On-Line Frauds

There are various types of frauds. Depending on type of Online fraud, you can take/use any or all of the following actions/ tips.

• Stay Calm. Do not panic. Do not take any rash decisions. Do not pay any money to scamster.
• You may take the screen shot of the caller’s no / email or any communication with scamster.
• Block the sender email or caller no.
• Immediately Informe your bank / service provider and register an official complaint in respective unit about the fraudulent transaction / incidence.
• Block the necessary accounts / card / online app of yours. (if possible, allow only your ongoing ECS, Mandate, PDC to be cleared)
• Disable your call forwarding if any.
• Enable 2FA (two-factor authentication) if not done earlier.
• Change password using different device of yours i.e. laptop / desktop.
• Visit the official Cybercrime site of government (www.cybercrime.gov.in ) and register your complaint.
• Call cybercrime help line No 1930
• Do reporting / registration along with FIR for any fraud within 24 hrs.
• Verify the genuineness of competent authority / anyone before sharing any sensitive information.
• If required, visit the nearest crime branch / police station personally.
• Inform the incidence to your close social contact group so they are not taken for surprise if at all, the fraudster tries to post any wrong thing about you or impersonate you in your social Network and initiate any financial transitions.
• Temporarily delete / block all your social profiles.
• Monitor your Financial accounts.

RBI has also published detailed documents on various types of frauds, Do’s and Don’ts.
Please refer the same on RBI official website - Reserve Bank Of India (https://www.rbi.org.in)

Path: On RBI website home page, refer links given: E LMS- Resources -Download Section – Be(A)ware

Document Names –1. Be(a)ware, 2. Raju and Forty Thieves
In case you are not able to find these documents, reach us and we will help you.

Knowledge Areas (about frauds / scams) Covered:

Part A

• Phishing links
• Vishing calls
• Frauds using online sales platforms
• Frauds due to the use of unknown / unverified mobile apps
• ATM card skimming
• Frauds using screen sharing app / Remote access
• SIM swap / SIM cloning
• Frauds by compromising credentials on results through search engines
• Scam through QR code scan
• Impersonation on social media
• Juice jacking
• Lottery fraud
• Online job fraud
• Precautions
• Money mules

Part B - Modus Operandi and Precautions to be taken against Fraudulent Transactions - NBFCs

• Fake advertisements for grant of loans
• SMS / Email / Instant Messaging / Call scam
• OTP based frauds
• Fake loan websites / App frauds
• Money circulation / Ponzi / Multi-Level Marketing (MLM) scheme frauds
• Loans with forged documents

Part C - General precautions to be taken for financial transactions

Apart from above list, we believe that some insights on following trending types of Online Frauds will be useful for every one:

Modus Operandi –

1. Initial Contact: The scam often begins with a phone call or message from someone claiming to be from a legitimate organization, such as a bank, government agency, or tech support. They may use various tactics to gain the victim's trust, such as offering a fake Offer, claiming there's a problem with the victim's account, KYC to be updated, or posing as a trusted individual.
2. Instructions to Enable Call Forwarding: The scammer convinces the victim to enable call forwarding (will not use the word, call forwarding but will ask to press certain keys like “ * ” ,” # ” etc. in certain sequence) on victims’ phone, on pretext of security reasons or to resolve an issue. They may provide step-by-step instructions, claiming it's a temporary measure to verify the victim's identity or fix a technical problem.
3. Activation of Call Forwarding: Once the victim follows the instructions and activates call forwarding (certain keys on device are pressed in certain sequence), all incoming calls to their number are automatically redirected to another number controlled by the scammer.
4. Exploitation: With calls now redirected, the scammer can carry out various fraudulent activities, such as intercepting calls containing sensitive information (e.g., banking details, authentication codes), impersonating the victim to gain access to accounts or personal information, or conducting further scams targeting the victim's contacts.

Some Tips:

1. Never hand over your mobile phone to unknown person: To active call forwarding it takes only few seconds, as few keys on mobile needs to be pressed in certain sequence. Hence always be attentive if at all you need to hand over your mobile to someone unknown.
   If someone requests for a call to be made from your mobile on any pretext like battery of requesters mobile is down etc., do take the contact no from requestor which he wants to connect, verify the given no’s authenticity and yourself connect the call. Do not press any key other than normal mobile or landline no.
2. Be Skeptical of Unsolicited Calls: Be cautious when receiving unexpected calls, especially if they claim to be from a reputable organization. Legitimate companies typically won't ask you to enable call forwarding or provide sensitive information over the phone.
3. Verify Requests: If someone asks you to enable call forwarding or take any other action involving your phone settings, verify their identity independently. Call the company or organization directly using a trusted phone number obtained from their official website or documents.
4. Guard Personal Information: Avoid sharing personal or sensitive information, such as account numbers, passwords, or verification codes, over the phone unless you initiated the call and are certain of the recipient's identity.

Note: Refer the common actions / tips given in the starting of this document.

Modus Operandi - In this type of fraud, the customer gets cheated without sharing the OTP (One Time Password). We know now days, in most online transactions, OTP is must. Then how come without OTP we get cheated?

It is observed that few sites do not need 2-way authentication. Mostly such practice is in foreign countries and fraudsters take advantage of this fact.

1. Malicious Applications: Many times, inadvertently we download some software applications on our device. These devices are specially designed to monitor and steal our passwords / OTPs etc.
2. SIM Swapping: As explained in RBI document, under this scam, the scamster has already got hold of all credentials of victim. On the basis of these credentials, scamster gets the duplicate SIM issued to self. Now the Old SIM gets deactivated and all the information including OTP, Messages etc. will be send on the SIM which the scamster is holding. There is a small-time window where during SIM swapping activation, both SIMs are active. This time window is exploited by scamster most of time.
3. Over the call OTP: Many times, it is observed that the scamster activates the over the call OTP facility. This is another way to get OTP in place of OPT by SMS. So, when the service provider calls to give OTP to original customer for SIM swapping authentication, the scamster also gets hold of this call, OTP and dose the scam.
4. Miss Calls: Sometime the victim gets series of repeated calls from an unknown no, especially in our busy or lazy hours. At times, we avoid these calls and sometimes we pick these calls, without much checking. When we take such call, we find out it is blank call or irrelevant wrong call. This normally happens when SIM swapping is being processed. Scamster tries to keep your mobile network busy or irritate you to such a level that you switch off your mobile. As a result, the original messages from the bank or service provider does not reach to you on time. In by the time, it reaches you, the fraudster does the fraud.

Some Tips:

1. Miss Calls / Over the call OPT: If you get repeated miss calls / Over the call OTP, do not ignore it. Do not switch off the mobile. In fact, be more vigilant and track your account. Check with your bank and service provider and verify about possibility of any unauthorized / fraudulent transaction / request.
2. No Network: When without any obvious reason the network of your SIM goes off, it can be a sign that deactivation of your SIM is being attempted. Get in touch with your service provider using other device and verify the situation.
3. Transaction Limit: For your account / cards, check the international limit activation. If you do not need the internation limit, kindly deactivate the same. Also, put the threshold spending limit for Online transactions, POS transactions, ATM withdrawal and Fund transfer as per your requirement.
4. Virtual Card: For Online Transaction, generate virtual card for required amount which is valid for limited period only (mostly for 1 or 2 days) so to avoid exposing your card details on any site. Few leading banks provide this facility. Avoid saving your cards details on any site.
5. Masked Aadhar Card: Aadhar card no is unique no. Disclosing this no to any one may invite breach to your KYC. Hence use masked Aadhar card. Masked Aadhar Card shows only last 4 digits of your Aadhar Card and hides the remaining digits. Log in to official Aadhar card site and check out for your masked Aadhar card.

Note: Refer the common actions / tips given in the starting of this document.

Modus Operandi - In this type of frauds, the fraudster gathers all the key details of victim. impersonate self as a representative from reputed logistic / courier company and calls up the victim on pretext of delivering the parcel received from a faraway or foreign location in victim’s name. They convince the victim about their fake identity, by confirming victim’s relevant details.

1. Parcel contenting illegal / banner material: Then caller very politely express their inability to handover the said parcel to victim due to violation of their internal guidelines. They also inform the victim that as per internal guidelines, they have to highlight this matter to their legal/ compliance team who will coordinate with you. After some time, victim gets another call from so called legal team of same company who again confirms all key information of victim and politely says that they suspect some illegal material / banned material in this parcel received on victim’s name. Hence as per regulatory guidelines they have to refer this matter to narcotics / crime department of police. They further request the victim to kindly coordinate with concern authorities. By now the victim is already confused and worried.
2. Video / Skype call from fake authorities / police: After sometime the victim gets another call from so called crime unit / police station. Caller instruct the victim to join video call or Skype, where they can have face to face communication. When the victims join such video call, he can see that the other person on call is dressed up in uniform and / or the office set up behind him seems to be of police station / crime unit. The person talks in typical police style. The person impersonating himself as police / authority, say that they have received victim’s case from XYX and on investigation they found some illegal banned stuff in said parcel which is a non bailable office and punishable with imprisonment.
3. Money demand for way out: By now the victim is totally tensed and into the trap of fraudster. Victim starts trying and convincing the fake COP about his innocence and No connection with this parcel. After few unsuccessful attempts, the Fake COPs give option to victim for a way-out of this situation, which the tensed victim quickly and happily accepts. This is the point the fraudster is waiting. He vey tactfully tells the victim to pay some amount to XYZ person or transfer the amount on link which will be shared with victim. The victim dose so and pays the demanded amount by falling prey to scamster.

Some Tips:

1. Verify the authenticity of Caller: When suspect such call, no matter who so ever is the caller, verify its authenticity. Now days there are many such mobile apps to help you in such regard. Best way to check official website and call back on the given no for verification / confirmation.
2. Do not fall prey if someone confirm your KYC details: If you have not ordered or expecting and parcel from concerned location or person, then firmly refuse to take the parcel and ask to send it back to sender.
3. Video call / Skype call: It is observed that in most cases these types of call are used so the victim is convinced on seeing the set up. Instead of joining such call, insist on you personally visiting the office of concerned authorities.

Note: Refer the common actions / tips given in the starting of this document.

Modus Operandi - It is observed that many times scamster send a parcel of small amount marked as pay on delivery. The caller convinces you that this parcel is ordered to be delivered to this address.

We think our family or friends might have sent it for us and get ready pay and take the parcel as the amount is small. We pay the delivery person thru scanner provided by him.

Some Tips:

1. Ask who has requested this parcel: Insist on know the senders / request initiator’s name. Verify with the sender. If not sure about the sender, refuse the delivery.
2. Do not pay by scanner – There are many fake scans available in market which captures payment details and later it can be used for fraud. If at all, you have to pay, the use official website or cash payment option in such situations.

Note: Refer the common actions / tips given in the starting of this document.

Modus Operandi - The "porn video call recording" scam is a type of extortion scam where scammers claim to have recorded the victim watching adult content online and threaten to distribute the video to the victim's contacts unless a ransom is paid. Here's a detailed insight into how this scam works and what you can do if you encounter it:

1. Initial Contact: The scam often begins with an unsolicited email or message claiming that the sender has hacked the victim's device and recorded them watching adult content. The message may include snippets of personal information, such as the victim's password or username, to make the threat seem more credible.
   At times you may get some unsolicited video call and if picked up, the adult contents start on mobile from caller’s side. Before you could understand anything, scamster record you watching live adult content. They share this clip with you and blackmail you.
2. Threat of Exposure: The scammer threatens to distribute the alleged video recording to the victim's family, friends, or colleagues unless a ransom is paid. They may use fear tactics, such as setting a deadline for payment or claiming that failure to comply will result in immediate exposure.
3. Demand for Payment: The scammer instructs the victim to transfer money via cryptocurrency to a specified wallet address in exchange for keeping the video private. They may also provide instructions on how to purchase cryptocurrency if the victim is unfamiliar with the process.
4. Intimidation Tactics: Scammers may use intimidation tactics to pressure victims into compliance, such as claiming to have access to the victim's personal information or threatening legal action if the ransom is not paid.

Some Tips:

1. Unsolicited Contact: Be wary of unsolicited video calls, emails or messages claiming to have compromising information about you. Scammers often send these messages to random email addresses or contact lists obtained from data breaches.
2. Generic or Vague Threats: Scam messages may contain generic threats or lack specific details about the alleged video recording, such as when or where it was supposedly captured.
3. Request for Payment via Cryptocurrency: Scammers typically demand payment in cryptocurrency, such as Bitcoin, to make it difficult to trace and recover funds. Legitimate organizations rarely request payment in cryptocurrency for resolving issues or disputes.
4. Pressure to Act Quickly: Scammers often use urgency tactics, such as setting short deadlines for payment or threatening immediate exposure, to pressure victims into making hasty decisions.

Note: Refer the common actions / tips given in the starting of this document.

What is Call Merging Scam - The call merge scam is a type of fraud where scammers trick victims into merging calls with a fake automated system or a scammer impersonating a bank or other trusted entity. The scammer, often claiming to be a friend of a friend, convinces the victim to merge calls, then uses the timing of an OTP (One-Time Password) delivery to trick the victim into revealing the OTP, thus gaining access to their accounts. 

Modus Operandi:

1. The Setup:
   The scammer contacts the victim, often claiming to be a mutual acquaintance or a friend of a friend.
2. The Call Merge Request:
   The scammer asks the victim to merge the call, perhaps saying they are calling from a different number or need to speak to someone else.
3. The OTP Delivery:
   The scammer strategically times the call merge, ensuring the victim receives an OTP from their bank or other service provider during the merged call.
4. The Deception:
   The victim, believing the OTP is part of the ongoing conversation, may unknowingly share it with the scammer. The scammer takes the OTP on real time basis thru the merged call.
5. Theft:
   With the OTP, the scammer can authorize fraudulent transactions and drain the victim's account.

Some Tips:

1. Never merge calls with unknown parties:
   Verify the caller's identity before merging calls.
2. Be suspicious of unexpected call merges:
   If someone asks you to merge calls, especially if it involves a financial transaction or OTP, hang up and call the person directly using a known number.
3. Banks never ask for OTPs over the phone:
   If you receive an OTP and are unsure of its legitimacy, contact your bank directly using their official customer care number.
4. Report suspicious activity:
   If you suspect a call merge scam, report it to the National Cybercrime Helpline, 1930 or your bank. 

Note: Refer the common actions / tips given in the starting of this document.

This is a sophisticated scam involving a "free phone" offer and SIM card manipulation to steal personal data and financial information. The scammer sends a new phone with a pre-hacked SIM card. Once the victim inserts the SIM and the phone is activated, the scammer can gain access to the victim's accounts, including banking and social media, by intercepting one-time passwords and other verification codes. 

Modus Operandi: 

1. The Bait:

• The scammer offers a "free" new phone, often through social media or unsolicited calls, enticing the victim with the promise of a new device.
• The "free" phone comes with a SIM card already inserted.
• The scammer might also claim it's a promotional offer or a way to upgrade the victim's phone. 

2. The Hacked SIM:

• The SIM card is not just a regular SIM; it's been compromised or cloned by the scammer. 
• The scammer might have obtained the victim's personal information through various means, such as phishing, smishing, or even purchasing stolen data from the dark web. 
• This information is used to convince the mobile network provider to issue a new SIM card linked to the victim's phone number, effectively swapping the SIM and taking control of the phone number. 
• The victim's original SIM card is deactivated, rendering their phone useless. 

3. Data Theft and Financial Fraud:

• With the hacked SIM card, the scammer can receive all incoming calls and text messages intended for the victim, including those containing one-time passwords (OTPs) and verification codes.
• These codes are crucial for accessing bank accounts, social media, and other online services.
• The scammer can then use this access to transfer funds, make unauthorized purchases, or take over the victim's online accounts. 

Some Tips:

1. Be wary of unsolicited offers:
   Don't trust unsolicited calls, messages, or emails claiming to be from mobile providers or banks. 
2. Verify information:
   If you receive a call about a new offer or SIM swap, contact your mobile provider directly through their official website or customer service number. 
3. Avoid sharing sensitive information:
   Never share your personal information, including your IMEI, ICCID, or OTPs, with unknown callers. 
4. Use strong passwords and enable MFA:
   Use strong, unique passwords for all your online accounts and enable multi-factor authentication (MFA) whenever possible. 
5. Monitor your accounts:
   Regularly check your bank and credit card statements for any unauthorized transactions. 
6. Report suspicious activity:
   If you suspect you've been targeted by a SIM swap scam, immediately report it to your mobile provider, your bank, and the police. 

Note: Refer the common actions / tips given in the starting of this document.

If your battery is running low, be aware that juicing up your electronic device at free USB port charging stations, such as those found in airports and hotel lobbies, might have unfortunate consequences. You could become a victim of "juice jacking," yet another cyber-theft tactic.

Modus Operandi: 

This type of juice jacking occurs when victims plug their devices into compromised or fake charging stations using their data-transmitting USB cables. This allows users to steal information, including passwords and pins.

Cybersecurity experts warn that bad actors can load malware onto public USB charging stations to maliciously access electronic devices while they are being charged. Malware installed through a corrupted USB port can lock a device or export personal data and passwords directly to the perpetrator. Criminals can then use that information to access online accounts or sell it to other bad actors.

Some Tips:

1. Use only USB devices from reputable, trusted suppliers.
2. Avoid using free, promotional USB charging cables because they could be infected.
3. Don’t ever use plugs that were left plugged into public USB charging stations.
4. When in Doubt, Go the AC Charging Route

Note: Refer the common actions / tips given in the starting of this document.