Cyber Insurance for Individuals in India 2026: Is It Worth Buying?

Most people assume their bank already protects them from digital fraud, and up to a point, that is true — RBI's zero-liability rule can wipe out your loss on an unauthorised transaction if you report it fast enough. But almost every high-profile scam pattern of the last two years — fake customs-officer calls, "digital arrest" scams, fake trading apps, remote-access-app fraud — works by getting you to authorise the payment yourself. That single word, authorised, is the entire gap individual cyber insurance exists to fill. Here is what RBI's rule actually covers, what a cyber policy adds on top, what IRDAI requires of these products, and what they cost.

What RBI's Zero-Liability Rule Already Covers You For

Under RBI's July 2017 circular on customer protection in unauthorised electronic banking transactions, your liability is zero if you report a fraudulent transaction within 3 working days of the bank's alert, provided the transaction happened without your knowledge or consent — a stolen card used without you approving it, or a hacked account moving money you never touched. Report it in 4 to 7 working days and your liability is capped, typically between ₹5,000 and ₹25,000 depending on account type. The bank must credit the disputed amount back to your account within 10 working days of your complaint, without waiting for the fraud investigation to conclude, and the case itself must be resolved within 90 days. This rule applies to every scheduled bank, small finance bank, payments bank, and prepaid wallet issuer in India. Note that RBI issued final amendment directions on 24 June 2026, effective 1 January 2027, extending these protections beyond unauthorised transactions to other categories of fraudulent electronic banking transactions and adding a small-value compensation mechanism. The 2017 framework described here applies until then, so check the final directions for exact scope.

What Individual Cyber Insurance Actually Covers

IRDAI has issued a guidance document specifically for individual cyber insurance, requiring insurers to design products around a person's actual digital risk rather than simply repackaging a corporate cyber policy. In practice, individual policies from Bajaj Allianz, HDFC Ergo, and ICICI Lombard bundle together several first-party covers: IT theft loss (funds moved from your bank account or wallet through hacking or phishing), identity theft (costs of restoring your identity and disputing fraudulent accounts opened in your name), malware and ransomware losses on your personal devices, email spoofing, and — increasingly marketed as a differentiator — counselling costs and legal expenses if you're the target of cyberbullying, stalking, or harassment.

The Coverage Gap That Actually Matters: Authorised Push-Payment Fraud

Because RBI's zero-liability rule is written around unauthorised transactions, it structurally cannot help when you were deceived into authorising the payment yourself — which is exactly how most high-value scams now operate. This category (often called authorised push-payment or social-engineering fraud) sits in a grey zone: some individual cyber policies explicitly list "social engineering fraud" or "phishing-induced transfer" as a covered peril, while others exclude it outright or bury it behind conditions. Do not assume a policy covers this just because it mentions phishing — read the specific peril list and exclusions, or ask the insurer in writing, before you buy.

What's Not Covered

• Losses arising from any deliberate, fraudulent, or illegal act by you, the policyholder
• Circumstances or facts that existed before the policy started — you cannot buy cover after you've already been scammed
• Losses caused by an order of a government or regulatory authority
• Delayed reporting — most insurers require you to notify them within a fixed window (commonly 30-90 days) of discovering the incident, in addition to filing with your bank and the police
• Purely commercial or business losses on a personal policy — freelancers and small business owners with significant digital income exposure should check whether they need a separate commercial cyber policy

What It Costs and How to Buy It

Individual cyber insurance is priced far below health or term cover — aggregator data puts entry-level policies at roughly ₹500 to ₹2,000 a year for about ₹1 lakh of cover, scaling up toward ₹3,000-plus for ₹10 lakh. You can buy it as a standalone policy or, in some cases, as an add-on rider to a home insurance policy. Bajaj Allianz's individual product, for instance, is marketed with no deductible, meaning the full covered loss is payable without you first absorbing a fixed excess amount.

Who Actually Needs This

• Anyone who transacts heavily on UPI and multiple wallets beyond their primary bank account, since more digital surface area means more phishing exposure
• Freelancers and gig workers whose income routes digitally and who don't have an employer's IT security team or incident-response process behind them
• Senior citizens, who remain the most targeted group for phishing calls and "digital arrest" scams, and who often take longer to notice and report a fraudulent transaction within RBI's 3-working-day zero-liability window
• Anyone with meaningful reputational or professional exposure on social media, where an account takeover can cause damage well beyond a direct financial loss

Cyber insurance is not a replacement for basic digital hygiene — it exists for the scenario where good habits still weren't enough, and even then, only within whatever specific perils the policy actually lists. For most people the honest math is this: at ₹500-₹2,000 a year, it's a cheap way to cover the exact gap RBI's rule leaves open, provided you read the policy wording closely enough to know whether social-engineering fraud is actually on that list.