Cyber crime, scams and the law
What is happening, what to do in the first hour, and what the law says. Written with the Codesnag team of ethical hackers.
All articles
Scam watchDigital arrest money trail: what the ED's ₹417 crore Goa case shows
The Enforcement Directorate says one Goa woman's ₹2.60 crore loss led to 400-plus accounts and 163 FIRs. Here is how the money moves, the warning signs, and what to do in the first hour.
· 5 min read
Sovereign AIWhat Claude Mythos means for India’s sovereign-AI push
Anthropic built a cyber-capable model and kept it restricted. Indian reporting says the Government wants a home-grown answer. Here is what is confirmed, what is only reported, and why sovereignty is the real story.
· 5 min read
LawRBI's new fraud compensation from 2027: who gets it and what to do
From 1 January 2027, small-value digital fraud victims may receive up to ₹25,000 from their bank. The five-day reporting rule is what decides whether you qualify. Here is the first-hour routine.
· 5 min read
Scam watchThe fake APK on WhatsApp: how one file empties a bank account
Mumbai Crime Branch alleges that 2,805 malicious APK files were sold to fraud gangs. Here is how the trick works, the warning signs, the first hour after a tap, and what BNS and the IT Act say.
· 5 min read
LawData breach under DPDP: who to tell, what to tell them and when
Two regimes, two clocks: CERT-In's 6-hour direction applies today, and the DPDP Rules' breach duties follow in May 2027. Here is who must be told, what they must be told, and how to run both.
· 6 min read
LawChildren's data under DPDP: parental consent for schools and edtech
The DPDP Act treats everyone under 18 as a child. What verifiable parental consent means, what the ban on tracking covers, and what schools, coaching centres and edtech apps should change before May 2027.
· 5 min read
LawDPDP Rules 2025: what a valid consent notice must say
The DPDP Rules, 2025 set out what an Indian app or website must tell people before asking for consent. Here is what the notice must contain, how withdrawal works, and where consent is not needed.
· 5 min read
LawDPDP Act and Rules 2025: what every Indian business must do now
The DPDP Rules were notified on 13 November 2025, and the main duties apply from 13 May 2027. Here is a plain guide for founders, CFOs, school and clinic owners, with a 12-point readiness checklist.
· 9 min read
Scam watchDigital arrest: what the Supreme Court's August 2026 order means for you
Complaints are falling, but digital arrest calls have not stopped. How the scam works, the warning signs, what to do in the first hour, and what the law says.
· 5 min read
Case studyDefending massive OTT data
A CERT advisory said the user data of India's largest regional OTT platform was for sale on the darknet. We were called in by referral, and had the sellers identified inside a week.
· 6 min read
Case studyThe urgent call to Codesnag
A zero-day against a smart-LED brand's IoT estate took every service down and wiped its cloud servers. Control was restored in three days — and the mobile apps turned out to be the way in.
· 5 min read
MethodInside a Codesnag engagement
An IDOR in a hotel chain's payment flow was being used to book rooms and club events at prices nobody agreed to. Their own security team could not find it. Here is how the engagement actually ran.
· 7 min read