Last week, heart-wrenching news of death by suicide by an elderly couple in Belagavi, Karnataka, shook us. The duo was under threat from scamsters who claimed that a SIM card had been purchased in the husband’s name for illegal activities. The husband and wife complied with the scamsters’ demands by transferring their life savings of ₹50 lakh out of fear. When the fraudsters demanded more, the couple faced the heart-breaking prospect of losing everything and having to depend on others for the rest of their lives. Unable to bear the possible ignominy, they made the tragic decision to end their lives.

In another incident, in early March, a retired IFS officer from Himachal Pradesh lost his savings, retirement benefits and the proceeds from the sale of a house – all worth over ₹6.5 crore, when he fell prey to scammers who lured him to install dubious apps that would earn him lucrative returns from the stock market. He now faces the difficult reality of rebuilding his life in retirement, grappling with the weight of this devastating loss.

Both are cyber scams – while one takes advantage of the victims’ fear and lack of awareness, the other exploits their desire for more. Such greed and fear have led to the siphoning off of more than ₹35,000 crore to cyber scamsters in foreign lands over the last four years, says Sandeep Mittal IPS, ADGP - Cyber Crime Wing, Tamil Nadu. The amount is about as large as India’s savings from buying less expensive crude oil from Russia in a year, he adds.

His remark that the digital realm has become the fifth domain of warfare — after land, water, air and space — is hardly an exaggeration, especially considering the level of sophistication employed by fraudsters today, who deceive both the aware and the unaware alike.

Today, digital tools are as essential as oxygen. From banking to shopping, work to entertainment, everything runs on screens and algorithms. One poor move on this digital minefield, such as a wrong click on a phishing link or the use of a weak password can mean your hard-earned money could end up in the hands of cyber criminals. Once stolen, it is often irretrievable. The best defence? Awareness. In a world where we can’t live without digital aids, staying vigilant is the price of security.

The onus of spreading awareness can never be on the State alone, but needs a concerted effort with all stakeholders pitching in, such as law enforcement, financial institutions, social media platforms and the media.

Here is our attempt to help you understand common modus operandi (MO) of fraudsters, so that you can keep vigil. Also find excerpts of our interview with Mittal, where he tells us what to watch for.

Phishing

The phishing MO is quite common and is one of the most notorious of cyber frauds. It’s so rampant that it is tempting to bet that there is a phishing e-mail in your mailbox right now.

A phishing mail is a fake e-mail that does a great job looking like it’s from a trusted source, such as a bank, a company or a government agency. It ‘baits’ you into clicking a link, downloading a file, or sharing personal information. The word ‘phishing’ in fact comes from ‘fishing’ due to the presence of ‘clickbait’-y content in such e-mails.

These e-mails often evoke a sense of urgency in the recipient, by means such as warning you about a ‘problem’ with your account, to make you act quickly without thinking. For example, you could receive an e-mail from SBI, asking you to complete KYC by clicking on a link in that e-mail, failing which ‘your account will be deactivated in 24 hours’. The logos and the fonts will all appear so genuine that you’ll need a watchful eye to tell the fake from the legitimate ones.

Fraudsters target even corporates. Take this case of a Hyderabad-based infrastructure company. One of its employees (likely from the finance department) received a fake e-mail from the fraudsters, who impersonated a company vendor. The mail specified a different bank account to which payments are to be made, as the regular account had become inoperable. Consequently, the company transferred funds to the account specified in the phishing mail and lost ₹5.5 crore to the crafty scamsters. A review later revealed that the domain of the sender’s e-mail ID was different. Domain here means the part of the e-mail ID that follows the ‘@’ symbol.

Perpetrators use Cyrillic characters (Greek letters that resemble English letters, and which are recognised by a computer as a special character) to replace one or two letters in the original domain. A closer look at the sender’s mail ID or a double-check with the actual vendor about the status of the bank account, through known channels, could’ve saved the company ₹5.5 crore.

These apart, fraudsters employ novel tricks such as a clickbait picture of a popular celebrity embroiled in a made-up controversy and circulate it widely on social media, especially through ‘verified’ accounts on X (formerly Twitter) that they control. The links embedded in such posts are malicious and could scrape vital personal information off your devices.

Smishing

Smishing is no different from phishing, except the medium is SMS. Fraudsters often take to smishing, as banks communicate a lot through SMSs today. These messages urge recipients to click on links purportedly for the purpose of KYC verification, processing before sanction of a loan, verification of bank accounts before disbursement of income-tax refund and so on.

While official communication from banks, for instance, use letters of the alphabet to mask the actual phone number of the sender (called masked sender ID), such as ‘SBIBNK’, smishing SMSs often contain the actual phone number. This can be a red flag. It’s always better to crosscheck with your bank’s branch, before clicking on the link.

With the growing popularity and convenience of WhatsApp, several businesses have moved to the app with a business account. Scammers, too, have followed them there. Take the case of this teacher from Delhi, who got a WhatsApp message from an account that had her bank’s name. The profile picture even had the bank’s logo.

The message asked her to download the ‘APK’ file of an app for the purpose of ‘KYC checks’. When she complied, she started getting messages of money being debited from her bank. Even when she contacted the customer care executive (whose number was included in the WhatsApp message), she was reassured that such debits are part of the KYC checks and that her money is safe. Little did she know that she would lose her retirement corpus of ₹47 lakh in a matter of two-three hours.

Always look for the ‘verified’ check mark if it’s a message from a business account or even crosscheck with your branch, to be safe rather than sorry. Smishing also includes other scams such as the traffic challan scam, where an SMS containing a link to a look-alike transport department website would be sent to the victim to pay fines. It’s better to be aware of the link to the official website and visit it directly to check the legitimacy of the challan, rather than clicking on such links.

Targeting the greedy

Post-pandemic, people have taken a liking to risky investment avenues such as stocks, IPOs, derivatives, currencies and cryptocurrencies, hoping to make a quick buck. Those cafeteria chit-chats about a colleague having made a fortune in F&O (futures and options), screenshots of deep green portfolios on the Internet and videos of social media influencers fuel the FOMO (fear of missing out) trend.

Cyber criminals thrive on this greed and FOMO. Unsuspecting investors click on links promising unreasonable returns, taking them to a social media group. These groups promise high returns, insider tips, or risk-free profits. They look quite genuine and purport to be registered with the SEBI too.

Once in the group, victims are urged to click a link to invest. The link leads to a fake trading platform that looks real, often showing a sleek dashboard and a fast-growing portfolio. Often, such platforms tend to be knockoffs of reputed brokers too. Encouraged by the apparent profits, victims may invest more money, believing they are making huge gains.

However, when they try to withdraw funds, the real trap is revealed. Scammers demand extra payments, claiming it’s for taxes, processing fees, or unlocking higher withdrawal limits. No matter how much is paid, the money is never returned. Eventually, the scammers disappear, leaving victims with nothing. In some cases, these frauds turn out to be a classic combination of a Ponzi scheme and multi-level marketing, where senior participants would be allowed to withdraw funds that are paid out of the contributions that junior participants bring in.

While ‘not to be greedy’ is the obvious takeaway here, it also helps to know how investing in stocks, for instance, works. A demat account is different from a trading account. A demat account is like a wallet for your investments, maintained with a depository (CDSL or NSDL), while a trading account is the one you maintain with your broker.

Whenever you buy shares on your trading account, the shares are received in your demat account (linked to that trading account), once the trade is settled. When this happens, you’ll receive an SMS from your depository confirming the same. The portfolio shown on the broker’s platform is a mere reflection of the demat account and not the other way around.

While it is not advisable to join such social media groups in the first place, such awareness could’ve saved victims in the early stages of fraud, before parting with substantial sums.

These apart, conmen also keep up with sunrise technologies such as AI deepfakes to float videos of personalities promoting a made-up investment scheme on social media. Gullible investors who throw caution to the wind and fail to question the absurdity of the claims fall prey to such schemes.

Digital ‘arrest’

This MO has been such a menace these days that it has ruthlessly impacted both the commoners and public figures alike. Here, scammers happen to operate out of countries such as Vietnam, Cambodia and Myanmar. They operate scam compounds where they enslave and employ poverty-struck immigrants, who are lured into the country by agents promising a career.

These operators then profile victims, taking cues from what they post on social media, aka ‘digital footprints’. The watch you wear, the car you drive, the places you go to — they all give away how affluent you are; and the people with whom you post pictures, disclose the details of your personal life. Even your child’s harmless birthday celebration, in which the child’s voice is audible, can be used by scamsters to spoof the voice using AI.

Once a victim has been targeted, the scammer video-calls the victim. The victim would be caught off-guard to see an elaborate set-up of a police station or a customs office or a court, with the scammers dressed in knockoffs of official uniforms. The victim is then informed that the ‘authorities’ have confiscated contraband or drugs received in the victim’s name. The victim would even be asked to confirm their Aadhaar number or other identity numbers, which the fraudsters might have lifted from the dark web. The conmen try to establish legitimacy by going a step further, sending doctored court orders or arrest warrants to the victim. They then demand substantial sums of money as penalty for the made-up offence. Another case can be that the victim is informed that his or her child is involved in an offence and that they need to pay up to let them go.

Next, the criminals employ pressure tactics such as ordering the victim to isolate herself and not to get in touch with anyone. They create a sense of urgency, allowing little time for the victim to become mentally stable and think through their actions. Victims are kept in this state of digital ‘arrest’ until they give in and pay. If at all a victim pays, the money is split within minutes and sent to hundreds of ‘mule’ accounts spread across numerous layers, making it difficult to track them.

“There is nothing called ‘digital arrest’ in this world,” says Mittal. “People should be vigilant if they receive such phone calls and should be bold enough to handle it and not panic. Call the helpline 1930 at any time of day or night. It’s the first line of defence in cases where money is lost. It would be prudent to register a complaint with 1930 without any delay in case money is lost, instead of visiting a police station and wasting ‘the golden hours’ to retrieve the lost money,” he adds.

(This is a free article from the businessline premium Portfolio segment. For more such content, please subscribe to The Hindu businessline online.)

Published on April 5, 2025