Cyber insurance in India covers financial losses from online crime, including unauthorised transactions, phishing, identity theft, cyber extortion and cyberstalking, plus related legal and counselling costs. It excludes money you willingly transferred into scams, voluntarily shared credentials, and incidents known before buying the policy. This is a direct answer to ‘what does cyber insurance cover?’
Indians lost around ₹22,495 crore to cyber fraud in 2025, and reported cases climbed roughly 24% to about 28.15 lakh over the year, according to Ministry of Home Affairs data (reported by The Print). A cyber insurance policy is sold as a financial cushion for exactly these situations. The trouble starts when buyers treat it as a refund button for any online loss, then find at claim time that much of what happened to them is outside the cover.
This guide walks through what cyber insurance covers for an individual in India, what it leaves out, and where it overlaps with protection your bank already owes you. For the groundwork on what the product is and why people buy it, see our companion explainer on what cyber insurance is and why you need it. Here, let’s focus on cyber insurance coverage.
What Does Cyber Insurance Cover? (Quick Answer)
Cyber insurance for individuals in India covers the financial and personal fallout of online crime. That mainly means unauthorised transactions, identity theft, losses from phishing and email spoofing, cyber extortion, and the legal or counselling costs that follow harassment. Coverage differs by insurer, and every policy sets out a defined list of exclusions alongside what it pays.
The quickest way to read a policy is to hold the covered risks and the excluded ones side by side. The table below shows the pattern most personal plans follow, though your own wording is what settles any claim.
| Situation | Typically covered? |
| Money stolen through an unauthorised net-banking, card or UPI-linked transaction | Usually yes |
| Loss after a phishing or email-spoofing attack | Usually yes |
| Identity theft and the cost of restoring your identity | Usually yes |
| A cyber extortion or ransomware demand | Often yes |
| Legal costs to pursue a fraudster or defend a claim | Often yes |
| Counselling after cyberstalking or bullying | Cover-dependent |
| Money you transferred yourself into a fake investment or trading scheme | Usually no |
| Loss after you willingly shared an OTP or password | Usually no |
| An incident you already knew about before buying the policy | No |
| Physical damage to your laptop or phone | No |
What a Personal Cyber Insurance Policy Covers in India
A personal cyber insurance policy covers a defined set of online risks that hit your money, your identity and your peace of mind. The Insurance Regulatory and Development Authority of India (IRDAI) has set out what such a policy should offer, and its 8 September 2021 guidance document lists theft of funds, theft of identity, unauthorised online transactions and email spoofing among the core covers.
Across products from insurers such as Bajaj Allianz, HDFC ERGO and ICICI Lombard, the covers tend to group into a few heads:
- Unauthorised transactions: Direct financial loss when someone drains a bank account, card, digital wallet or UPI-linked account without your consent, often after a phishing link or a SIM-swap attack.
- Identity theft and restoration: The money lost to identity misuse, plus the cost of the paperwork and legal follow-up needed to set your records straight.
- Cyber extortion: Ransom or extortion demands after a criminal locks or threatens to expose your data.
- Legal costs: Defence and legal expenses when you pursue a fraudster, or when a dispute arises from a covered risk such as a misused social media account.
- Cyberstalking, bullying and harassment: Several policies pay for psychologist counselling sessions where a victim faces stress after online harassment, and many extend the cover to a spouse and dependent children.
- E-reputation and social media: Costs tied to restoring your reputation after account takeover or online impersonation.
Sum insured on personal plans commonly runs from about ₹50,000 up to ₹1 crore, so the same product can suit a light internet user or someone who banks and trades heavily online.
For where those premiums land, see our guide on how much cyber insurance costs in India.
First-party and Third-party Cover Explained
Every cyber insurance policy is built from two blocks: first-party cover and third-party liability. First-party cover pays for losses you suffer directly. Third-party liability pays for claims brought against you by others whose data or systems you exposed. An individual policy leans heavily on the first-party side, while business policies carry both.
For a household, first-party cover does most of the work: stolen funds, identity restoration, extortion and counselling all are usually here. Third-party liability matters more once you run a business. Since a breach that leaks a customer’s data can lead to legal claims against you. Business policies also add covers an individual rarely needs, such as business interruption, breach-notification costs and regulatory-response expenses. If you are buying only for personal use, the first-party heads are the ones to read closely.
What Cyber Insurance Does Not Cover
Exclusions decide most rejected claims, so they deserve as much attention as the covered list. A cyber insurance policy will not pay where the loss falls into a named exclusion, and personal plans in India tend to carry a fairly aggressive set. Reading these before you buy is the single best way to avoid a surprise later. Exclusions are a leading cause of claim rejection.
Common exclusions on personal and business policies include:
- Voluntarily sharing an OTP, PIN or password. Where you hand over credentials without being manipulated through a covered method, insurers generally treat the loss as your own (Business Standard).
- Investment and trading scam losses. Money you transfer yourself into a fake scheme is usually excluded, which matters a great deal in India, where investment scams accounted for about 75% of all money lost to cyber fraud in 2025 (The Print).
- Known or pre-existing incidents. Anything you were already aware of before the policy started, or losses tied to unpatched software and weak security.
- Deliberate or dishonest acts. Fraud, criminal or reckless conduct by the insured, or insider fraud in a business context.
- War, terrorism and nation-state attacks. Losses linked to cyber war or state-sponsored attacks are typically carved out (BimaKavach).
- Physical hardware damage. Replacing a laptop or phone damaged in an incident is not part of cyber cover (IRDAI-based framing).
- Intellectual property infringement. Software, patent and copyright disputes belong to a separate IP policy (HDFC ERGO).
- Uninsurable fines and contractual liabilities. Certain regulatory penalties and liabilities you take on by contract fall outside the cover.
Cyber Insurance vs Your Bank’s RBI Liability Cover
Before any policy pays out, your bank already carries a duty to refund certain frauds, and that overlap changes what cyber insurance is actually worth to you. Under the Reserve Bank of India’s 2017 customer-protection circular, your liability for an unauthorised electronic transaction depends on who was at fault and how fast you reported it. Where the bank must refund, a cyber policy adds little; where the bank need not, the policy can be one of the few backstops left.
The RBI framework works in tiers. You have zero liability if the fraud stems from the bank’s own negligence or a third-party system breach, provided you report it within three working days of the bank’s alert. If you report within four to seven working days and your liability is limited, capped between ₹5,000 and ₹25,000 depending on the account or card type. Report later, and the outcome follows your bank’s board-approved policy. Once notified, the bank is expected to shadow-credit the disputed amount within 10 working days.
| Scenario | Bank’s RBI liability | Where cyber insurance can add value |
| Third-party breach, reported within 3 working days | Zero liability, bank refunds | Limited; may cover incidental costs the bank ignores |
| Reported after 3 to 7 working days | Limited liability, you bear ₹5,000 to ₹25,000 | Can cover the capped amount you are left carrying |
| You shared credentials or reported late | You may bear the full loss | One of the few remaining backstops, subject to exclusions |
| Identity restoration, counselling, legal, e-reputation | Not the bank’s responsibility | Core reason to hold a personal policy |
The honest read is that cyber insurance earns its place mainly at the edges the bank does not reach: the non-financial harm, and the situations where the bank’s duty to refund does not apply. It also works on the principle of indemnity, so it tops up the loss you are left with rather than paying a second time over the bank’s refund. For how a policy stacks against a standalone identity theft cover, see comparison on cyber insurance vs identity theft cover.
How to Check What Your Own Policy Covers
The safest habit is to read your own wording rather than a marketing summary, since two plans priced alike can differ sharply on limits. Coverage on paper means little if a sub-limit caps the payout well below the headline sum insured. A few checks tell you most of what you need before you buy or renew.
- Sub-limits per cover. Each head, such as counselling or legal costs, can carry its own cap inside the overall sum insured.
- Single versus aggregate limits. Check whether the sum insured resets per incident or applies across all claims in the year.
- Family cover. Confirm whether a spouse and children share the sum insured or hold their own.
- Reporting deadlines. Policies set their own notification windows, and missing them can void an otherwise valid claim.
- Deductibles. The portion you bear on each claim varies by plan.
What steps to follow if fraud happens? You need to learn how to claim cyber insurance after online fraud.
The Bottom Line
Cyber insurance can be suitable as a defined backstop rather than a cure-all, and its value depends heavily on reading the covered and excluded lists before you sign. For a household that banks and trades online, the cover can help most with identity restoration, harassment support and the frauds your bank is not obliged to refund. For a lighter internet user, the case is more balanced and worth weighing against the premium.
MyRupia is an independent insurance guidance platform, so we do not sell or recommend any cyber policy. If you already hold one and want a second read of what it actually covers, or your claim has been turned down over an exclusion, our team can help you review the wording and understand your options (book a consultation).
This article is for general information and is based on publicly available regulatory and industry sources. It is not insurance, financial or legal advice. Check your policy wording and consult a qualified professional before making a decision.
Frequently Asked Questions
Q1. Can I claim from both my bank and my cyber insurance for the same fraud?
No, you cannot recover the same loss twice. Cyber insurance works on indemnity, so it pays only what you are left bearing after any bank refund under RBI rules. If the bank re-credits you in full, the policy adds nothing for that amount, though it may still cover related costs the bank ignores.
Q2. Does cyber insurance cover money lost in an investment or trading scam?
Investment and trading scam losses are generally excluded, even when the scam first reached you through a phishing link. The reason is that you transferred the money yourself into the scheme, so it is not treated as an unauthorised transaction. This gap matters, since such scams drive most of India’s cyber fraud losses.
Q3. Is there a waiting period before a personal cyber policy starts paying?
Cover usually begins from the policy inception date, but any incident you already knew about before that date is excluded. Each cover can also carry its own reporting deadline. Read the wording for the retroactive date and the notification window so a valid claim is not lost on timing.
Q4. Does a personal cyber insurance policy cover my family members?
Many individual plans extend to a spouse and dependent children on the same sum insured, which helps where children face online stalking or harassment. What differs is whether the cover is shared across the family or held per person. Confirm this in the policy schedule before you rely on it.
Q5. Does cyber insurance cover fraud on international or overseas platforms?
Several personal policies offer worldwide cover for the insured, so a fraud that originates abroad can still qualify. The same exclusions and reporting rules apply regardless of where the incident starts. Check the geographic scope clause, since not every plan extends beyond India.