On January 2, as the echoes of New Year revelry subsided, a 78-year-old retired government employee residing in the upper-middle class neighbourhood of Bowenpally in Secunderabad saw his serene life turn upside down after he received an unexpected call at 9.05 a.m. The call lasted until 2.30 p.m., and by then, he had lost nearly ₹1 crore from his life savings.
Online scammers, posing as agents of international parcel services company, Mumbai crime branch inspectors, and CBI officers, had persuaded him to prematurely encash his fixed deposit and transfer ₹98.79 lakh to a ‘special CBI account’, which was later found to have been in Baramulla, Kashmir.
“I was shown the transaction details this account had on January 2. It was five pages long, with about 25 names per page, on that day alone. While most transactions were between ₹50,000 and ₹80,000, there were two transactions of ₹1.20 lakh and ₹1.50 lakh from Andhra Pradesh,” recalls Ramesh Rao (name changed upon request), as his wife stares blankly at him.
Parcel scam, where intruders falsely use names of global logistics and delivery companies, preys on the victim’s fears. The perpetrators typically begin a call by mentioning a ‘suspicious parcel’ containing items like drugs or passports associated with the victim’s phone number and Aadhaar card. To have their name cleared, the person is asked to provide statements via video calls and transfer funds into specified bank accounts under the guise of ‘verifying its legitimacy’. The entire process is carried out with such precision that people often end up parting with their money before realising they have been conned.
With the forged FIR copies in his name and WhatsApp photos of CBI-Mumbai, Rao had believed everything that was told to him. “When I asked the caller what to put under the description for the transaction, I was told to mention ‘real estate purchase’. I asked them why I couldn’t mention CBI, but they said it was so scammers are not alerted,” he shares.
He made the transaction but got suspicious the very next minute. He asked the caller to stay on the phone, stating that he needed to use the washroom. “I kept my phone aside, took my wife’s phone and called the manager of my bank where I have had an account for 35 years. When I shared what had happened, he immediately halted the RTGS transaction for ₹98.79 lakh. But within 20 minutes, I had lost ₹16 lakh. The rest of the money is frozen, and I am working on the legalities,” he explains.
According to officials at the Telangana State Cyber Security Bureau (TSCSB), located on the third floor of Tower-B of the swanky Integrated Command Control Centre (ICCC) in Hyderabad’s Banjara Hills, 6,520 cybercrime cases were registered in January 2024 alone. These included 2,420 cases of identity theft, 1,938 instances of business and investment fraud, 913 cases of impersonation (or cheating), 691 advertisement portal frauds, and 558 loan frauds. The financial toll amounts to ₹88 crore. Between May and December last year, the TSCSB received 89,783 complaints, leading to the registration of 14,271 FIRs. To put matters into perspective, Telangana recorded 1,099 cybercrime cases in 2018, a number that surged to 16,339 in 2023, according to the Telangana annual round-up of crime.
Resembling a corporate office, the TSCSB operates round-the-clock in three shifts, with 32 tech-savvy constables clad in maroon polo neck T-shirts bearing the bureau’s logo. While one section addresses distress calls and registers complaints, the data desk simultaneously collates data, mapping and identifies trends.
Despite joint efforts of the department and the police to raise awareness, TSCSB Director Shikha Goel says not all incidents are reported. This underscores the sheer number of unreported cases, including those involving sextortion. “So far, we have been able to freeze amounts to the tune of ₹133 crore since its inception in June 2022. Over ₹11 crore was refunded to victims in 2023,” she adds.
The landscape of cybercrime has undergone a significant transformation, progressing from OTP and social media fraud to the realm of Artificial Intelligence (AI) and a more complex virtual network of criminals. Cases of deep fakes, exemplified by a recent incident where the perpetrators extorted ₹74,000 from a 76-year-old man through a morphed video featuring the face and voice of a retired officer of Uttar Pradesh police, pose A threat to unsuspecting people.
Another looming problem for the youth is the advancement and expansion of the virtual world. As if bullies and online predators on social media platforms weren’t enough, the Metaverse has emerged as another unsafe space. As highlighted in a report titled ‘Metaverse: Another Cesspool of Toxic Content’, in May 2022, a 21-year-old woman faced virtual sexual assault and harassment within an hour of entering the three-dimensional virtual environs. The woman, employed as a researcher for a non-profit advocacy organisation, alleged that her ‘avatar’ was subjected to assault while other players watched.
“Where is the law to report such cases? And even if there are laws, what is the proof or evidence of where the crime happened?” asks Gaurav Sahay, Practice Head (Technology & General Corporate), Fox Mandal & Associates, a law firm with offices across the globe. To deal with these cases, he feels laws need to take shape, and judges must be ready to interpret existing laws for current circumstances.
Tracing and tackling cyber crime
In 2022, Telangana topped the cybercrime charts in the country for the second consecutive year with 15,297 cases, a jump from 10,303 cases recorded in 2021, as per the latest report by the National Crime Records Bureau (NCRB). In 2020, this number stood at 5,024.
Stating that there are no geographical boundaries in cybercrime, Goel says, “The offenders can be in any part of the world, accounts can be anywhere, and withdrawal of money can be made in any part of the world, so catching criminals becomes difficult.”
Besides, offenders use unaudited payment gateways, for which there are no means of verification, leading to further complications. The movement of money is so fast that even a slight delay in reporting it to the police makes it challenging to trace it. The level of anonymity is high, and crime is highly decentralised, making it excruciatingly difficult to track, says Sahay. When combined with the legal framework that is traditionally tied to jurisdictional limitations, it becomes even harder to track criminals and bring them to book. “When it comes to cybercrime, it is difficult to even establish the ‘intention’, which is so prominent in our lawbook,” he adds.
Experts are divided in their opinions on compliance. Sahay says companies pay heavily for due diligence and compliance. “They pay heavy penalties which may range between ₹50-250 crore in case of an event of data breach,” he says, calling for in-depth, continuous regulatory sandboxing, the practice of isolating a program from other programs to ensure that if errors or security issues arise, they do not spread to other areas on the computer.
On the other hand, Supratim Chakraborty of the law firm Khaitan & Co. calls for harmonisation, where strict regulation to counter cybercrime goes hand-in-hand with the ease of doing business and innovation in the country. He points out that compliance is expensive, and not always a priority for businesses.
Industry experts are betting big on the Digital India Act, 2023, which proposes specialised and dedicated adjudicatory mechanisms for online civil and criminal offences and the Digital Personal Data Protection Act, 2023. “This will ensure we are fairly covered from the cybercrimes of the day,” says Mitish Chitnavis, chief technology officer at cybersecurity company iValue.
The intervention of advanced technologies like AI and ChatGPT is only making things worse, with deep fake cases taking off and offenders using those to hack into victims’ accounts. “Moreover, suspects are using morphed images and videos to blackmail victims in loan and investment fraud cases,” TSCSB inspector Shravan Kumar says.
The TSCSB has introduced an in-house AI-driven crime monitoring system or Cyber OS which picks up all the requisite information from the FIR directly and disseminates it to relevant stakeholder banks and police stations to promptly detect and investigate cybercrime cases in Telangana.
This technology is currently operational only in Cyberabad — one of the three police commissionerates of Hyderabad — while the department is working to expand it to all parts of the State, says Goel.
The department has also come up with an AI-based tool called ‘Cy-CAPs’, short for Cyber Crime Analysis and Profiling System. This maps crimes to criminal and criminal networks across the country. So far, 66,726 accused from various States have been identified across the country, including a case where 72 offenders were linked to over 9,000 cases in India.
The State also became the first mover in setting up a fully functional 1930 helpline centre for reporting and disseminating essential information to track cybercrimes. The centre, which receives about 2,000 calls a day, has logged over 90,000 calls since its inception in June 2021. On a daily average, the helpline centre records a loss of around ₹3 crore, say officials.
The way forward
Experts unanimously advocate the necessity of having advanced technologies and frequently upgraded comprehensive and all-encompassing policies in place to check cybercrime in the country. “As augmented reality and virtual reality gain traction, and the metaverse captures attention, it will likely give rise to new forms of cybercrime,” Praveen Sasidharan, Partner and Risk Advisory at Deloitte India says. “Public and private partnership to dedicatedly focus on creating counter technologies is the way to go,” he points out, highlighting that the technology refresh cycle has been reduced from 10 years to three years.
Akshat Gairola, partner, Cybersecurity, BDO India, emphasises that technology is a complement to, not a replacement for, skilled cybersecurity professionals. “The government should also enforce a policy that mandates technology companies to provide solutions to retail customers as very few extend their solutions to them, making them more vulnerable to such threats and further prevent them from being used as a pivot to launch attacks on larger companies,” Gairola suggests.
Stakeholders across the board also agree that education and awareness about evolving tactics, policies and initiatives in place are fundamental to dealing with the crisis effectively. “More than 60% of such cases can be avoided through awareness,” Goel says.
