A fake FedEx agent, RBI letters, politician Nawab Malik’s name: How scammers carried out a UPI fraud

Scam

It all began with a seemingly innocuous phone call on February 26 morning for 33-year-old Rima (name changed), a senior executive at an international consumer brand in Gurugram.

The caller, Shabaz Ali, identified himself as a customer service representative from FedEx, the global courier giant.

What followed though turned out to be a nightmarish experience.

With a tone of urgency, the caller informed Rima of a parcel purportedly dispatched in her name to Taipei (Taiwan) from Mumbai, intercepted by customs officials.

“The contents are alarming, Ma’am," the agent continued, "There are three credit cards, passports, a laptop, 5 kg cloth and 200 grams of MDMA – all under your name."

Rima's heart raced as confusion and panic set in. How could such a thing happen? She had never sent any such parcel, let alone to Taipei.

But before she could gather her thoughts, the agent began to divulge more alarming details, including Rima's Aadhaar number and address, leaving her dumbfounded.

Perplexed and anxious, Rima tried to reason with the agent, insisting that there must be some mistake. But the plot thickened when the agent suggested reporting the incident to the Mumbai police, citing the severity of the situation.

The agent then proceeded to connect her to the police.

“Sir, I got a call from FedX saying some illegal parcel was found in my name…," Rima began to narrate her ordeal to the alleged police officer on the other end of the line, connected via the courier service.

The officer, adopting a tone of urgency, asked for Rima’s Aadhaar number and asked her to wait patiently while he connected on another call. Five minutes later, he warned Rima of the severity of the alleged identity theft and money laundering.

"Your Aadhaar card has been linked to multiple bank accounts, some of which are under investigation for suspicious activity," the officer intoned gravely.

The scammers, skilled in the art of psychological manipulation, painted a grim picture of criminal activity using the reference of Mohammed Nawab Mohammed Islam Malik or Nawab Malik, the NCP leader who was arrested last year in a money laundering case.

“We had arrested the politician last year, but his 600 agents continue to operate illegal accounts for money laundering and cryptocurrency. He was caught in drug violations as well. Three illegal bank accounts are linked to your ID in this case,” he said.

Panic-stricken and desperate for guidance, Rima found herself at the mercy of the supposed law enforcement officials who promised to help Rima get out of this scam.

"You are now a part of an investigation," the officer declared solemnly, further solidifying Rima's belief in the authenticity of the situation.

Rima was instructed to download Skpye and connect to what she believed to be a legitimate police investigation. The authenticity of the setup, complete with official logos and background chatter, lulled her into a false sense of security.

Rima continued to follow the scammer’s instructions blindly.

The purported investigation unfolded like a carefully scripted drama, complete with fake documents, which were shared in the Skype message box, and fabricated narratives.

Snapshots of the Skype ID, fake letters taken by the victim during the scam call.

This included a fake "confidentiality agreement" undersigned by Dr Balsingh Rajput IPS (DCP Cyber Crime), and a fake letter from the RBI with names of Nitin Pal Singh IPS (Crime branch commissioner), George Mathew IPS (Financial department head), and RBI governor Shaktikanta Das, who were mentioned as part of the investigation.

“You will have to read out the confidentiality agreement on the screen. Are you ready Rima? We will record. Please find a quiet space and do not connect with anyone until this is completed. It is for your safety. Otherwise, we will not be able to relieve you,” the officer asked, his voice heavy with authority.

All this while, the camera on the other side remained off, a red flag ignored by Rima.

As the interrogation intensified, Rima found herself bombarded with questions about her bank accounts, daily financial transactions, and investments.

"How many bank accounts do you have? Do you use payments apps like Google Pay or Paytm?" the scammers probed relentlessly, exploiting Rima's growing sense of dread and lack of knowledge about such matters.

“These agents have a pattern of doing transactions. They usually use 98989, 48483, 97989, 32323 etc. They never transact in zero denomination,” the scammer posing as DSP explained, his words dripping with authority.

To clear her name, Rima was instructed to transfer Rs 98,989 to the financial department’s system ID, a government account, under the guise of verification. Blinded by fear and confusion, she complied.

According to the data released by the Ministry of Finance, more than 95,000 cases of UPI scams were recorded by the end of March 2023.

It could have been worse but thanks to the the timely intervention of her brother, who had heard of this modus operandi before, the truth was finally unveiled, sparing Rima from further financial ruin.

Rima immediately blocked her bank account and filed an complaint with National Cybercrime Reporting Portal (NCRP) within the next three hours. The complaint was forwarded to the cyber police station (west) in Palam Vihar Gurugram. Moneycontrol has seen the copy of the complaint.

In a swift action, the bank and cyber cell together managed to freeze the transfer.

Currently, Rima is carrying out formalities with the bank to get the money back into her account.

In response to moneycontrol queries, a FedEx team informed that they have been carrying an advisory on their website to inform the customers about such scams carried out in their name.

"FedEx does not request personal information through unsolicited phone calls, mail, or email for goods being shipped or held, unless requested or initiated by customers. If any individual receives any suspicious phone calls or messages, they are advised not to provide their personal information. Instead, they should immediately contact the local law enforcement authorities or report to the cybercrime department," the advisory reads.

Not an isolated case, rise of UPI-related frauds

Rima's story serves as a cautionary tale, highlighting the importance of vigilance and scepticism in an age where deception lurks behind every screen.

Per the latest available data, UPI-related frauds continue to pose a significant challenge in India's digital payment landscape.

According to the data released by the Ministry of Finance, more than 95,000 cases of UPI scams were recorded by the end of March 2023.

A report by the IIT Kanpur’s Future Crime Research Foundation in September last year said that between January 2020 and March 2023, there were approximately 23,000 cybercrimes every day. Out of this, nearly 77 percent were financial scams and crimes, and a whopping 47 percent involved UPI scams.

While the strategies employed by scammers in UPI frauds can vary, they typically exploit users' emotional vulnerability and limited technological awareness at their core. These fraudsters employ a variety of techniques, ranging from enticing users with false promises of lottery wins to issuing warnings about impending bank account suspensions.

To lend credibility to their schemes, they often utilise stolen identity data, creating an illusion of legitimacy to deceive unsuspecting victims. Through intimidation tactics and coercion, scammers instil fear by threatening severe consequences, such as freezing bank accounts or even physical visits to the victim's residence.

Two weeks ago, there was news of one man from Gurgaon losing 56 Lakhs to a scammer and another, 1.3 Crores. I got the same call today.
A customer care exec from FedEx will call you and say that your Aadhar card is being misused to send packages with drugs to Thailand. Lavanya Mohan (@lavsmohan) March 5, 2024

@MumbaiPolice @MahaCyber1 @Cyberdost Got a call from this number +91 99509 63540 as a Fedex agent who told that my package was in customs held up for illegal items. It was part of a scam Please take action against these type of criminals. Nishanth (@nishanthlfs) February 15, 2024

To gain trust, users are frequently asked to make small payments for supposed "verification," with scammers promptly reimbursing these amounts to establish a facade of legitimacy.

Once trust is established, scammers then proceed to solicit larger UPI payments from users or manipulate them into entering security PINs on deceptive QR codes, resulting in significant financial losses for the victims.

Unfortunately, a lot of cases go unreported as many fear further consequences or societal embarrassment.

Tightening noose

Despite a comprehensive framework set up by the RBI for players in the UPI transactions system, besides fraud monitoring system, UPI-related frauds have not been able to scale down.

Till the time something concrete comes out, the ball would lie in the consumer's court.

Having said that, the government has been working on some projects to tackle the issue.

Recently, Ashwini Vaishnaw, the Union Minister for Electronics and IT said that the government is working with the RBI, banks and the UPI system to devise a mechanism so that fraudsters can't use a victim's money.

"We are working on a mechanism such that will prevent fraudsters from using the money even if they fraudulently take the money," he said, mentioning about strengthening the 'Sanchar Saathi' portal with new tools to safeguard citizens.

List of initiatives undertaken by the government to tackle digital payments frauds

The portal, introduced in May last year, allows individuals to block all the personal data stored on a lost or stolen smartphone, including net banking details, UPI IDs, and social media accounts like WhatsApp.

More than 1 crore fraudulent numbers have been blocked via the portal in the last 9 months and over 2,500 numbers are being blocked daily, the minister informed. On February 9, a meeting chaired by Vivek Joshi, Secretary, Department of Financial Services (DFS), Ministry of Finance also took stock of the action taken by banks and financial institutions to tackle this challenge.

Two new platforms 'Chakshu’ and 'DIP' were launched on March 4 as a part of the portal to allow for real-time intelligence-sharing among several stakeholders.

On Feb 9, Vivek Joshi, Secretary, Department of Financial Services (DFS), held a meeting to discuss the increasing incidents of recent online financial frauds.

An Indian Express report in November last year mentioned that the government is also planning to introduce a four-hour window for first time digital transaction above Rs 2,000 between two persons.

While the process is expected to add some friction to digital payments, officials quoted in the report are of the view that it is necessary to mitigate cybersecurity concerns.