Cyber Insurance for Individuals in India: Read the Exclusions First

That rule covers the loss most people buy cyber cover for. A policy is worth considering for what the rule does not reach. It is poor value if you are buying it to insure a right the regulator has already given you.

What is your liability if money leaves your bank account?

RBI’s circular of 6 July 2017 sets it out. Two cases give you zero liability.

• The bank was at fault. Your liability is zero whether or not you reported it.
• A third party breached the system, and neither the bank nor you were at fault. Your liability is zero if you tell the bank within three working days.

After that, a sliding scale applies.

Two more parts of that circular matter. The burden of proving you are liable lies on the bank. And the bank must credit the money back within ten working days, while it looks into it.

Wallets were brought in from January 2019. For prepaid instruments from authorised non-banks, a report in four to seven days caps your loss at ₹10,000. If the transaction was smaller, that lower figure applies. The issuer must credit the money in ten days and close the case in ninety.

The exception is your own carelessness. Share your PIN, OTP or password and you bear the whole loss until you report it. Losses after you report are the bank’s. Our page on UPI fraud covers how these cases start.

What does an individual cyber insurance policy cover?

IRDAI published a Guidance Document on Product Structure for Cyber Insurance on 8 September 2021. It lists the covers an individual policy may carry.

• Theft of funds from a bank account, card or wallet
• Identity theft
• Social media misuse
• Cyber stalking and bullying
• Malware damage and data restoration cost
• Phishing
• Unauthorised online transactions
• Email spoofing
• Media liability claims
• Cyber extortion
• Data breach and privacy breach

The genuinely useful items are the ones your bank will not pay for. Legal costs after identity theft. Defence costs in a defamation claim over a social media account. Data restoration after ransomware. Prosecution costs in a cyber stalking case.

What does cyber insurance exclude?

This is where the product earns its reputation. The list below is from an actual policy filed with IRDAI, the Bajaj Allianz Individual Cyber Safe policy, UIN IRDAN113P0003V01201718. Wordings differ by insurer, but the shape is standard.

• Prior acts. Anything committed or attempted before the policy started.
• Trading. Losses on purchase or sale of securities, commodities, derivatives, currencies, foreign exchange and cryptocurrencies.
• Outage or disturbance of external networks such as power, internet, cable and telecom.
• Dishonest or improper conduct by the insured.
• Bodily injury and property damage.
• War, terrorism including cyber terrorism, and governmental acts.
• Trade secrets and intellectual property.
• Unsolicited communication and unauthorised collection of data.

Read the cryptocurrency exclusion twice. A large share of Indian online fraud now involves crypto, and it sits outside a standard cyber policy.

How fast must a general insurer settle a claim?

The timelines come from IRDAI’s master circular of 5 September 2024. The rules behind it were notified the same year.

A surveyor must be assigned within 24 hours of the claim. The surveyor must report within 15 days. A delay there costs the insurer ₹500 a day, payable to you.

The insurer must then decide within seven days of getting that report. Or within fifteen days of assigning the claim, if that comes first. Miss the deadline and interest runs at the bank rate plus 2%. You do not have to ask for it.

One warning about free look. The 30-day free look covers life policies. It also covers new individual health policies of a year or more. The retail general insurance part of the circular has no free look rule at all. So do not assume you can cancel a cyber policy in month one.

Should you buy it?

For most salaried households, the honest answer is probably not yet. The bank liability rule already covers card and account fraud. Premiums are low, but so are typical sums insured, and the exclusions cut deep.

It gets more useful in three situations. If you hold significant assets and a public profile, identity theft cover is real. If you run a small business from a personal device, data restoration matters. If you have already been targeted, the legal cost cover pays for itself.

What actually reduces your risk costs nothing. Report unauthorised debits the same day. Read our pages on the digital arrest scam and UPI fraud, and check your account alerts are switched on.