India Is Now Asia-Pacific's Biggest Mobile Fraud Target. The State's Response Remains Cosmetic
Editor-in-Chief of indiacommentary.com. Current Affairs analyst and political commentator. Author of Cyber Scams in India, Digital Arrest, The Money Trap and The Human Hack
View all posts by this Author
By Sunil Garodia
First publised on 2026-08-27 05:01:06
About the Author
Editor-in-Chief of indiacommentary.com. Current Affairs analyst and political commentator. Author of Cyber Scams in India, Digital Arrest, The Money Trap and The Human Hack
View all posts by this Author
India recorded 18,187 mobile threat detections in the first quarter of 2026, the highest of any market in the eight-country Asia-Pacific study conducted by Kaspersky. Indonesia followed at 15,163. Between them, the two countries account for the bulk of mobile threat volume in the region. The numbers are not surprising. They are confirmation of a trend this publication has tracked for three years: India's smartphone economy has outgrown its smartphone security.
The headline count is the least alarming part of the report. The more damning figure is buried in the detail. Across the eight markets studied, the average number of threat detections per affected user rose 49 percent year on year, from 4.9 to 7.3. This increase came even as the total number of users encountering any threat at all declined. Read plainly, that means cybercriminals are not casting wider nets. They are picking fewer targets and hitting them harder, repeatedly, until the fraud succeeds. This is not opportunism. It is targeting.
Kaspersky's researchers point to a specific toolkit driving this shift in India: the Rewardsteal Trojan, which poses as a giveaway or cashback application to harvest banking credentials, and a resurgent Thamera Trojan, which hijacks compromised devices to mass-produce fraudulent social media accounts. Both are distribution multipliers. A single successful infection does not just empty one account. It becomes infrastructure for the next thousand phishing links, sent through messaging apps, SMS and fake job offers. Choon Hong Chee, Kaspersky's head of consumer channel for the region, described this as cybercriminals combining stealthy attack techniques, persistent malware and AI-powered deception. That last element deserves attention. A separate global Kaspersky study on messaging-app fraud found that two out of three victims believed artificial intelligence had been used against them, most often through AI-written messages, cloned voices or deepfake video. More than half of successful scams run their entire course, from first contact to the money leaving the account, in under thirty minutes.
None of this is happening in a vacuum. The Ministry of Home Affairs told Parliament that India's reported cyber fraud losses rose 206 percent between 2023 and 2024, from Rs 7,465 crore to Rs 22,845 crore, with case volume climbing from 24 lakh to 36 lakh over the same period. The Indian Cyber Crime Coordination Centre projects losses could approach Rs 1.2 lakh crore for 2025, close to 0.7 percent of GDP. Set against that trajectory, the Kaspersky data is not a warning of what is coming. It is a description of what is already here.
The government's own instruments show the shape of the problem without confronting its scale. The Citizen Financial Cyber Fraud Reporting and Management System, in operation since 2021, has helped save a little over Rs 7,000 crore across 23 lakh complaints. The Financial Fraud Risk Indicator, built with the Reserve Bank of India and the National Payments Corporation of India, prevented Rs 660 crore in losses over six months. Both are real achievements. Both are also arithmetic footnotes against a fraud economy running into tens of thousands of crores a year. The state is intercepting the outflow after the transaction. It is not disrupting the funnel before the transaction happens, which is where Rewardsteal and Thamera do their work.
This publication has argued before, in the course of documenting cyber fraud patterns across three languages, that India's regulatory architecture treats mobile fraud as a banking-sector problem to be solved with post-facto freezes and helpline numbers. It is not a banking problem. It is a telecom, app-store and platform-liability problem that banking is left to clean up. Fraudulent applications that impersonate reward programmes reach users through app stores that do not verify publisher intent, through SMS gateways that do not authenticate senders, and through social media accounts that Thamera itself manufactures at scale to look legitimate. Every one of those choke points sits with a regulator or a platform that faces no meaningful liability when it fails to hold the line.
The Kaspersky report should be read as a scorecard, not a curiosity. India tops the region on mobile threats because India has built the region's largest attack surface without building matching gatekeeping at the app-store, telecom and platform layer. Until that changes, next year's report will carry a higher number, and the government's response will again arrive after the money is gone.
