India loses Rs 70k crore to cybercrime annually, and the criminals are getting bolder

We live in an age where most of our transactions are through digital means, whether it is UPI payments, card transactions or purchases made on e-commerce platforms. This also means that our financial and identity data are available to those who would use them for nefarious means, as recent instances of the ‘FedEx scam’, and other online frauds, show. But just how big is the problem?

According to the latest estimates by the cybersecurity industry, online cyber frauds bleed the Indian economy of Rs 70,000 crore annually. This is much higher than the previously reported estimate of Rs 10,000 crore.

India has a massive online fraud problem, and the reason it hasn’t registered in our collective minds is because 90% of the incidents involve stealing a moderate amount of under Rs 50,000.

The modus operandi

It’s all part of the modus operandi for scammers: Steal a small amount in a single incident so that it doesn’t come under law enforcement radar

“Scammers will start by stealing small amounts, say a few hundred rupees, and then will increase the amount stolen to a few thousands and then lakhs as the scammer understands the victim more. The scammer will also gain more confidence as they target new victims and will try to steal larger amounts,” said former IPS officer and cybersecurity expert Prof Triveni Singh. 

Interestingly many of the online frauds where large amounts have been stolen are traced to China, Singh adds.

To make matters more complicated, online scammers will almost never be physically present in the same geographical location as the victims they target. A cost of a multi-state police investigation far exceeds the amount stolen when it’s only a few thousand rupees.

At the backend most scams involve 4-5 mule account hops so it is even harder to trace the actual scammer. A ‘mule account’ is when scammers use an innocent civilian’s bank account to transfer the stolen money.

Scammers simply pay an unwitting person such as a day labourer or a shopkeeper Rs 1,000 a day to use their bank account. In this way scammers will use 4-5 mule accounts to transfer the money before converting it into cryptocurrency, thereby making it impossible to trace the money trail back to the scammer. When the police investigate, the money will be tracked back to these innocent ‘mules’ who had little idea they were part of a grander operation.

Online fraud almost always involves social engineering or tricking the victim into doing something stupid. Scammers know it is too expensive and technologically more difficult to hack into banking systems and directly steal money from bank accounts. That’s why scammers engineer or create scams to trick victims.

Fear and hope

The ‘courier scams’ like the recent scam in the name of Fedex are some of the most popular scams right now. The scammers work as a team, some posing as courier company or airport security personnel and others as law enforcement officials.

They call and allege there is a parcel being couriered with the victim’s name containing illegal items, like drugs. The scammers then trigger fear and anxiety by claiming the victim can be arrested for this. The victim, out of fear, agrees to transfer money to what the scammers say is a ‘holding bank account’ until the ‘investigation’ into the illegal items is over.

Or in the case of the female lawyer recently, the scammers posing as narcotics bureau officials asked her to strip for a fake ‘drug test’, recorded the video and then blackmailed her till she agreed to pay ransom.

Other popular scams are job scams and investment scams. With job scams the fraudsters trick victims using the lure of a high paying job. But in order to get the job you need to pay a fee. The victim whose trust has been earned ends up paying a fee for a non-existent job.

It’s the same with investment scams. Scammers find victims via social media, messaging, and dating apps to cultivate trust, then convince victims to sink money into a ‘high return investment scheme’ usually involving cryptocurrency. The victim makes the investment and the scammer disappears with the money.

In the upcoming articles, we will focus more on these scams, why do people get defrauded, what do regulators and law enforcement officials do, and the laws which protect citizens against such scams.

Meanwhile, FedEx issued a statement saying that the company never seeks personal information of its customers.

"FedEx does not request personal information through unsolicited phone calls, mail, or email for goods being shipped or held, unless requested or initiated by customers. If any individual receives any suspicious phone calls or messages, they are advised not to provide their personal information. Instead, they should immediately contact the local law enforcement authorities within the vicinity or report to the cybercrime department of the government of India."

(The author, Regina Mihindukulasuriya, is a Bengaluru-based freelance journalist. Views are her own)