Glossary
The words you meet in a cyber crime complaint
Plain meanings, with the Hindi term where one is commonly used. If a police officer, banker or news report uses a word you do not know, it is probably here.
A
- Aadhaar biometric lock · आधार बायोमेट्रिक लॉक
- A free UIDAI setting (mAadhaar app or uidai.gov.in) that blocks fingerprint and iris authentication until you unlock it. It stops AePS withdrawals using leaked fingerprints.
- APK sideloading
- Installing an Android app from a file sent on WhatsApp or downloaded from a link instead of the Play Store. Almost every "bank KYC", "challan" or "wedding invitation" APK is malware that reads your SMS and OTPs.
- Authenticator app
- An app such as Google or Microsoft Authenticator that generates login codes on your phone. Unlike SMS OTPs, the codes cannot be intercepted by a SIM swap.
B
- BNS
- Bharatiya Nyaya Sanhita, 2023, which replaced the IPC; cheating, extortion, stalking and intimidation sections apply to most cyber crimes.
- BNSS
- Bharatiya Nagarik Suraksha Sanhita, 2023, which replaced the CrPC; governs FIRs, Zero FIRs and release of seized or frozen property.
- BUDS Act
- Banning of Unregulated Deposit Schemes Act, 2019: makes it an offence to run or promote a deposit scheme that is not registered with a regulator. Used against Ponzi and "guaranteed return" apps.
- Business email compromise (BEC)
- Fraud where an attacker controls or imitates a company or supplier mailbox to redirect payments, typically by changing bank details on an invoice.
C
- Call spoofing
- Making a call appear to come from a different number, such as a bank's helpline or a +91 landline. Indian telecom rules now block most international calls showing Indian numbers, but it still happens.
- CEIR
- Central Equipment Identity Register, used to block a lost or stolen phone by IMEI on all networks.
- CERT-In
- Indian Computer Emergency Response Team, the national incident-response agency; organisations must report incidents to it within six hours.
- CFCFRMS
- Citizen Financial Cyber Fraud Reporting and Management System: the I4C platform behind 1930 that passes complaints to banks for freezing funds.
- Chakshu
- The Sanchar Saathi facility for reporting suspected fraud calls, SMS and WhatsApp messages before any loss.
- Chargeback
- A reversal of a card payment requested through your bank, usually for a fraudulent or undelivered transaction. Must be raised within the card network's time limit, so report quickly.
- CIBIL dispute
- A correction request to a credit bureau (CIBIL, Experian, Equifax, CRIF) when a loan you never took appears on your report, typically after identity theft or a fraud loan app.
- CSAM
- Child sexual abuse material. Possessing, sharing or searching for it is an offence under the POCSO Act and the IT Act; report to cybercrime.gov.in, which allows anonymous reporting.
- Cyber cell · साइबर सेल
- A police unit that handles cyber complaints, either at district level or as a dedicated cyber police station. The cell takes complaints, requests data from platforms and coordinates bank freezes.
- Cyber insurance
- An insurance policy that covers losses from online fraud, identity theft or data breaches. Retail policies in India typically require an FIR or 1930 complaint before paying out.
D
- Data principal / data fiduciary
- DPDP Act terms: the data principal is the person the data is about; the data fiduciary is the company or body that decides how it is processed and carries the legal duties.
- Deepfake · डीपफेक
- AI-generated video or audio that makes a real person appear to say or do something they did not.
- Digital arrest · डिजिटल अरेस्ट
- A scam in which callers posing as police or agency officers keep a victim on a video call, claim they are under arrest, and extort money. No such procedure exists in Indian law. Read more →
- Digital lending guidelines (RBI)
- RBI rules that require lending apps to disburse and collect only through regulated entities, disclose all charges, and not access your contacts or photos. Apps that break them are usually illegal lenders.
- Doxxing
- Publishing someone’s private details (address, phone, workplace) online to intimidate or enable harassment.
- DPDP Act
- Digital Personal Data Protection Act, 2023: India’s data protection law, with consent, purpose limitation, breach notification and penalties up to ₹250 crore.
E
- e-KYC
- Electronic identity verification using Aadhaar OTP or video, done inside the bank or telecom's own app or branch. It is never done through a link sent on WhatsApp or SMS.
F
- Family safe word
- A word agreed within a family that anyone calling with an "emergency" must know; defeats voice-clone scams.
- FIR · एफआईआर
- First Information Report, the document that starts a police investigation. A portal complaint is not an FIR.
G
- Grievance officer
- The person every large platform must appoint in India to receive complaints; contact details are on the platform’s help pages.
- Grooming
- Building trust with a child online over time to lead to sexual abuse or exploitation. Often starts in games or Instagram DMs; report to cybercrime.gov.in and Childline 1098.
H
- Hash value
- A fixed-length fingerprint (such as SHA-256) of a file or disk image. Recording it when evidence is collected proves the copy was not altered later.
- Honeytrap
- A scam where a fake romantic or flirtatious contact draws a target into sharing intimate images or secrets, then blackmails them. The usual start of sextortion.
I
- I4C
- Indian Cyber Crime Coordination Centre, the MHA body that runs 1930, the NCRP and the bank-freeze system.
- IMEI
- The 15-digit identity number of a handset; dial *#06# to see it. Needed to block a stolen phone.
- Impersonation profile
- A fake social-media account using your name and photos, often used to ask your contacts for money. Platforms remove them on report with a copy of your ID.
- Intermediary
- A platform that hosts user content (WhatsApp, Instagram, X, marketplaces). Under the IT Rules 2021 it must have a grievance officer and remove content on valid notice.
- IPC vs BNS
- The Indian Penal Code was replaced by the Bharatiya Nyaya Sanhita on 1 July 2024. Offences before that date are charged under IPC sections; later ones under BNS, so section numbers in FIRs differ.
- ISEA
- Information Security Education and Awareness, the MeitY programme behind infosecawareness.in that publishes free cyber safety material for citizens and schools.
- IT Act
- Information Technology Act, 2000: India’s primary law on computer-related offences, electronic records and intermediaries.
J
- Juice jacking
- Tampered public USB charging ports that can push malware or copy data. Rare but easy to avoid: use your own adaptor or a charge-only cable.
K
- KYC
- Know Your Customer, the identity verification banks and telecoms must do. "KYC expiry" messages with links are almost always scams.
L
- Lien (freeze)
- A hold placed by a bank on money in an account, usually after a 1930 complaint, so it cannot be withdrawn while the case is examined. Frozen money is not automatically returned.
- Lien release (CFCFRMS)
- The process of getting money that was frozen after a 1930 complaint returned to you. It usually needs an FIR and a court order or police request to the bank; the freeze alone does not refund anything.
- Link shortener (in smishing)
- Services such as bit.ly that hide the real destination of a link. Legitimate banks and government bodies do not send shortened links in SMS; treat one as a warning sign.
- Loan-app harassment
- Illegal lending apps that take your contacts and photos at install, then threaten and defame you to extract many times the loan.
- Lookalike domain
- A web address built to resemble a real one, such as sbi-kyc-update.com or a .in instead of .gov.in. Check the part just before the first slash; official Indian government sites end in gov.in or nic.in.
M
- Malware · मैलवेयर
- Any software written to harm or spy: viruses, trojans, spyware, ransomware and the SMS-stealing APKs behind most Indian banking fraud.
- Money mule
- A person who lets fraud money pass through their bank account, knowingly or after being told it is a "job". Mules face account freezes and criminal charges even if they kept little of the money.
- Mule account · म्यूल अकाउंट
- A bank account, often rented or opened with stolen identity, used to receive and move fraud proceeds so the real criminals stay hidden.
N
- NCII
- Non-consensual intimate imagery: private images shared without consent. Platforms remove it on report; StopNCII blocks re-uploads.
- NCRP
- National Cyber Crime Reporting Portal, cybercrime.gov.in, where any cyber crime can be reported online.
- NPCI
- National Payments Corporation of India, the body that runs UPI, RuPay, IMPS and AePS. It sets the rules banks and apps follow, including dispute handling.
O
- OSINT
- Open-source intelligence: investigating using publicly available information, a core skill in cyber crime investigation.
- OTP · ओटीपी
- One-time password sent by SMS or app to authorise a transaction or login. Nobody legitimate ever asks you to share it.
P
- Parcel scam
- A call claiming a courier parcel in your name contains drugs or illegal items, which is then "transferred" to fake police. The standard opening of a digital-arrest extortion.
- PCI DSS
- Payment Card Industry Data Security Standard: the rules any business storing or processing card data must follow. Compliance is required by card networks, not by Indian law directly.
- Phishing · फ़िशिंग
- Fake emails, messages or websites that imitate a trusted organisation to steal passwords, OTPs or payment details. Read more →
- Pig butchering
- A long-con investment scam: the victim is "fattened" with a relationship and small fake profits before a large loss.
R
- Ransomware
- Malware that encrypts files and systems and demands payment; modern groups also steal data first and threaten to leak it.
- Remote access app
- Software such as AnyDesk or TeamViewer that lets someone else see and control your phone or computer. Scammers ask you to install it to "fix" a bill or "verify" an account, then read your OTPs.
S
- Screen sharing
- Showing your screen to another person on a video call. If you share while opening a banking app, the caller sees your balance, OTPs and PIN entry.
- Section 63 BSA certificate
- The certificate under the Bharatiya Sakshya Adhiniyam, 2023 (formerly s.65B Evidence Act) that makes electronic records admissible in court.
- Sextortion · सेक्सटॉर्शन
- Blackmail using real, recorded or faked intimate images or videos, usually after a video call from a stranger. Read more →
- SIM binding
- A security feature where a payment app works only on the phone that holds the registered SIM. It is why UPI stops working after a SIM swap and why fraudsters want your physical SIM replaced.
- SIM swap
- Obtaining a duplicate SIM for your number on forged documents so that calls and OTPs go to the attacker.
- Smishing
- Phishing by SMS, usually with a short link to a fake login or payment page.
- SOC
- Security Operations Centre: a team and toolset that monitors an organisation's systems around the clock for attacks and responds to alerts.
- Spoofed sender ID
- An SMS that appears to come from a bank's header such as "SBIINB" but was sent by a fraudster. TRAI header rules reduce this, but a familiar sender name alone does not make an SMS genuine.
- Stalkerware
- Apps secretly installed on a phone to monitor location, messages and calls, often by a partner or family member.
- Suspect Registry (I4C)
- A national database run by I4C of phone numbers, bank accounts and identifiers linked to reported cyber fraud, shared with banks and telecoms so they can block or flag them.
T
- TAFCOP
- Sanchar Saathi tool that lists every mobile number issued against your identity and lets you report ones that are not yours.
- Takedown notice
- A formal request to a platform or host to remove content, such as an impersonation page, leaked images or a phishing site. Under the IT Rules 2021 platforms must act on valid notices within set timelines.
- Task scam
- A "part-time job" that pays small amounts for liking videos or rating products, then demands deposits to unlock larger "tasks".
- Two-factor authentication (2FA)
- A second check beyond the password, such as an authenticator-app code. An authenticator app is safer than SMS.
U
- UPI
- Unified Payments Interface, the instant bank-to-bank payment system. Entering a UPI PIN always sends money; it is never needed to receive.
- UPI collect request
- A request from another UPI user asking you to pay them. Approving it with your PIN sends money out. "Receive ₹5,000, enter PIN" is always a scam; no PIN is ever needed to receive.
- UPI PIN · यूपीआई पिन
- The 4- or 6-digit code that authorises a UPI payment. It is entered only inside your payment app, never on a call, a website or a form.
V
- VAPT
- Vulnerability Assessment and Penetration Testing: a structured security test of applications, networks or cloud, producing ranked findings and fixes.
- Vishing
- Phishing by voice call: a caller pretending to be the bank, police or a courier company.
- Vishing script
- The rehearsed call flow fraudsters follow: a hook (blocked card, parcel, lottery), a reason for urgency, and a request for a code or payment. Recognising the structure is the best defence.
- Voice cloning
- Using a few seconds of recorded speech to generate a synthetic voice that sounds like a specific person, used in "family emergency" scams.
- VPN
- Virtual private network: encrypts your internet traffic and hides your location from websites. Useful on public Wi-Fi, but it does not protect you from phishing or a malicious app.
Z
- Zero-day
- A software vulnerability that is being exploited before the vendor has released a fix. Keeping phones and apps updated closes zero-days once patches arrive.
- Zero FIR
- An FIR registered at any police station regardless of where the crime happened, to be transferred to the right station. Any station must register one.