoofed number, background noise engineered to sound chaotic, and a story with a clock on it: an accident, a police station, a hospital, a kidnapping. The voice will often be crying, which conveniently disguises the small imperfections a clone still has.
3. Deepfaked investment endorsements
76% of all money lost
How it works. A short video of a recognisable Indian business leader, anchor or actor appears in your feed, apparently on a news channel, announcing a trading platform or "AI wealth engine". The face and voice are synthetic. Click through and you reach a slick app, a WhatsApp group full of enthusiastic strangers, and a dashboard that shows your balance rising beautifully. Small withdrawals work — that is what buys your trust. Large ones trigger a "tax", a "clearance fee", a "margin call". Then silence.
4. The relationship that becomes a portfolio
Weeks of grooming
How it works. A wrong-number message, a matrimonial profile, or a friendly stranger on a dating app. Weeks of genuine-feeling conversation follow, with no money mentioned at all. Then, casually, a mention of trading gains — a family platform, an uncle's tip, a private crypto exchange. You are walked through a small first deposit that returns a profit. The relationship is the product; the platform is the exit.
5. The part-time job that pays you first
Targets students
How it works. A WhatsApp or Telegram message offers simple paid tasks: like videos, rate hotels, complete "prepaid orders". The first few tasks genuinely pay — ₹150, ₹300, credited within minutes. Then the tasks become "merchant tasks" requiring you to deposit money to unlock a bigger commission. Your dashboard shows a growing balance you cannot withdraw until you complete one more level, which requires one more deposit.
6. The APK in your chat
Instant account drain
How it works. A file arrives on WhatsApp: a wedding invitation, a traffic e-challan, a courier update, a bank statement. It is an .apk — an installable Android app. Once installed and granted permissions, it can read your SMS, which means it reads your OTPs. Money can leave your account before your phone shows you a single message.
7. The helpline that is not the helpline
Finds you when you are annoyed
How it works. Fraudsters seed fake customer-care numbers into search results, business listings, forum answers and comment sections for banks, airlines, wallets and delivery apps. You call in a moment of frustration. The agent is calm, competent, and asks you to install a screen-sharing or "remote support" app so he can process your refund. What he sees is your banking app; what he captures is your credentials.
8. The boss on a video call
Business payments
How it works. An employee in finance joins a video call with people who look and sound like senior colleagues, and is instructed to make an urgent confidential transfer — an acquisition, a regulatory deposit, a vendor emergency. The faces are synthetic, assembled from public video. This one does not target the reckless; it targets the diligent, because diligence in a hierarchy means doing what a senior person on camera tells you.
9. Fake AI apps and clones
Rides every AI news cycle
How it works. Every time a new AI tool trends, dozens of clones appear within days — same icon, near-identical name, thousands of installs bought in bulk. Some are simply subscription traps that bill you weekly. Others harvest photos, contacts and clipboard data. The "AI photo editor" and "AI companion" categories are the worst offenders, because both invite you to hand over images voluntarily.
10. Sextortion with synthetic images
19% of all cases
How it works. A short video call from an unknown number, sometimes not answered for more than a second. Later, a message arrives with an explicit image or clip that appears to show you — generated or face-swapped from your public photos — plus a list of your contacts and a demand for money. Sometimes the caller claims to be police, offering to "settle" the case.
Anatomy of a digital arrest
Every version of it follows the same five moves. Recognising move two is enough to end it.
The golden hour: what to do in the first 60 minutes
If money has already left your account, speed is the only variable you still control. Banks and the police can freeze funds in transit, but the window is short and it closes as the money is layered across mule accounts. Work down this list in order — tick them off as you go.
Immediate actions
- Call 1930. The national cyber crime helpline. It exists specifically to trigger a freeze request on the receiving account. Call it before anything else, including before you feel ready to explain what happened.
- File at cybercrime.gov.in. The National Cyber Crime Reporting Portal, run by the Ministry of Home Affairs. Choose "Financial Fraud". Keep the acknowledgement number.
- Tell your bank in writing. Not only the phone call. Use the app's or the net-banking portal's dispute form so there is a timestamped record of when you reported it.
- Freeze the channel. Block the card, disable UPI, or lock net banking from inside your bank's own app.
- Screenshot everything. Numbers, chats, UPI IDs, transaction references, app names, links. Do it before you block anyone, because blocking can hide the history.
- Report the number on Chakshu. At sancharsaathi.gov.in, the Department of Telecommunications portal for reporting fraudulent calls and messages. It also lets you check which mobile connections are registered against your own ID and disown any you did not take.
- If an app was installed, take the phone off the network. Turn on aeroplane mode, then uninstall from Safe Mode, then change passwords from a different device.
- Tell one person. Shame is the reason most of these go unreported, and unreported means unfrozen. Say it out loud to someone within the hour.
Three things worth doing today, while nothing is wrong
Prevention here is unusually cheap, because all three take minutes and none of them cost anything.
- Agree a family safe word. One word, shared verbally, never written in a chat. Any emergency call demanding money must produce it. This single habit defeats voice cloning outright.
- Check your own mobile connections. Sanchar Saathi's "Know Your Mobile Connections" shows every number registered against your identity document. People routinely find connections they never took. Disown them there.
- Turn off "install unknown apps". On Android, revoke it for WhatsApp, Telegram and your browser. It removes the entire APK category of attack in about forty seconds.
Where to report, officially
1930 — National cyber crime helpline. For money already lost. Call first.
cybercrime.gov.in — National Cyber Crime Reporting Portal, Ministry of Home Affairs. Categories for financial fraud, crimes against women and children (with an anonymous option), and other cyber crime. It also hosts a searchable repository of reported cyber-criminal identifiers, and a "Report Suspect" route for numbers, emails and URLs.
sancharsaathi.gov.in — Department of Telecommunications. Chakshu for reporting fraudulent calls and messages, CEIR for blocking a lost or stolen handset by IMEI, and Know Your Mobile Connections for auditing numbers issued against your ID.
All three are free government services. None of them will ever ask you for an OTP.
Frequently asked questions
Can police in India really arrest someone over a video call?
No. There is no provision in Indian law for an arrest, an interrogation or a custodial "verification" conducted over a video call, and no agency operates that way. Any call that uses the phrase, or that instructs you to remain on camera and stay silent about it, is fraudulent regardless of how convincing the uniform, the room or the paperwork looks.
How much audio does an AI voice clone need?
Very little — seconds rather than minutes, and public reels, stories and forwarded voice notes are more than enough source material. This is why the defence cannot be "I would recognise my own family". The defence has to be procedural: call back on a saved number, and use a safe word.
I already sent money. Is it gone?
Not necessarily, and speed decides it. Reporting to 1930 and to your bank quickly can trigger a freeze on the receiving account before the funds are moved onward, and a meaningful amount is recovered or blocked this way each year. The chance falls sharply with every hour, so report before you have finished processing what happened.
Why do banks in India keep asking me to update KYC by SMS?
They generally do not. Genuine KYC prompts appear inside your bank's own app or on its official website. Unsolicited SMS and WhatsApp messages with links, and calls telling you to click one, are the standard delivery method for this scam. The safe habit is simple: never act on the link, always open the app yourself.
Is it worth reporting if the amount was small?
Yes. Reports feed the identifier repository that flags repeat mule accounts and numbers, so a small report can contribute to blocking a large one. Reporting the number on Chakshu takes under two minutes even when no money was lost.
Are deepfakes illegal in India?
As of August 2026 there is no dedicated deepfake statute. Cases are prosecuted under existing provisions on cheating, impersonation and information technology offences. On 28 July 2026 the Supreme Court urged Parliament to create a standalone offence for digital arrest and to legislate specifically on deepfakes, and the government confirmed a draft bill was being prepared. This is general information, not legal advice — consult a lawyer about any specific case.
What is the single most useful habit?
Refusing to act inside someone else's clock. Almost every scam on this list depends on compressing your decision into minutes. Any request that cannot survive a fifteen-minute pause and one verification call on a number you chose is not a request worth honouring.
The verdict
What AI changed is the cost of impersonation, not the structure of fraud. The structure is what it has always been: manufacture urgency, isolate the target, and move money to somewhere it cannot come back from. Every scam above is that same skeleton wearing a new face.
Which is oddly reassuring, because it means you do not have to keep up with the technology. You have to keep up with three questions: Who put me on a clock? Who told me not to tell anyone? And who wants me to move money to prove something? Anything answering yes to two of the three is a scam, and it does not matter how real the voice sounded.
Send this to the person in your family who is most likely to answer an unknown number. That is the whole point of it.
Figures cited are Ministry of Home Affairs data for 2025 as reported in August 2026, and the Supreme Court observations of 28 July 2026. Scam tactics change constantly — the reporting channels above do not.
Read next: Top 10 AI Tools That Actually Work in Indian Languages · Best Free AI Tools for Students in India · Top 10 Side Hustle Apps in India
Discussion
Tried one of these tools? Say what worked and what did not. Off-topic and promotional comments are removed.
Comments
Post a Comment