India Blocks 3,718 Apps and 15.75 Lakh SIM Cards in Major Cybercrime Crackdown

India has intensified its fight against digital fraud by blocking 3,718 mobile applications, including fraudulent loan apps, along with more than 15.75 lakh SIM cards and 5.77 lakh IMEI numbers linked to suspected cybercrime infrastructure.

These cumulative figures were recorded up to 30 June 2026 and disclosed by the Ministry of Home Affairs in a written reply to the Lok Sabha on 11 August 2026.

The action matters because modern cybercrime rarely depends on only one fraudulent phone number, application or bank account. Organised fraud networks often combine misleading mobile apps, disposable SIM cards, compromised devices, phishing links, fake customer-care identities and mule bank accounts.

By targeting several parts of this chain together, authorities are attempting to make online fraud more difficult to operate, repeat and scale.

The official details are available in the Ministry of Home Affairs press release.

India’s cybercrime crackdown at a glance

These figures show that the government’s cybercrime response extends beyond removing suspicious applications. It also covers telecom identities, mobile devices, financial identifiers, mule accounts and online infrastructure used to facilitate fraud.

What India’s cybercrime crackdown includes

The Indian Cyber Crime Coordination Centre, commonly known as I4C, is coordinating several national measures against cybercrime.

The 3,718 mobile applications were blocked under relevant provisions of the Information Technology Act, including Section 69A and Section 79(3)(b). The action included fraudulent loan applications and other apps linked to unlawful activity.

The broader response includes:

• Blocking mobile applications used in cybercrime
• Blocking SIM cards reported by police authorities
• Blocking IMEI numbers linked with reported devices
• Identifying suspicious bank accounts and financial identifiers
• Declining transactions connected with suspected fraud infrastructure
• Sending faster takedown notices to online intermediaries
• Supporting the reporting and restoration process for financial cyber fraud

This coordinated approach is important because blocking one phone number or bank account may not be enough. Fraud operators often replace compromised infrastructure quickly and continue using a new SIM, device, application or payment account.

Why fraudulent mobile applications are dangerous

A fraudulent app may look professional, display a familiar logo and imitate the design of a genuine bank, government department, courier company, investment platform or loan provider.

It may promise:

• An instant personal loan
• A quick traffic-challan payment
• A government benefit or subsidy
• A courier or parcel update
• A high-return investment opportunity
• An account-verification or KYC service
• A refund, cashback or reward

The risk increases when the user installs the application and grants permissions without understanding why they are required.

A malicious app may request access to:

• SMS messages
• Phone calls and call logs
• Contacts
• Notifications
• Storage and media files
• Camera and microphone
• Accessibility Services
• Device administration
• Screen activity
• VPN configuration

These permissions may allow criminals to monitor activity, read OTP messages, collect banking details, display fake payment screens or maintain control over important phone functions.

CERT-In’s warning about fake RTO and e-Challan apps

In March 2026, the Indian Computer Emergency Response Team, or CERT-In, warned Android users about a malware campaign impersonating official Regional Transport Office and e-Challan services.

Victims received messages claiming that a vehicle challan had been generated. The messages encouraged users to download APK files with names such as:

• RTO Challan.apk
• RTO E Challan.apk
• MParivahan.apk

Once installed, the malware sought permissions to access SMS messages, calls and background processes. It could create fake financial screens, collect credentials and send OTP information to an attacker-controlled server.

CERT-In advised users to verify traffic challans only through the official e-Challan portal or the relevant State traffic police website. Its complete warning is available in the CERT-In RTO and e-Challan malware advisory.

The incident shows why an application should never be trusted only because its name, icon, message or screen looks official.

Why blocking SIM cards matters

SIM cards allow fraudsters to create temporary identities for calls, SMS messages, WhatsApp accounts, Telegram profiles and fake customer-support numbers.

When one number is reported or blocked, a fraud network may attempt to continue using a new SIM card. Large numbers of disposable or improperly obtained SIMs can therefore help criminals operate repeated campaigns.

Blocking SIM cards reported by police authorities can disrupt:

• Fraudulent customer-care calls
• Fake banking and KYC messages
• WhatsApp impersonation accounts
• Digital arrest calls
• Loan and investment scams
• Courier and parcel fraud
• OTP interception attempts

It also shortens the useful life of phone numbers being used as part of reported cybercrime operations.

Why IMEI blocking is important

IMEI stands for International Mobile Equipment Identity. It is a unique identification number assigned to a mobile device.

Blocking a SIM card targets the mobile number. Blocking an IMEI targets the identified handset or device associated with the reported activity.

This makes it more difficult to reuse the same device simply by inserting a fresh SIM card. It can also help authorities and telecom operators identify devices repeatedly linked with reported fraud activity.

IMEI blocking cannot eliminate cybercrime on its own because criminals may replace the phone, change accounts or adopt new techniques. However, it raises the operating cost of fraud and limits the repeated use of known infrastructure.

The financial system behind the crackdown

The government’s response links citizens, police authorities, banks, wallets, payment intermediaries, telecom service providers and technology platforms.

Citizen Financial Cyber Fraud Reporting and Management System

The Citizen Financial Cyber Fraud Reporting and Management System, or CFCFRMS, was launched under I4C in 2021.

Its purpose is to support immediate reporting of financial cyber fraud and help stop stolen funds from being transferred further through the financial system.

According to the Ministry of Home Affairs, the system had helped save more than ₹11,158 crore across over 32.80 lakh financial-fraud complaints by 30 June 2026.

The word “saved” should not be interpreted as a guaranteed refund in every complaint. Restoration can depend on transaction tracing, bank action, investigation and legal procedures.

I4C Suspect Registry

I4C operates a Suspect Registry in collaboration with banks and financial institutions.

By 30 June 2026:

• More than 30.48 lakh suspect identifiers had been received from banks.
• Information relating to 32.08 lakh Layer 1 mule accounts had been shared with participating entities.
• Transactions worth ₹25,698 crore had been declined.

Mule accounts are bank accounts used to receive or transfer money connected with fraud. Some account holders knowingly participate, while others may be recruited or deceived into allowing their accounts to be used.

Sahyog Portal

The Sahyog Portal supports faster communication between authorised government agencies and online intermediaries.

It facilitates notices for the removal or disabling of unlawful information, data, communication links and services used to commit illegal acts.

This can help reduce the time during which a fraudulent app, website, social account or digital service remains available to potential victims.

Money Restoration and Grievance Redressal modules

Money Restoration and Grievance Redressal modules became operational in April 2026.

These modules are intended to support:

• Restoration-related processing for defrauded money
• Complaints involving frozen bank accounts
• Grievances related to lien-marked funds
• More consistent coordination between banks and investigating authorities

How to identify a potentially fraudulent app

Before installing any application, check more than its name and icon.

Review the following:

• Publisher name: Confirm that it matches the organisation the app claims to represent.
• Official website: Reach the app through the organisation’s independently verified website.
• Download source: Prefer the official operating-system or device-manufacturer app store.
• Number of downloads: A newly published app with limited history deserves extra caution.
• Recent user reviews: Look for reports of unexpected payments, permissions or account access.
• Requested permissions: Check whether they are genuinely needed for the app’s purpose.
• Privacy information: Review what data the app claims to collect and share.
• Spelling and branding: Look for unusual words, low-quality images or copied logos.

A calculator, loan-status checker, document viewer or invitation app should not normally require unrestricted access to SMS messages, Accessibility Services or device administration.

Never install an APK file simply because it arrives through WhatsApp, Telegram, SMS, email or a social-media message.

Warning signs of a malicious app message

Fraudsters often use urgency, fear or excitement to stop users from checking the details properly.

Be cautious when a message claims:

• Your loan offer will expire immediately.
• Your bank account will be suspended.
• Your KYC must be updated within a few hours.
• Your parcel will be returned or seized.
• A traffic fine must be paid immediately.
• You have won a cashback or reward.
• An investment opportunity is guaranteed.
• You must install an app to receive a refund.

Do not use the link included in an unexpected message. Search for the organisation’s official website independently and verify the claim through its official support channel.

What to do if you installed a suspicious app

Act quickly, particularly when the application received access to SMS messages, notifications, banking information or Accessibility Services.

1. Disconnect the phone from mobile data and WiFi.
2. Open the device settings and uninstall the suspicious application.
3. Review recently granted permissions and disable unfamiliar access.
4. Check whether Accessibility Services or device-administration access was enabled.
5. Run a scan using a trusted and updated mobile-security application.
6. Do not use the affected device for banking until it has been checked.
7. Change important passwords from a clean and trusted device.
8. Reset exposed UPI PINs or payment credentials through official applications.
9. Review bank statements and payment activity.
10. Contact the bank immediately if financial information may be compromised.

If the application obtained deep access, continued running in the background or cannot be removed safely, seek professional technical help. Preserve useful evidence before resetting the device.

How to report cyber fraud and suspicious identifiers

If money has been lost through a digital scam, call the national cybercrime helpline number 1930 immediately.

After receiving an acknowledgement number, complete the formal complaint through the National Cyber Crime Reporting Portal.

Preserve:

• Transaction IDs and UTR numbers
• Bank alerts and statements
• Screenshots of the fraudulent app
• APK file names
• Website addresses
• Phone numbers and UPI IDs
• WhatsApp, Telegram, SMS or email messages
• Social-media advertisements and profiles

The portal also provides facilities to check and report suspicious identifiers, including:

• Mobile numbers
• Email addresses
• Bank account numbers
• Website URLs
• Apps
• WhatsApp numbers and Telegram handles
• SMS headers and social-media profiles

You can use the official Check Suspect facility or the Report Suspect facility.

Reporting an attempted scam, even before money is lost, can help build a wider repository of suspicious identifiers.

Safe internet use starts with informed choices

A reliable broadband or fiber connection supports work, education, entertainment, online banking and communication. However, internet speed alone cannot protect a user from a fake app, phishing page or fraudulent payment request.

Digital safety depends on:

• Updated devices and applications
• Downloads from trusted sources
• Careful review of app permissions
• Strong account passwords
• Multi-factor authentication
• Fast reporting of suspicious activity
• Refusing unexpected remote-access requests

Consumers looking for a home WiFi connection can use InternetWale to compare broadband and fiber plans by locality or pincode and connect with relevant partner providers.

InternetWale is an ISP comparison and discovery platform, not a direct internet service provider. Final plan pricing, exact-address serviceability, installation, billing and technical support should be confirmed with the selected provider.

Protect your home WiFi and connected devices

Whichever ISP or broadband plan a household chooses, the home network should also be protected.

• Use a strong and unique WiFi password.
• Change the router’s default administrator credentials.
• Use WPA2 or WPA3 encryption.
• Install router firmware updates.
• Review connected devices periodically.
• Remove unknown phones, televisions or smart devices.
• Use a guest network for visitors where available.
• Avoid sharing the WiFi password publicly.
• Keep phones, computers, cameras and smart-home devices updated.

A secure router cannot make a fraudulent app safe, but it remains an important part of layered digital protection.

A strong step, but awareness remains essential

Blocking thousands of mobile apps, lakhs of SIM cards and device identifiers is an important cybercrime intervention.

It shows that fighting online fraud requires coordination across applications, telecom networks, mobile devices, banks, payment systems and law-enforcement agencies.

However, the first line of defence still sits in the user’s hand.

A few seconds spent checking an application, questioning an urgent message or verifying a payment request can prevent serious financial and personal loss.

India’s cybercrime crackdown can remove known threats and disrupt reported fraud infrastructure. Lasting digital safety will also depend on faster reporting, responsible platforms, secure financial systems and citizens who treat every unexpected link, APK file and payment request with caution.

Final thoughts

India’s decision to block 3,718 mobile applications, more than 15.75 lakh SIM cards and 5.77 lakh IMEI numbers demonstrates the scale of the country’s coordinated response to cybercrime.

The wider system—covering CFCFRMS, the Suspect Registry, Sahyog Portal, financial restoration modules and citizen reporting—shows that cyber fraud must be tackled at several levels at the same time.

For users, the message is clear: install apps only from trusted sources, review every permission, protect banking credentials and report suspicious activity immediately.

If financial cyber fraud occurs, call 1930, inform the bank and complete the complaint through cybercrime.gov.in.

A safer digital India requires government action, accountable platforms and alert internet users working together.