Cyber Insurance in India: Will It Pay You Back After a UPI Scam?

I have spent the better part of three years reading cybercrime complaints and talking to victims of online fraud in India. And there is one question that comes up more often than almost anything else, especially after someone has already lost money:

“Is there some kind of insurance for this?”

The answer is yes. Cyber insurance exists in India. Multiple insurance companies sell it. Some policies cost less than a thousand rupees a year. And yet, almost nobody buys it. The ones who do often discover at claim time that what they assumed was covered is not.

This article is going to be honest with you about what cyber insurance in India can and cannot do. I am not going to sell you a policy. I am going to tell you what I have seen, what the fine print actually says, and whether it makes sense for someone like you.

What Is Cyber Insurance? In Simple Terms

Cyber insurance is a policy that pays you money if you suffer a financial loss because of a cyber event. That sounds broad, and it is intentionally so, because different insurers define “cyber event” differently.

At its core, the idea is simple. If someone hacks your email and transfers money out of your account, or if you fall for a phishing attack and lose funds, the insurance company reimburses part or all of the loss. Some policies also cover identity theft, social media hacking, cyber extortion, and even legal costs if you need to go to court.

In countries like the US and UK, cyber insurance has been around for over a decade, mostly sold to businesses. In India, it is still relatively new for individuals, and most people have never heard of it.

Which Companies Offer Cyber Insurance for Individuals in India

As of 2026, these are the main insurers offering standalone cyber insurance policies for individual buyers:

• HDFC Ergo offers a policy called Cyber Sachet. It is one of the most widely discussed individual cyber insurance policies in India and covers a broad range of cyber events including identity theft, phishing, and financial fraud.
• Bajaj Allianz has an individual cyber insurance plan that covers unauthorized digital transactions, email spoofing, cyber extortion, and media liability related to online activities.
• ICICI Lombard offers cyber risk insurance for individuals that includes financial loss from phishing, vishing, and SIM swap fraud, along with identity theft expenses.
• SBI General has entered the market with a cyber insurance product aimed at individual digital banking users, covering online banking fraud and UPI-related incidents.
• IFFCO Tokio offers cyber insurance with coverage for social media identity theft and cyber stalking, in addition to standard fraud coverage.

Some of these policies start at around ₹500 to ₹700 per year for basic coverage of one to two lakh rupees. Higher coverage of five to ten lakh rupees costs more, typically between ₹2,000 and ₹5,000 per year depending on the insurer and plan.

What Does Cyber Insurance Actually Cover

This varies from policy to policy, but most individual cyber insurance plans in India cover the following:

• Unauthorized digital transactions: If someone gains access to your bank account, credit card, or UPI and makes transactions without your consent, the insurer covers the financial loss.
• Phishing and vishing: If you receive a fake email, SMS, or call that tricks you into sharing your banking credentials, and money is then stolen, this is typically covered.
• Identity theft: If someone uses your personal data to open accounts, take loans, or commit crimes in your name, the policy may cover expenses related to restoring your identity and any legal fees.
• Cyber extortion: If someone threatens to release your personal data or photos unless you pay, some policies cover the extortion amount and related counseling expenses.
• Social media hacking: If your social media account is hacked and used to damage your reputation, or if someone creates fake profiles in your name, some policies offer coverage for related expenses.
• Malware and ransomware damage: If malware damages your devices or encrypts your data, certain policies cover the cost of data recovery or device replacement.
• Legal costs: If you need to hire a lawyer because of a cyber incident, some policies reimburse legal fees up to a specified limit.

What Cyber Insurance Does NOT Cover and This Is Where Most People Get Disappointed

Here is the part that matters most, and the part that most people do not read before buying:

• Losses where you voluntarily shared your OTP or password: This is the biggest exclusion and the one that catches the most victims. If a scammer called you, pretended to be from your bank, and convinced you to read out your OTP, most insurers will argue you voluntarily shared the credential. Your claim may be denied. This is exactly how most UPI fraud works in India, which means the most common type of scam affecting Indians right now may not be covered.
• Losses from investing in fraudulent platforms: If you put money into a fake trading app, a Telegram task scam, or an IPL betting app, that is not a hack. You transferred the money yourself. Most policies do not cover this.
• Losses from cryptocurrency transactions: Most Indian insurers explicitly exclude crypto-related fraud from individual cyber insurance policies.
• Pre-existing incidents: If the fraud happened before the policy start date, it is not covered, even if you discover it later.
• Losses exceeding the coverage limit: If your policy covers two lakh rupees and you lose five lakh, you only get two lakh.
• Business losses: Individual policies do not cover losses related to your business, freelancing income, or professional activities. For that, you need a commercial cyber insurance policy.
• Waiting period: Some policies have a waiting period of 15 to 30 days after purchase, during which claims are not accepted.

I want to be direct about this. The majority of online fraud cases I have seen at ScamDekho would fall into one of these exclusion categories. It does not mean cyber insurance is useless. It means you need to know exactly what scenario your policy covers before you assume you are protected.

Is Cyber Insurance Worth It for You

This depends on who you are and what risks you face.

• It probably makes sense if you regularly shop online with multiple cards, use several banking apps, and your exposure to digital fraud is high. For someone handling lakhs of rupees through UPI every month, a policy that costs 1,500 rupees a year for five lakh coverage is not a bad tradeoff, assuming the policy covers the specific risks you face.
• It also makes sense if you are a senior citizen or someone who is not very comfortable with digital transactions but is forced to use them. The risk of unknowingly clicking a phishing link or falling for a fake app is higher for this group.
• It may not be necessary if you use only one bank account, rarely transact online, and already follow basic digital safety practices. The premium might be low, but the probability of an eligible claim is also very low.

And it is definitely not a substitute for being careful. No insurance company is going to reimburse you if you ignored every red flag and sent money to a stranger on WhatsApp. Insurance works as a safety net for situations where you did everything right and still got hit.

How to File a Cyber Insurance Claim

If something does happen and you believe it is covered by your policy, here is the general process:

• File a complaint with the police and cybercrime cell immediately. Call 1930 and register your complaint at cybercrime.gov.in. Get the complaint number.
• Inform your bank and request them to flag the transaction and freeze the recipient account if possible.
• Notify your insurance company within the time window specified in your policy. Most insurers require notification within 24 to 72 hours of the incident. Late reporting is one of the most common reasons for claim rejection.
• Gather all evidence. Transaction screenshots, bank statements showing the fraud, cybercrime complaint receipt, FIR if filed, communication records with the scammer, and any other relevant proof.
• Fill out the claim form provided by the insurer. Attach all supporting documents.
• Wait for the investigation. The insurer will verify the incident, check whether it falls within coverage, and may ask for additional documents. The process usually takes 15 to 45 days.

One important thing. If the police or bank manage to recover the stolen money, the insurer will deduct that amount from your claim payout. You are not going to get double compensation.

What I Actually Recommend to People Who Ask

When someone who has just been scammed asks me whether they should buy cyber insurance, I tell them two things.

First, file your complaint right now. Insurance is not going to help you with an incident that already happened. Focus on recovery through the cybercrime helpline.

Second, before you buy a policy, read the exclusions page. Not the brochure. Not the advertisement. The exclusions. If you understand exactly what is not covered and you are comfortable with that, buy the policy. If you read the exclusions and realize that the exact scenario you are worried about is not covered, then the policy is not for you.

Prevention is cheaper and more reliable than insurance. Checking a suspicious link before clicking it takes ten seconds. Verifying a payment screenshot before handing over goods takes thirty seconds. These small habits prevent the kinds of losses that insurance often refuses to cover anyway.

The goal is not to become paranoid. The goal is to build a few simple habits that make you a harder target. Insurance is a backup for the rare case where those habits are not enough.

Frequently Asked Questions