The Enforcement Directorate (ED) has arrested four people for their alleged involvement in a cyber scam where people are duped through fraudulent applications on the pretext of making investments in the stock market.
The accused identified as Shashi Kumar M (25), Sachin M (26), Kiran SK (25), and Charan Raj C (26) were arrested in Bengaluru, Karnataka. He had incorporated a company and opened a bank account, where the seized money was laundered. The agency obtained a seven-day remand for interrogation.
The ED has now conducted 13 searches at multiple locations and traced proceeds of crime worth over ₹25 crore as part of its money laundering probe, which is based on several First Information Reports (FIRs) registered with the police in other states.
In a case registered by the Faridabad police in Haryana, the victim was cheated of ₹ 7.59 crore. First, he had clicked on a stock market investment link while browsing Facebook, and then added it to a WhatsApp group named “ICICI IR Team (57)”. He observed the group for several months, and noted that many members, who in fact planted scamsters, were reporting high returns on investment.
Encouraged by the prospect of making good money, he agreed to join another group and was assigned by the administrator to install the app “IC ORGAN MAX”, which paid him ₹61 lakh. He was then told to install another app called “Techstars.shop”, and was scammed again.
In two other cases, a Noida-based businessman lost ₹9.09 crore and a doctor in Bhatinda Punjab was cheated of ₹5.93 crore.
Elaborating on the modus operandi, senior officials said that the syndicate initially lured potential victims through social media platforms such as Facebook, Instagram, WhatsApp, and Telegram, with promises of high investment returns, Initial Public Offering allocations through special quotas, etc. added to the WhatsApp / Telegram group, which already has fake members. These groups have names similar to well-known applications or financial institutions.
Once victims are convinced of the group’s authenticity and have witnessed the “success” stories of other members, they are encouraged to install malicious applications using links provided by masterminds. The application will also have the names of various stocks, futures, options, forex, etc. similar to the platforms of well-known companies.
Believing that they were investing in the stock market, the victims ended up transferring the funds to shell company bank accounts managed by the syndicate. “To build more confidence, the victim may be shown getting good results, but in fact only the numbers are shown in this fake application. When the victim invests more funds, gradually they realize that they cannot withdraw the funds. When they try to withdraw money, the scammer asks the victim to pay statutory taxes, brokerage fees, etc., which is nothing but a way to take more money…,” said the official.
“Once the scammers believe they have made as much money as possible, they cut off all communication and disappear,” the official said.
To evade detection, the criminals obtained hundreds of SIM cards illegally through various individuals in India through Telegram groups. They are sent overseas after being activated. “These SIMs are linked with bank accounts of some shell companies or used to create and open WhatsApp accounts for the purpose of deceiving the victims,” ​​the official said.
“The scammer put together hundreds of special shell companies to receive and siphon off the proceeds of crime… when filing Form INC-20A (required to be submitted on the portal of the Ministry of Corporate Affairs to start business by a company), he submitted a false bank statement as proof of subscription of shares by the holder stock,” the official said.
Through a complex web of “mule” bank accounts, which are re-rented from people through chat app channels, cybercriminals divert funds received from victims and convert the same into cryptocurrency to be managed from abroad. In mule accounts, small transaction amounts (less than ₹5 lakh) are used to avoid triggering any suspicious activity alerts.
The official added that the ‘Golden Triangle’ – located at the intersection of Thailand, Laos, and Myanmar – which has long been known for illegal activities such as drug/human trafficking, is now also a hotbed of cyber fraud operations. In the past, many Indian nationals were lured on the pretext of job offers, sold to the region and forced to work in fake call centers to commit cyber fraud.
