Two rules for fraud victims. IDFC Bank shows how some cases see swift action

The fraud itself— ₹590 crore siphoned from Haryana government accounts through the bank’s Chandigarh branch, allegedly by employees colluding with outsiders—is dismaying but not surprising. Bank frauds of this kind have happened before and will happen again. That alone is not what is driving the fury on social media.

What is driving it is something else entirely.

Most of the funds were restored or secured within about a day. Haryana’s chief minister announced that nearly ₹556 crore had been recovered almost immediately. The bank reimbursed the state, including interest. The Reserve Bank of India declared there was no systemic risk. Everyone moved on.

And that is precisely what is making ordinary people so furious. They are holding this story up against their own experience, and the contrast is unbearable.

Two years ago, I wrote in this column about the epidemic of digital financial scams targeting Indians. The scale was already enormous then; it has only grown since. The government recently placed numbers on the problem in Parliament. Through April 2021 to September 2025, cybercriminals defrauded Indian citizens of nearly ₹3,588 crore across 583,000 reported cases. The overwhelming majority involved internet banking fraud and online credit-card scams.

And of that ₹3,588 crore? Exactly ₹239 crore, or about 6.7%, has been recovered. When an ordinary person is defrauded, the system retrieves roughly six paise of every rupee stolen.

Now compare that with the IDFC case, where a government entity recovered 94% of the money in a single day. A large portion of the funds has not been recovered from the criminals; the bank reimbursed the Haryana government from its own pocket almost immediately. Not just that, the next morning’s newspapers carried full-page advertisements from the bank congratulating itself on the resolution.

The difference is not about the criminals’ cleverness or the difficulty of tracing funds. In both situations, money moves electronically through a KYC-compliant banking system where, in theory, every rupee should be traceable. The difference is about whose money it is, and therefore how urgently institutions act.

I have written before that the fundamental problem with financial fraud in India is not a lack of awareness but a lack of consequences. Financial-education campaigns are committed to politeness: they teach people what to do but rarely warn them, with sufficient force, about what is being done to them. The scamsters who empty a retired schoolteacher’s savings through a fake FedEx call possess enormous experience manipulating victims. The victims have none.

But another asymmetry receives less attention: enforcement asymmetry.

When tens of thousands of ordinary Indians are robbed through cyber fraud, cases pile up in overworked cybercrime cells. Stolen money disappears through layered accounts and cash withdrawals. Victims are often told recovery is unlikely. When a state government’s accounts are compromised, forensic teams are deployed overnight, recall requests are sent immediately to beneficiary banks, and the chief minister holds a press conference within a day to announce success.

What would actually change behaviour is what might be called visible punishment, not merely the filing of cases that drag on for years, but swift, public, headline-making arrests and convictions that create genuine fear among would-be fraudsters. The mathematics of cyber fraud currently favours the criminal: the expected value of stealing, given the near certainty of keeping most of the money, far exceeds the risk of punishment. Until that calculation changes, no amount of awareness campaigning will make a meaningful dent.

The IDFC case, oddly, offers a useful illustration of what is possible when institutions are sufficiently motivated. The same banking infrastructure that enabled the theft also enabled the recovery. The technology exists. The legal frameworks exist. What appears to be missing is the will to extend the same urgency to cases involving ordinary citizens as to those involving government departments.

The anger on social media is not irrational. It is, if anything, a precise reading of a system that appears to operate with two sets of rules—one for the powerful, and one for everyone else.

Dhirendra Kumar is founder and chief executive officer of Value Research, an independent investment advisory firm.