The next part of our scams series. A stranger calls and knows your name, your bank or your child's exam rank. That is rarely luck. Personal data is bought and sold in India, sometimes for less than a rupee a person. Here is what a list costs, where it comes from, how it turns into a scam call, what the law does and doesn't do yet, and what you can do today.
- 5 paisea mobile number's price in a 2026 police case, by our arithmetic
- 412026 exam and institute databases on sale in July, MediaNama found
- 31.09 lakhspam complaints filed in India in 2025
- 771 crorecalls flagged as suspected spam in April 2026 alone
What a person costs
In Bilaspur in June 2026, the operator of a loan services office told police of having bought about one lakh mobile numbers for Rs 5,000. That is five paise each. Prices vary a lot by what's in the record, but they stay small.
- 1 lakh mobile numbersRs 5,000Paid. Bilaspur, June 2026.
- 10,000 people's dataRs 2,500Paid. Noida, July 2024.
- 10,000 people's dataRs 30,000Paid. Hyderabad, May 2023.
- 15 lakh+ exam recordsRs 6,999Listed. July 2026.
- 1.38 lakh NEET PG aspirantsRs 3,599Listed, as alleged by doctors. October 2025.
- A vehicle owner's name and addressUnder Rs 2Reported by the Internet Freedom Foundation, September 2026.
- One person's phone recordsRs 5,000One reported rate. Mumbai, October 2026.
Paid means police say that sum changed hands. Listed means a seller's asking price, with the seller's own record count. These are different kinds of data, so the list doesn't show a trend.
Where the data comes from
Hackers are only part of the story. Many lists start with someone who had ordinary access, or with nothing more than patience.
- Staff at outsourced vendorsDelhi Police said staff at a call centre serving a bank's card customers leaked customer data. The fraud came to about Rs 2.6 crore, with 18 arrests.
- Telecom staff and SIM sellersIn a Delhi case, a client list passed from a telecom employee through a chain of people. In Mumbai, a SIM gallery sales executive was held for allegedly misusing customers' KYC details to activate SIMs.
- Exam and admission recordsMediaNama found databases covering nearly every major entrance exam listed on three websites.
- Directories and doorstepsIn the Bilaspur case, police said the numbers were gathered from departments, online directories and door-to-door visits. No hack was needed.
- Stolen school recordsThe Bombay High Court heard in June 2026 that hacked data included children's travel routines and mental health details. It said this could pose "a grave risk" to their safety.
- Phone recordsMumbai police arrested seven people, including two police constables, over phone records allegedly sold to people watching spouses, employees and rivals.
How one record becomes a call
A number alone is cheap. It becomes dangerous when it comes with a reason to call you. Tap a step to see how a caller's knowledge adds up.
An exam, a course enquiry or a shop asks for your name and number. Nothing feels unusual.
In Lucknow, police say two men bought data of NEET-qualified students with low ranks online.
A low rank means a family that is worried about a medical seat. The seller doesn't need to guess.
Families were called about management-quota seats. Four complainants reported paying about Rs 45 lakh, Rs 20 lakh, Rs 38 lakh and Rs 23 lakh.
An illustration with made-up details, built on a Lucknow case reported by PTI and Aaj Tak in November 2025.
Why such a cheap list pays
A list only needs a few victims to pay for itself. Take the Hyderabad case reported in 2023.
- Rs 30,000paid for 10,000 people's data
- Rs 1,000paid per SIM card
- Rs 26,000 a monththe home job offered
- Rs 2,600deposit asked of each victim
- About 12deposits pay back the list
Source: Telangana Today, May 2023. The last step is our arithmetic.
Scale it up and the sums grow. In the Delhi telecom case, police said about 6,372 clients lost about Rs 1.94 crore to fake call centres using one company's customer data. In Noida in January 2026, police said a gang bought insurers' customer data "from the market". They seized 721 data sheets and arrested 13.
Students are a market too
Exam candidates are easy to target: a known age, a known goal, a deadline and a worried family. In July 2026, MediaNama found one database claiming over 15 lakh CUET UG 2026 records for Rs 6,999. It called people from a sample of over 500 students. Six answered, confirmed the details and hadn't known their data was on sale.
NEET PG aspirants reported calls from people who knew their ranks and scores, offering seats for Rs 25 lakh or more. No link between those calls and any listing has been proved. The exam board denied a breach at its level, and said the data moves across several bodies during counselling. A call like this can be the first step into a fake college or unapproved course.
What the law does, and doesn't do yet
India has a data protection law, but most of it hasn't started. This is the point people most often get wrong.
- August 2023Parliament passes the Digital Personal Data Protection Act.
- November 2025Definitions and the Data Protection Board's legal basis start. The Rules are notified.
- August 2026The government tells the Lok Sabha the Board's members are still to be appointed.
- November 2026Consent manager registration is due to begin.
- Around May 2027Notices, consent, security duties, breach alerts, people's rights, complaints and penalties are due to begin.
- Until then, you can't take a complaint to the Data Protection Board.
- Penalties can reach Rs 250 crore, but they go to the government, not to the person harmed.
- Your new rights will apply to companies you gave consent to. They won't reach a stranger who bought your number.
Other rules already apply. Companies must report cyber incidents to CERT-In within six hours, but that report doesn't go to you. If customer data leaks through a bank's outsourced vendor, RBI's rules say the bank "shall be liable to its customers for any damage". CERT-In tracked 29.44 lakh cyber security incidents in 2025, but that counts all incidents, not data breaches. We found no official yearly count of breaches.
Spam is the part you can see
Spam complaints reached 31.09 lakh in 2025, and more than 18 lakh in the first half of 2026. Still, in April 2026 telecom systems flagged about 771 crore calls as suspected spam, against fewer than 4 lakh complaints, TRAI's own memo shows. It also shows operators closed about 80% of complaints against registered telemarketers as invalid. TRAI says most spam comes from ordinary 10-digit numbers, which bypass your preferences. In a LocalCircles survey, 87% of respondents believed their data was already out there. That is a belief, not a measure, but it's a telling one.
What you can do today
There is no official service that shows which of your data is out. You can't take back a leak, so watch for its effects and make the data less useful.
- Don't trust a caller for knowing your details. Your rank, loan or policy number proves nothing. Those details are for sale. Hang up and call the official number yourself.
- Report spam within seven days. Use the TRAI DND app or 1909. Blocking only hides a number on your phone. Reporting helps trace it.
- Report fraud attempts. If no money was lost, use Chakshu. If money was lost, call 1930 at once.
- Check the SIMs in your name. Sanchar Saathi lists them, and you can report any you don't recognise.
- Pull your credit report. Every credit bureau must give you one free full report a year. Look for loans you didn't take.
- Give less. Ask why a form needs your number, your Aadhaar or your date of birth. Our post on Aadhaar and PAN photocopies explains what to do.
Where TheRollNumber fits
Apps are one more way data leaves your phone, and most people can't remember what they allowed. ADi Wallet's Device section shows which permissions each app on your phone holds, with family controls. It can't stop a leak, but it helps you see what you've given away. Businesses that collect documents to check people can use Checkkbox to work with a person's consent and fetch records from the source. Talk to us to see how.
Sources
- NPG News (Hindi), on the Bilaspur data case, June 2026
- MediaNama, on leaked student data sold online, July 2026
- Zee News, on the Noida fake call centre, July 2024
- Telangana Today, "Cybercrooks bank on gangs selling personal data", May 2023
- Careers360, on the NEET PG 2025 data claims, October 2025
- Internet Freedom Foundation, "Less than Rs 2 for your name and home address", September 2026
- Outlook, "Two cops, five others booked for selling call records", October 2026
- PTI via The Tribune, on the Gurugram call centre data leak, August 2025
- PTI via ThePrint, on the Delhi fake medicines case, May 2023
- Free Press Journal, on a SIM seller in an admission fraud, September 2026
- Bombay High Court, Interim Application (L) No. 19695 of 2026, order of 12 June 2026. We don't link it, because the order names a school.
- PTI via Careers360, on the Lucknow MBBS admission case, November 2025
- Aaj Tak (Hindi), on the Lucknow NEET admission case, November 2025
- ETV Bharat (Hindi), on the Noida insurance fraud, January 2026
- The Federal, on calls to NEET PG aspirants, January 2026
- Medical Dialogues, on NEET PG data for sale, December 2025
- Digital Personal Data Protection Act, 2023
- Ministry of Electronics and IT, G.S.R. 843(E), commencement notification, November 2025
- Digital Personal Data Protection Rules, 2025
- Lok Sabha Unstarred Question 3960, 12 August 2026
- CERT-In, Directions of 28 April 2022
- RBI, Managing Risks in Outsourcing Directions for commercial banks, November 2025
- PIB, IT Ministry's reply to the Lok Sabha, August 2026
- PIB, TRAI's annual update on spam, February 2026
- TRAI, Third Amendment Regulations with explanatory memorandum, 18 September 2026; the half-year total is our sum of its two figures
- PIB, reply to the Rajya Sabha on spam, February 2026
- PIB, TRAI advisory on reporting spam, November 2025
- LocalCircles, survey on personal data leakage, March 2025
- Department of Telecommunications, Chakshu on Sanchar Saathi
- Department of Telecommunications, Sanchar Saathi mobile connections check
- Reserve Bank of India (Credit Information Companies) Directions, 2025, updated as on 1 July 2026, paragraph 21(7)
