Over the past three months, Ruchi Garg, 44, a stay-at-home mother of two in Ghaziabad, Uttar Pradesh, has preferred offline transactions to digital ones. In August, a 13-minute WhatsApp audio call changed the way she uses the Internet and social media. Like many others in her circle, Garg used to spend up to eight hours on her phone on various social media apps, especially WhatsApp.

One morning, after her second son had gone to school and her husband to office, Garg got a WhatsApp call from a number displaying the photo of a police officer in uniform. “I couldn’t understand why a police officer would be calling me,” she says.

Also read | Senior citizen visits SBI to transfer ₹30 lakhs for ‘wife’s treatment’; Staff saves him from losing money to scammers

“The man spoke quickly, saying that my elder son, who is studying engineering in a college in Vellore [in Tamil Nadu], had been arrested in a major scam. He told me that if I wanted to save his reputation, I would have to pay ₹80,000,” she says. The money, he said, was to prevent her son’s photograph from being widely circulated.

“He didn’t let me hang up. He insisted that if I wanted to consult my husband, I should call him from another number,” says Garg. She panicked and sent the money to the Unified Payments Interface number the scammer had given her. “I could hear my son’s screams in the background,” she recalls. “Maybe they used AI to generate his voice.” When the caller asked for more money, something felt odd, and she called her son from another number. “He said he was in class. I understood that I had been scammed and hung up,” she says.

Garg is overwhelmed by what happened to her; shocked that the scammer had profiled her, and knew where and what her son was studying. There is fear of being scammed again. “I verbally informed the Senior Superintendent of Police in Vellore as I was worried about my son, but they did not pursue the case as the [scammer’s] number was from Pakistan,” she says.

Garg is among thousands of Indians who have been the target of a scam known colloquially as ‘digital arrest’. From January 1 to November 15 this year, as many as 92,323 ‘digital arrests’ have been reported across the country with people collectively being cheated of ₹2,140.99 crore, as per the Indian Cybercrime Coordination Centre (I4C) that operates under the Ministry of Home Affairs (MHA) and is the nodal body for monitoring, analysing, and investigating cybercrime trends. There are many more like Garg who have not filed police complaints.

On October 27, Prime Minister Narendra Modi cautioned people against the new cybercrime. He described what Garg and others like her have gone through. Criminals collect personal information and make phone or video calls to prospective victims. They pose as officials from various law enforcement agencies, and at times from the Reserve Bank of India (RBI), and extort money by creating an atmosphere of fear.

‘Digital arrests’ are just one of the many large-scale organised cybercrimes in India. According to I4C, Indians are likely to lose over ₹1.2 lakh crore, roughly 0.7% of the GDP, over the next year due to cyber frauds.

Through 2024, until November 11, financial fraud in the country reported via MHA’s cybercrime portal, cybercrime.gov.in, stood at ₹19,888.42 crore. The 1930 helpline to report such fraud recorded 14.41 lakh calls. In 2023, up to 15.56 lakh calls were received and India’s total cybercrime financial fraud was reported at ₹921.59 crore. As per I4C, cybercrimes witnessed an increase of 113% from 2021 to 2022 and 60% from 2022 to 2023.

Held hostage digitally

Sunita Mehta (name changed upon request), a 57-year-old Central government employee, was travelling on work on May 24 this year during the Lok Sabha election. Back home in Delhi, her husband was alone.

“As soon as I left, my husband, Rajesh (name changed to protect identity), received an automated call stating that his parcel was stuck in the Customs Department. But we were not expecting any parcel,” Mehta recalls. The call was then forwarded to a person who claimed that banned items had been found in the parcel and that the call was being transferred to the Crime Branch.

The caller instructed Rajesh to download Skype. Once he did, a person in a police uniform appeared on screen and informed him that documents pertaining to his identity were being misused for money laundering. The caller showed him a photograph of a Minister in jail and alleged that four bank accounts in Rajesh’s name were used by someone involved in financial crimes.

“Another person in a police uniform appeared on screen and showed Rajesh a letter bearing the logos of the Crime Branch, the Central Bureau of Investigation (CBI), and other probe agencies. They told him that RBI rules stipulated he would need to transfer 96% of his money to a government bank account for verification. They said after verification, the money would be returned,” Mehta says.

The call continued for more than 24 hours as the scammers said they needed to monitor Rajesh 24x7, Mehta says. They even asked him to show them the bathroom before he entered in order to check if anyone else was around. “The moment he paused, another person would appear on the video and start talking. They terrorised him. They claimed to be watching our home with drones and warned him that if he turned off the video, the police would arrest him,” she says.

The next morning, Rajesh went to a bank near his home in south Delhi’s Saket with the Skype video still on. He transferred ₹5.68 lakh to a so-called surveillance bank account of the government. When he questioned the scammer about it being a savings bank account, the scammer assured him that it was done intentionally so that money launderers would not be alerted.

At one point, Rajesh said he would speak to his lawyer. The caller grew angry and warned him that all his money would be seized, and that he would be sent to jail. “They assured him that the money would be returned within 20 minutes. However, after 2-3 hours, when the money didn’t come back, we immediately called the cybercrime helpline,” Mehta says.

She adds that the police only placed the account under surveillance on May 30. “By then, the money had been transferred through several bank accounts.”

Mehta says when they took the case to court, “the bank argued that the money remaining in the account belonged to other victims and our funds had already been moved to other bank accounts”. In court, it was revealed that on the same day at least 30 people had been given that account number to transfer funds to.

Scam compound ‘learning’

On August 20, around 550 km from Delhi, a physician in Lucknow, Uttar Pradesh, fell victim to an identical crime. He was held hostage digitally for 48 hours and lost ₹48 lakh. On November 14, U.P. Police’s Special Task Force (STF) arrested five persons from Gurugram, Haryana, who had cheated the physician.

“While investigating, we found that the money from the Lucknow doctor was deposited in two bank accounts and subsequently transferred to 178 other bank accounts,” says Vishal Vikram Singh, Additional Superintendent of Police (ASP), STF, U.P. Police. The main accused was identified as Pankaj Surela, 28, a graduate and resident of Alwar, Rajasthan.

Singh says Surela had gone to work in a ‘scam compound’ in Cambodia in March. The outfit was owned by five or six Chinese nationals, with staff hired from Pakistan, Nepal, and India. “They received training in how to cheat people by posing as CBI, police, Crime Branch, and narcotics department officials,” the ASP says.

The suspects were arrested on charges of cheating, forgery, and criminal conspiracy under the Bharatiya Nyaya Sanhita and Section 66 of the Information Technology Act, 2000.

The I4C has identified ‘scam compounds’ in Asian countries such as Cambodia, Myanmar, Laos, and Azerbaijan that resemble call centres. These compounds used to be casinos that shut down during the COVID-19 pandemic.

According to a United Nations report from October, Indian youth are being recruited with offers of IT or administrative work, often based in Thailand. On arrival, they are met by agents who transfer them to counterparts, who take them across the border into Cambodia, Myanmar, and Lao PDR. Around 1,300 Indians have been rescued from ‘scam compounds’ between May and August this year.

On January 3, Rajesh Kumar, chief executive officer of I4C, said at a press conference that around 50% of cybercrime complaints on the national helpline every day have their origin in China and pockets of Cambodia and Myanmar.

Surela told the STF that the ‘scam compound’ operators have local conduits in India. He was working for Chinese operators after returning from Cambodia, where he stayed for 15-20 days. “Up to 30% of the commission is assured to the holder of the bank account where the money is parked. It is not only mule accounts; people are also renting their accounts out,” Singh says.

According to I4C, about 4,000 mule bank accounts are identified every day by investigating agencies. Over the past year, over seven lakh mule bank accounts have been blocked. Officials say the defrauded money may be used for terror financing and money laundering, and is often pushed out of the country in the form of cryptocurrencies.

“They exploit a person’s inner fear. If the victim shares their Aadhaar number, they misuse the information and convince the person that they are involved in a crime. If you appear weak, they play with the mind and the person succumbs to the fraud,” Singh says.

The golden hour for reporting the crime is within 24 hours. The helpline and the portal run by the I4C are linked to State police apparatuses in addition to over 300 financial intermediaries, banks, and wallets. Real-time alerts are sent to banks and payment wallets by I4C after a financial fraud is reported, asking them to block or freeze the amount.

However, data from I4C show that out of the ₹11,269 crore that was reported to have been defrauded in the first six months of the year, ₹1,361 crore was blocked by banks, but only ₹11.97 crore was returned to the victims. Until June, I4C had asked Microsoft to block 1,500 Skype IDs involved in digital frauds.

Fraud alert

On October 28, the I4C issued an alert against illegal payment gateways facilitated by mule bank accounts following raids by the Gujarat and Andhra Pradesh police forces.

Visakhapatnam Commissioner of Police Shanka Brata Bagchi says the police identified the main accused who brought the scam from China to India. The illegal set-up was running from a flat in the city in the guise of a cosmetics company.

“The extent of the scam can be uncovered only when the masterminds, who are hiding in the U.S and Taiwan, are caught. All of them have Chinese passports,” Bagchi says.

Five persons, including four women, were arrested in Visakhapatnam. Two primary suspects — Sairam and Girish — had hired people for ₹25,000 each. Bagchi suggests that a certain percentage of police hirings should be reserved for cybersecurity experts.

Chennai residents C. Jebaraj and his wife Shanthi were scammed by men claiming to be from TRAI. | Photo Credit: R. Ravindran

Meanwhile, in Chennai, C. Jebaraj, 75, a retired university professor, and his wife Shanthi, 71, almost became victims of a ‘digital arrest’ on November 5. “We were on a video call with men who initially claimed to be from the Telecom Regulatory Authority of India,” says Shanthi, a home-maker. “Then they told us that my husband’s name had appeared in a major money laundering scam involving politicians and policemen, and that we needed to cooperate to save him. One of the callers was even wearing a police uniform,” she adds.

After the call went on for a couple of hours, their daughter, who also lives in the city, called Jebaraj. He told her that they couldn’t speak and briefly explained what was happening.

“She rushed home. When she arrived, the call was still going on with the logo of Delhi Police’s Crime Branch on the screen. She immediately disconnected the call. Later, we received a threatening message saying that if we didn’t take the call, we would be arrested,” Shanthi says. Her daughter then reported the incident to the cybercrime helpline, informed the bank, and requested a password change for their accounts.

A police officer said people’s personal information is on sale on the dark web and apps like Telegram for as low as 10 paise. According to Akshat Khetan, founder of AU Corporate Advisory and Legal Services that also offers financial services, black market data trading must be tackled jointly by the government and technology platforms. He calls for stronger penalties for violations to deter illegal sale of data.

As of March 31, 2024, there are at least 95 crore Internet users in India.