Biggest digital arrest scam: How I lost ₹23 crores to cyber criminals
Perhaps the costliest cyber-arrest scam India has seen, Naresh Malhotra shares his ordeal to warn others of cyber dangers. But could banks be held responsible?
On the fated day of August 1, ex-banker Naresh Malhotra, convalescing after knee surgery, received a call on his landline phone. The 78-year-old had no idea that the shrill ring of the phone was the death knell for his lifesavings. The voice on the other end was about to drag him into an excruciating nightmare.
“The voice on the other end told me that my Aadhaar had been compromised. All my phone connections were about to be disabled. A landline had already been taken in my name in Mumbai. My Aadhaar was used for opening some fraudulent bank accounts which were involved in ₹13000 money laundering racket and this money was used for purchasing arms for Pulwama attack,” shares Malhotra.
Signed, stamped, swindled: Forged papers seal the scam
“A person impersonating Mumbai Police came online and instructed me to switch to WhatsApp call for 'further action'. They sent me an ‘arrest order from Mumbai Police’, which looked very convincing,” he says.
What followed was a psychological siege. The scamsters, posing as various agencies such as Mumbai Police, Enforcement Directorate (ED) and Courts drew out every intimate detail of Malhotra’s life. The talked him into giving information about his two daughters, his assets, bank accounts, demat accounts, lockers.
"They sent me court orders signed by judges accusing me of bankrolling arms for the Pulwama attack and crimes affecting national security. They later also produced a bail order that looked very legit, complete with stamps of authorities and on official letter head, to prevent this arrest on condition that I submit all my assets until an inquiry cleared me of these charges,” he shares.
“They asked me to submit all my asset to Reserve Bank of India (RBI). They also gave me a ‘certificate of Reserve Bank of India’ declaring that once the investigation was over, I would get all my assets back,” he says.
So, bit by bit, over a month, Malhotra sold his assets and shares to transfer ₹22.92 crores to the accounts he believed were of RBI.
But why did no one warn him that he was falling prey to cyber fraud? Because he didn’t share his ordeal with anyone, neither his daughters nor even with the house helps who were with him in the same house. Why?
“I was made to sign a confidentiality bond on WhatsApp everyday. They put me under gag order. They threatened me that I was under 24/7 surveillance, that there were people stationed outside my house and that I was being followed by cops in civil dress, so if I discussed anything with anyone, my two daughters, my sons-in-law and my four grandchildren will be eliminated," he says, adding, “Everyday for 45 days, I was required to report to them every two hours between 8:00am to 8:00pm. I was reporting to CBI and ED officials (impersonated).”
From August 4 through September 4, Malhotra transferred INR 22.92 crore to 16 bank accounts. He visited the three banks where he had accounts about 21 times and not even once did any bank employees suspect Malhotra was moving such large amount of money, selling shares under duress.
How did it end?
How did it all end? A frustrated Malhotra decided that he had had enough of these ‘agencies’ and he decided to surrender to Supreme Court of India himself.
“On 9 September, they told me the Mumbai police had been 'compromised' as the investigating officer had been caught relaying sensitive information and my data to the terrorists in Kashmir. And the Bombay police commissioner was in hospital. They asked me to check the YouTube video of it. They warned me against getting in touch with the Mumbai Police. They asked me to block the two numbers they had been communicating me with until then. They asked me to also delete the messages. I didn't know how to block the numbers. They guided me to do so. But I refused to delete any messages. Then they asked me to wait for their next call,” recalls the retired banker.
“On 16 September, they told me that ED had cleared my ₹22.92 crore transaction. The Reserve Bank of India had approved that the assets be transferred back to me. Then I received another document from “the Chief Justice of India from the Supreme Court” asking to deposit ₹5 crore so that the process could start," he says.
"I told them I’d need to arrange it by selling my shares. By Wednesday, a stamped Supreme Court directive arrived, instructing me to deposit the funds into a specific account, followed almost immediately by a Home Ministry order to transfer it into another account and then RBI’s order asking me to transfer it in some other account. They pressed me to transfer the money to a private company in Kolkata,” he says.
“I told them I was not going to transfer any money to any private company. A lady claiming to be the head of their CBI unit threatened that they were sending police to take me in custody. I said ok, I will give this money to the general manager of Reserve Bank of India in person or surrender at Supreme Court myself until my name is cleared. They asked me to wait for their next call," he says.
"I was ready to surrender to the police or to the Supreme Court of India. But their call didn’t come. That’s when it hit me. I had been scammed!”
Costliest digital-arrest scam yet?
The case stands out as perhaps the costliest cyber-arrest scam India has ever seen. The Intelligence Fusion and Strategic Operations (IFSO) of Delhi Police, is working on the case. A senior officer of the unit says, "The money was fanned out through 4,236 transactions across seven layers. And less than 3 crores has been frozen. We lost the golden hour. People should report such cases within an hour for chances of better recovery."
I am not disturbed: Naresh Malhotra
During the ordeal, it was as if Malhotra was under some hypnotic spell of the cyber gang. “I couldn’t think clearly or use my critical thinking as if they had put my mind under siege,” he says.
However, now, he is surprisingly calm. “I am purposely normal. I am taking it as a non-event. The loss is not disturbing me. I am not perturbed,” says Malhotra, who is avoiding taking any unknown calls and is surrounded by family, friends and media.
Are banks liable?
The question remains if banks should also be held liable? In this case, 2.92 crore transferred to 16 bank accounts through 21 RTGS from three accounts held by Malhotra. It was fanned out through 4,236 transactions across seven layers. If such big amount of money is moving rapidly through mule accounts, what is the responsibility of the bank to check such cyber frauds?
Note to readers:
There is no such thing as digital arrest. Police doesn't arrest anyone on WhatsApp. Arrests are always done in person after due inquiry.
Report any such cyber fraud incidents immediately, it improves the chances of recovery of your money.
You can file a complaint at 1930, the National Cyber Crime Helpline in India. Or visit the National Cyber Crime Reporting Portal cybercrime.gov.in to complete your complaint.
Have details such as your bank account detail, transaction details (UTR number), exact transaction amount and a brief explanation of the fraud handy before you dial 1930 or log on to cybercrime.gov.in
