‘Mind arrest’: IIT Madras study explains how fraudsters exploit victims’ fear

Financial cybercrime victims in India are not necessarily careless or digitally unaware, with highly educated professionals also falling victim to fraud, an Indian Institute of Technology (IIT) Madras-led study has found. The researchers said fraudsters often exploit fear, stress, urgency and financial pressure to affect victims' decision-making.

The study found that high digital literacy does not necessarily protect individuals from cyber fraud. The victims interviewed included IT professionals, bankers, doctors, management and finance professionals, public-sector officers and people holding cybersecurity certifications.

Stress makes victims vulnerable

The researchers found that victims were often targeted during periods of stress or major changes in their lives. These included illness in the family, retirement, job searches and workplace pressure.

According to the study, fraudsters used fear, financial expectations and concerns about reputation to create what the researchers described as an “engineered brain freeze”. Some victims referred to the experience as a state of “mind arrest”, which affected their ability to think clearly while the fraud was taking place.

Also read ‘Hacker’s bent of mind’: IIT Kanpur, Madras B.Cybersecurity course to train ‘cyber warriors’, says in-charge

The study also found that financial losses varied widely, from a few thousand rupees to more than Rs 1 crore. Victims reported not only monetary losses but also shame, insomnia, depression and loss of trust within their families.

Nandan Sudarsanam of the Wadhwani School of Data Science and Artificial Intelligence at IIT Madras said digital literacy should not be viewed as the only factor determining vulnerability to cybercrime.

Sundarsanam said, “Our findings show that financial cybercrime is not simply a problem of inadequate digital literacy. Even highly educated and digitally experienced individuals can become vulnerable when fraudsters exploit fear, stress, and urgency. Understanding these factors is essential to designing more effective prevention strategies.”

IIT Madras study based on 33 victims

The findings are based on semi-structured interviews with 33 financial cybercrime victims, comprising 22 men and 11 women. Twelve of the participants were senior citizens.

The victims were from Chennai, Bengaluru, Hyderabad, New Delhi and Mumbai. The interviews were conducted in English, Hindi and Tamil and analysed using the Gioia methodology.

The study was led by P Kandaswamy, IPS (Retd), and Nandan Sudarsanam of IIT Madras, in collaboration with Akanksha Jaiswal, Associate Professor, The University of Western Australia, Chennai Campus, and Ameeta Fernando of Loyola Institute of Business Administration, Chennai.

The research received support from the Wadhwani School of Data Science and Artificial Intelligence at IIT Madras.

Cyber fraud tactics highlighted

The researchers highlighted several India-specific cybercrime tactics, including threats involving Aadhaar, UPI-based money transfers, fake investment platforms claiming SEBI registration and “digital arrest” scams.

The study noted that India's rapid transition to digital finance, including widespread mobile access and UPI, has brought hundreds of millions of first-generation users into digital financial services. According to the researchers, this has also created a wider opportunity for cybercriminals to target people through investment and stock-trading frauds, task and job scams, digital payment fraud and malware attacks.

The researchers said official statistics from the Indian Cyber Crime Coordination Centre (I4C) capture transactional breaches but do not fully reflect the human impact experienced by victims. The study therefore focused on victims' experiences and the factors that affected their decision-making during fraud.

Stronger cybercrime response needed

The study found that institutional responses differed between cases. While some banks and cybercrime cells responded quickly, others faced limitations in technical capabilities and coordination.

P Kandaswamy, IPS (Retd), Adjunct Faculty at IIT Madras, said cybercrime responses should focus on strengthening institutional systems rather than blaming victims.

He said, “The response to cybercrime must move beyond blaming victims. Banks and law-enforcement agencies need stronger systems for early detection, rapid intervention, and coordinated response, along with better support for victims.”

The researchers recommended moving beyond generic online safety messages and developing awareness campaigns around specific fraud methods and situations in which people may be vulnerable.

Also read Password in public? CBSE OSM portal under lens after 19-year-old hacker claims to bypass security measures

The study also called for stronger cyber-forensic capabilities in police cyber cells, faster detection of fraudulent transactions by banks and better coordination between banks, police and courts.

The researchers acknowledged that the study is qualitative and metropolitan in scope and largely represents victims who came forward to report their experiences.

The team plans to test the findings through a multilingual, large-scale survey. Future research will also cover tier-two and tier-three cities, the unorganised sector and the long-term recovery of cybercrime victims.