India’s authentication risk cannot be summarized by one breach number. Banking fraud reports count cases using specific reporting thresholds. CERT-In tracks incidents and threat patterns. UIDAI reports the scale and operation of Aadhaar. Each source measures a different part of the system.

This page collects figures that product, security, and editorial teams can cite without stripping away their definitions. It will be updated when the underlying primary sources publish new data.

Banking fraud reports reached 36,075 cases in 2023–24

The Reserve Bank of India reported 36,075 fraud cases involving ₹13,930 crore during 2023–24, compared with 13,564 cases involving ₹26,127 crore in 2022–23. These figures cover frauds of ₹1 lakh and above reported by banks and financial institutions during the period.

RBI warns that frauds reported in a year may have occurred in earlier years. In 2023–24, 89.2% of the reported fraud value related to incidents that occurred in previous financial years. Do not interpret the annual report as a real-time incident counter.

The number of reported cases rose while the total reported amount declined 46.7%. RBI says card and internet frauds accounted for the largest number of frauds, while loan-portfolio fraud dominated by value.

Source: RBI Annual Report 2023–24, fraud analysis and Table VI.1

India’s BFSI sector saw a reported 175% phishing increase

CERT-In’s Digital Threat Report 2024 says the Indian financial sector saw a 175% increase in phishing attacks during the first half of 2024 compared with the same period a year earlier. The report identifies phishing and compromised credentials among the key forms of cyberattack in India.

That percentage belongs to the report’s BFSI threat context. It should not be generalized to every Indian company or treated as a national count of phishing messages.

Source: CERT-In Digital Threat Report 2024

One report estimated India’s average breach cost at $2.18 million

The same CERT-In report cites an estimated average data-breach cost of $2.18 million in India, alongside a global average of $4.88 million. This is a cited industry estimate inside the government report, not a direct CERT-In measurement of every Indian breach.

Use this figure to explain the potential scale of impact, not to predict the cost of a particular incident. Company size, sector, detection time, legal response, and the records involved change the outcome.

Source: CERT-In Digital Threat Report 2024

CERT-In observed attacks that bypass ordinary MFA

In August 2026, CERT-In warned of Microsoft 365 campaigns using password spraying, credential stuffing, device-code phishing, Resource Owner Password Credentials abuse, session-token compromise, and business email compromise. The advisory describes attackers obtaining OAuth tokens or valid session tokens without directly stealing a user’s current password.

This is not a count, but it is an important authentication statistic in a broader sense: MFA enrollment alone is not an outcome measure. Teams also need to track phishing-resistant factor use, legacy-flow disablement, token theft, new OAuth grants, and session revocation.

Source: CERT-In Advisory CIAD-2026-0037

What should an authentication dashboard measure?

Public statistics describe the environment. Your own controls need product-level measurements:

Metric	What it reveals
Login success by method	Reliability and fallback dependence
MFA or passkey coverage	Exposure to password-only compromise
Credential-stuffing blocks	Automated account-takeover pressure
OTP sends per successful login	Abuse, retries, and delivery problems
New OAuth grants by scope	Consent-phishing and integration risk
Session revocation completion	Incident-containment speed
Recovery success and denial	Whether recovery bypasses stronger login

Segment these metrics by tenant, platform, client, and authentication method without putting secrets or raw identity documents into analytics.

How to cite this page responsibly

Include the year, population, and reporting threshold beside every number. “India had 36,075 frauds” is incomplete. “RBI recorded 36,075 fraud cases of ₹1 lakh and above reported by banks and financial institutions during 2023–24” preserves the definition.

Link the primary source, not only this roundup. If a later report revises a table, prefer the revised official value. This page is citation infrastructure, not a substitute for reading the source.

For engineering controls behind these trends, read the credential-stuffing defense guide, secure account recovery guide, and OAuth consent-phishing guide.

Contact the NamoID team

NamoID can help you translate broad risk statistics into measurable controls for login, sessions, tokens, consent, and recovery. Bring your current authentication methods and incident concerns; the team can help you define the metrics that matter for your product.

Contact the NamoID team in Slack for an early response and an implementation-focused discussion.

Last substantive review: 29 October 2026. Figures remain labeled by their original reporting periods.