Two rules for fraud victims

The IDFC First Bank fraud has angered many people. I am angry too. But here is the interesting question: why exactly are people angry? The fraud itself, Rs 590 crore siphoned from Haryana government accounts through the bank's Chandigarh branch, apparently by employees colluding with outsiders, is dismaying but not surprising. Bank frauds of this kind have happened before and will happen again. That is not what is producing the fury on social media. What is producing it is something else entirely: Most of the funds were restored or secured within about a day. Haryana's Chief Minister announced that nearly Rs 556 crore had been restored almost immediately. The bank reimbursed the state, including interest. The RBI declared there was no systemic risk. Everyone moved on.

And that is precisely what is making ordinary people so furious. They are holding this story up against their own experience, and the contrast is unbearable.

Two years ago, I wrote in this column about the epidemic of digital financial scams targeting Indians. The scale was already huge then, and it has only grown. The government recently placed some numbers on the problem in Parliament. Over 4.5 years, from April 2021 to September 2025, cybercriminals defrauded Indian citizens of nearly Rs 3,588 crore across 5.83 lakh reported cases. The overwhelming majority involved internet banking fraud and online credit card scams. And of that Rs 3,588 crore? Exactly Rs 239 crore, or about 6.7 per cent, has been recovered. When an ordinary person is defrauded, the state recovers roughly six paise of every rupee stolen.

Six paise.

Now compare that to the IDFC case, where a government entity recovered 94 per cent of the money in a single day. Please note that a large portion of the money has not been recovered from the criminals – the bank reimbursed the Haryana Government from its own pocket almost immediately. Not just that, the next morning’s newspapers had full-page ads from the bank patting itself on the back over the whole affair. The difference is not about the criminals' cleverness or the difficulty of tracing funds. In both cases, the money moves electronically through a KYC-compliant banking system where, in theory, every rupee should be traceable. The difference is about whose money it is and, therefore, how urgently institutions move.

I have written before about how the fundamental problem with financial fraud in India is not a lack of awareness but a lack of consequences. The channels of financial education are committed to politeness – they will teach you what to do but rarely warn you with sufficient force about what is being done to you. The scamsters who clean out a retired schoolteacher's savings via a fake FedEx call have enormous experience manipulating victims, but the victims have none. 

But another asymmetry receives less attention: enforcement asymmetry. When tens of thousands of ordinary Indians are robbed through cyber fraud, the cases pile up in overworked cybercrime cells, the stolen money vanishes through layered accounts and cash withdrawals, and victims are often told there is little hope of recovery. When a state government's accounts are compromised, forensic teams are deployed overnight, recall requests are sent to beneficiary banks immediately, and the Chief Minister holds a press conference to announce success within a day.

Suggested read: The old-fashioned art of the scam

What would actually change behaviour is what I would call visible punishment. Not just the filing of cases that drag on for years, but the kind of swift, public, headline-making arrests and convictions that create genuine fear among would-be fraudsters. The mathematics of cyber fraud currently favours the criminal: the expected value of stealing, given the near-certainty of keeping most of the money, vastly exceeds the risk of punishment. Until that calculation changes, no amount of awareness campaigns will make a meaningful dent.

The IDFC case, oddly, offers a useful illustration of what is possible when institutions are sufficiently motivated. The same banking infrastructure that enabled the theft also enabled the recovery. The technology exists. The legal frameworks exist. What appears to be missing is the will to extend the same urgency to cases involving ordinary citizens as to those involving government departments.

The anger on social media is not irrational. It is, if anything, a precise and accurate reading of a system that has built two different sets of rules – one for the powerful, and one for everyone else.

Also read: IndusInd Bank's wake-up call: Why we never recommended it