India recently signed the United Nations Convention against Cybercrime in New York on the sidelines of the 81st United Nations General Assembly, or UNGA. It’s the first global framework against cybercrime with 95 signatories. However, it is not yet in force, requiring 40 ratifications or accessions before it officially enters into force.
Its significance for India is clear. Industrial-scale cyberscam compounds are burgeoning in Myanmar’s Myawaddy, a city on the Myanmar-Thailand border. Their complex system of functioning transcends borders. The scammer may sit in Myanmar, the victim in Mumbai and the recruiter in India or Dubai. The money may pass through several mule accounts before becoming cryptocurrency. The platform may be headquartered elsewhere with evidence stored on servers in yet another jurisdiction.
In India, financial cybercrime complaints rose from 2,62,846 involving Rs 551 crore in 2021 to more than 20.4 lakh involving Rs 22,495 crore in 2025. Between 2023-24 and 2025-26, the National Cyber Crime Reporting Portal logged more than 5.38 million complaints involving over Rs 56,087 crore.
Though the problem is transnational, India has responded with a sophisticated domestic response. The Indian Cyber Crime Coordination Centre (I4C) coordinates enforcement, and the 1930 helpline allows rapid reporting. The Cyber Fraud Mitigation Centre coordinates between banks, telecom companies and the police, resulting in millions of mule accounts and suspects being mapped. The work has been substantial and timely, but initiatives to solve the problem has its own roadblocks.
For instance, in 2022, the Ministry of External Affairs issued a warning about fake job rackets. Indians were being lured by cyber scam recruiters and then taken illegally into Myanmar’s Myawaddy region and forced into digital scams and crypto fraud. India has since repatriated hundreds of victims.
In one of my trips to the border town of Mae Sot in Thailand, I met with NGOs and other individuals helping such victims. They had noted that recruiters are paid a 20 per cent commission for each recruit. NGOs such as Global Advance Projects and Acts of Mercy, which have worked to rescue and rehabilitate thousands of victims from cyberscam compounds, suggest this is possibly the largest global transnational human trafficking event in history.
Considering that custom-made compounds were built only in 2020 specifically for cyberscam operations, it is now estimated to be a $3 trillion economy. It is also backed by the largest organised crime syndicates in the world. Of the many victims I met, it was evident that not all were innocent; many had returned for their jobs, and many knew exactly what they were being recruited for.
Also read: Myanmar is reaching out to India. New Delhi shouldn’t squander the opportunity
Beginning of India’s cyber diplomacy
The industry is now a whole combination of financial enticement, human trafficking, organised crime, cryptocurrency, telecommunications infrastructure, corruption and armed protection. The fact that many don’t see the moral dilemma in working in this industry, perhaps because you never come face to face with the victims, makes it more alarming. United Nations Office on Drugs and Crime (UNODC) estimates that scam losses across East and Southeast Asia, Australia and New Zealand reached $88-114 billion in 2025, up from $18–37 billion in 2023.
And this is where the convention becomes important, as it tackles a core issue—the problem of evidence sharing in the form of telecom records, crypto transactions, etc. While India has Mutual Legal Assistance Treaties with Myanmar, Bangladesh, Sri Lanka, Indonesia and Malaysia, anywhere else it depends on diplomatic requests. Even though the convention offers a broader framework for cooperation, the problem is that a treaty requires trust and political will.
Cyber cooperation means sharing identities, financial records, subscriber data and potentially communications. States do not trust one another equally, and they define cybercrime differently. For some countries, what is law enforcement for another becomes surveillance. And this critical difference naturally becomes a part of negotiations. UN human rights experts have warned that the electronic evidence provisions were broad enough to extend investigative powers beyond conventional cybercrime. The text contains safeguards, but disputes over privacy, proportionality, and intrusive cross-border requests remain.
India, on the other hand, must widen its access to evidence without compromising national security. But the greater difficulty is that the convention operates between states, while major cybercrime ecosystems thrive where state authority is fragmented. If the server is in one country and the compound sits in territory where the central government’s writ is contested, an assistance request achieves little because the receiving state cannot enter the compound, as is the case of Myanmar.
India’s signature on the convention should, therefore, mark the beginning of its cyber diplomacy. There is much more to do in times to come, as until now New Delhi, similarly to its neighbours, has only viewed neighbourhood security through borders, terrorism, insurgency, narcotics, migration and maritime threats. Now, it’s clear that these overlap with cybercrime. UNODC data shows that trafficking for forced criminality rose from 1 per cent of detected victims in 2016 to 8 per cent in 2022.
What India needs now is a digital neighbourhood policy. Using the convention as a foundation, and once in force, India must develop bilateral mechanisms based on evidence sharing. Building trust on an issue that will impact Bangladesh, Nepal, Sri Lanka, Myanmar and Southeast Asia will be imperative if this issue has to be tackled. Linking financial intelligence with trafficking investigations, targeting recruiters operating inside India, following crypto account networks and treating scam compounds as transnational organised crime, not merely online fraud, will all require liaising.
Furthermore, proper redressal will need to recognise victims correctly. An Indian rescued from a compound may have been both forced to commit fraud and trafficked, but also gone there willingly knowing the job description. This has its own implications. India’s response will, therefore, have to be sophisticated enough to recognise both criminal responsibility and exploitation, rather than assuming that everyone found inside a scam compound belongs neatly on one side of that divide.
Finally, the convention matters. But treaties do not arrest criminals. States do. India’s cyber frontier no longer ends at its territorial boundary. It runs through smartphones, servers, crypto wallets and sometimes through a guarded compound in Myawaddy. Signing in New York was an important step, but the harder task is recognising that India’s neighbourhood security is no longer merely territorial. Its borders are becoming digital.
Rami Niranjan Desai is a Distinguished Fellow at the India Foundation, New Delhi. She tweets @ramindesai. Views are personal.
(Edited by Saptak Datta)