'Digital arrest' scams are big in India and may be spreading

A woman in the Indian city of Delhi last week found herself under "digital arrest" – a form of scam in which victims make payments to criminals posing as law enforcement officers.

Delhi Police explained that the woman was called by people posing as officers from the Central Bureau of Investigation (CBI) – India’s equivalent of the FBI.

The callers claimed that the woman's husband had been charged with crimes. If she paid to secure his release, the charges would be dropped and the story would not reach the media.

The scammer coerced the victim into staying on the phone for six hours, claiming the long call was a "digital arrest." The woman made a ₹200,000 ($2,384) payment and was preparing to make another when her husband walked through the door – at which point she realized she had been duped.

On Saturday, police arrested three men over the incident.

Local media reported that the suspects had extorted others in a similar manner – posing as CBI officers and threatening to arrest family members of victims.

One of the suspects had worked previously for Airtel Payments Bank and was well-versed in the banking system. Another was a retailer of SIM cards and had access to obtaining the kit through fake IDs. Yet another was responsible for providing mule bank accounts using fake IDs.

The police recovered 15 mobile phones, 15 ATM cards of different banks, and 14 SIM cards from the alleged fraudsters.

• Would you buy Pegasus spyware from this scammer?
• 750 million Indian mobile subscribers' info for sale on dark web
• Deepfake CFO tricks Hong Kong biz out of $25 million
• That call center tech scammer could be a human trafficking victim

While the technique of holding victims in virtual custody is novel, digital arrest fraud is similar to many other scams in its use of fear to extract payments from victims.

"With a mix of data from social media and phone calls, scammers make people follow their commands, at times for days, and empty out their bank accounts," Mudit Bansal, threat intelligence researcher at Indian infosec firm CloudSEK, told The Register. "They make users stay put in their places while pulling information from their social media and building upon their fear."

He added that the fraudsters will even use information from public data leaks to trick victims into thinking that they know things only a law enforcement officer would know.

They also use information a panicked victim will reveal during the call to further trick their target – though according to Bansal, "most of this is just general guesses." The victim may at the time also hear fake crying sounds in the background that they are made to believe is their loved one.

Bansal warned some of the more sophisticated scammers will create fake payment websites that resemble law enforcement agencies' online presences to further convince the victim to hand over their money.

According to the researcher, common pretexts for a digital arrest include authorities intercepting contraband in a package, or a spouse or child involved in peddling drugs, or cases of sexual violence.

Most examples of digital arrest scams appear to come from India. In fact, all the cases cited in an explainer from Geneva-based nonprofit CyberPeace Foundation come from the subcontinent – as are most reports of the crime found online.

However, Bansal insists the scam is a global phenomenon.

"Still, the reports from other parts of the world are much smaller than what the Indian subcontinent is seeing," the CloudSEK researcher told The Register.

"Quick digitalization and gullibility are making the Indian subcontinent's audience very susceptible to cyber scams. Adding to the mix the power of AI in video and audio manipulation, we can also predict a steep rise in such scams," he concluded. ®