Phishing mails are so passe. Cyber fraud in India has evolved rapidly, moving from basic email scams to highly organised psychological operations that are draining life savings in a matter of hours. Today’s scams directly target ordinary citizens, especially the elderly and those with limited digital experience. The nature, scale, and impact of cybercrime have undergone significant changes over the last two decades.
Cyber Security Analyst Jiten Jain, discusses various types of cyber fraud that have increased in scale and audacity. For this article, we focus on these three:
- OTP and UPI-Based Fraud
- The Rise of “Rent-a-Account” and “Rent-a-SIM” Fraud
- Digital Arrest Scams
- The Explosion of OTP and UPI-Based Frauds
With UPI platforms, QR code payments, contactless credit card transactions, and mobile wallets, India moved rapidly toward a cashless ecosystem. While this created convenience, it also created massive vulnerabilities.
Fraudsters now:
- Buy stolen credit card data on the dark web.
- Use OTP-based verification to complete transactions.
- Purchase gift vouchers and digital goods to convert stolen money into usable value.
Unlike Western countries, where cards can often be used without OTP, India’s OTP system offers protection—but it also creates new psychological attack routes.
Cyber fraudsters know that their prey won’t part with their OTP all too easy. So they create situations where they play on your fear or trick you into buying into their well-thought through con. Consider this – You get a call on your WhatsApp from an unknown number. You answer the call. The person at the other end of the line, gives you the reference of a friend of yours and says he was trying to send him some money but ended up sending it to you instead. You check your UPI and find there is some money that has come in. Then the scammer asks you to send you a screenshot so he can tell the person he’s sent money to the wrong payee. So far so good? Nothing so far sounds like someone is trying to pull a fast one on you. After all, you got some money in your bank account and haven’t lost a penny.
Then the scammer tries to tell you he’s made the same mistake and another small amount has come into your account again. He again asks for a screenshot. And it’s possibly in this one seemingly innocuous screen grab that you may unwittingly end up sending a screenshot of an OTP that has also got generated at the scammer’s behest – one that he hasn’t disclosed to you. Another option is he uses the same friend’s reference to reassure you that all is well and asks you to merge the WhatsApp call you are getting. Even though your friend’s number doesn’t show up, in that one unthinking second, if you merge the calls, you’ve actually allowed the scammer to listen to the OTP via an IVR call from WhatsApp that allows you to transfer your WhatsApp onto another device. Once this happens, the scammer has got what he wants and you lose access to your own WhatsApp. Your WhatsApp has been ‘hacked’ and the scammer may now use your actual number to send fraudulent messages to your friends on WhatsApp to try and hoodwink them into forking out money.
2. The Rise of “Rent-a-Account” and “Rent-a-SIM” Fraud
A new and dangerous method of cyber fraud now involves using rented bank accounts and SIM cards of poor and vulnerable people to move and withdraw stolen money. Fraudsters lure people who are vulnerable, say rickshaw drivers or daily wage workers, with offers of easy monthly income of Rs. 20,000 or more. In return, they ask them to hand over their debit cards and allow UPI access under the pretext of part-time jobs or online clicking work. Once control is gained, by linking Aadhaar card and other details, these accounts are used to route proceeds from OTP, UPI or credit card frauds, after which the money is withdrawn in cash, and the real scammers vanish. In nearly 99% of cases, police fail to catch the masterminds, and the unsuspecting account holder becomes the target of the police. Earlier, UPI limits prevented such frauds from involving larger amounts, typically ranging from Rs 10,000 to Rs 50,000. However, this rental-account system has now become a major channel for laundering stolen digital money.
3. Digital Arrest Scams: The Most Dangerous New Threat
The most terrifying and financially devastating scam today is ‘digital arrest’ fraud.
This is not a technical hack. It is a pure psychological takeover.
How does it work? Victims receive calls claiming that their Aadhaar is linked to drug trafficking, or multiple SIM cards are being used in terror funding. A courier with drugs has been intercepted and the victim is told that s/he is the intended addressee. Or details of someone close to the victim are given out by the scammer, who often calls the victim, dressed as a policeman or a law enforcement officer, and says that their relative is under arrest in a drug case and the case can be ‘settled’ without the ‘arrested person’ doing any jail time.
Fake officers posing as police, CBI, ED, or customs officials appear on video calls wearing uniforms. Victims are shown fake Supreme Court orders. They are told they are under “digital arrest.”
The Trap? Victims are ordered to: Stay on camera continuously, not inform family members, and follow all instructions due to a “national security” issue.
They are told: Their bank accounts will be seized, but first, they must “transfer funds for verification.”
Since the victim performs the transaction themselves, using their own phone, with their own OTP, on their own bank app. All security systems get bypassed. Banks usually have limits on daily transfers and new payees cannot be transferred money above a certain limit in the first 24 hours. That’s why you often hear that a person was kept under ‘digital arrest’ for longer than 24 hours. Once the new payee is added and the limit of 24 hours is crossed, money is transferred in lakhs every day. This is why losses now run into crores, not thousands.
Even highly-educated and senior citizens are falling prey because the scam weaponises fear—especially fear for children and grandchildren who are staying abroad.