21,000 OTPs sold, 10,000 devices infected: Ahmedabad police bust 4-nation ‘Boss Scam’

The accused allegedly supplied these mobile numbers to fraudsters, who used them to create WhatsApp accounts. The OTPs required for activation were received on the dummy SIM cards allegedly controlled by Piyada and then shared with members of the network.

The statement further said, “Thereafter, the details of the mobile numbers generated on such SIM cards were provided to persons involved in cyberfraud criminal activities. When the cyber criminals carried out the process of activating WhatsApp accounts on these mobile numbers, the required OTP was received by the accused on the dummy SIM cards in his possession and was provided to the concerned person, on the basis of which the WhatsApp account was activated.”

In this manner, the accused provided dummy SIM cards, mobile numbers and WhatsApp accounts to cyber criminals and played an important role in establishing the digital communication system required for cyber fraud criminal activities, said the police.

Sold 21,000 OTPs

The police added that Piyada also used dummy SIM cards for e-commerce applications such as Amazon, Flipkart, etc, and online gaming applications and sold OTPs.

“So far, over the last five years, the accused Piyada sold approximately 21,000 OTPs for e-commerce and online gaming at an average price of Rs 100, thereby obtaining over Rs 21,00,000, and sold approximately 900 OTPs for activating WhatsApp accounts at an average price of Rs 250, thereby obtaining over Rs 2,25,000 in commissions,” the police said.

Injammul, according to the police, is also a graduate and coordinated with persons involved in cyberfraud activities. The accused assisted in the use of mobile numbers, dummy SIM cards and WhatsApp-based communication systems used for cyber fraud.

During the investigation, based on the information of approximately 4,500 SIM cards found in the mobile devices, the Cyber Crime Branch analyzed 251 NCRP complaints, registered by applicants across 26 states. These included 194 online financial frauds, 3 Boss Scams, 29 online and social media-related crimes, 5 sexually explicit acts, 4 crimes related to Hacking/Damage to computer systems, seven cases related to Sexually Obscene material, seven cases of Sexually Abusive Content, 1 case of Child Sexual Exploitative and Abuse Material (CSEAM), and eight other cyber crimes.

Ahmedabad City Police Commissioner Anupam Singh Gahlaut on Tuesday said that they were investigating the role of foreign nationals in the larger scheme of things. While the two arrested accused were part of the Indian side of the scam, the entire infrastructure of the larger scam is said to be based out of several other countries.

According to technical analysis, the police said, the malware is suspected to have been developed by cyber criminals associated with China and was being used to target Indian citizens through a call centre located in Islamabad. “The bank accounts involved in the cyber fraud were found to have been accessed through a China-based VPN service. Based on these findings, it has preliminarily emerged that the accused used a multi-country cyber infrastructure associated with China, India, Pakistan and Hong Kong to conceal their identities and actual locations. Through this coordinated action, more than 10,000 infected devices were secured, and Indian citizens were rescued from potential losses of crores of rupees due to cyber frauds such as the Boss scam,” the police said.

What is Boss scam

In this type of fraud, cyber criminals impersonate an officer of the Reserve Bank of India or any government institution and send a ZIP File to the CEO/Director/other employee of a company through WhatsApp or email. The ZIP file contains malicious files such as “.exe” (Executable File) and “.dll” (System Library File). When such a file is executed on a computer/laptop through WhatsApp Web, the criminals gain control of the WhatsApp Web Session, said the police.

“Thereafter, the criminals save their own mobile number in the name of the CEO/Director and use their profile photograph to create an identity as the CEO/Director. By stating that there is an immediate need for a financial transaction, instructions are given through WhatsApp to the employees of the company’s Accounts/Finance Department to transfer the money. By deleting the original number of the Boss/CEO and saving the criminal’s own number in the name of the Boss, it becomes difficult for the employees to verify the authenticity of the message, and they transfer the money without confirmation,” said the statement.

Dummy SIM cards were allegedly used to provide the mobile numbers and WhatsApp accounts required for the wider cyber fraud operation. When cybercriminals activated WhatsApp accounts using these numbers, the required OTPs were received on the dummy SIM cards and then shared with the persons concerned, enabling the accounts to be activated. Police said the two accused provided this infrastructure to the gang.