ED arrests 4 in Bengaluru for cheating people of Rs 25 crore in cyber investment scams

A special court in Bengaluru has remanded the accused to ED custody for a week each.

According to the ED, the agency conducted 13 searches at various premises under Section 17 of the Prevention of Money Laundering Act (PMLA), 2002, which led to the seizure of incriminating material, including mobile phones and other digital devices.

The ED said it took up the case based on First Information Reports (FIRs) registered at Faridabad, Noida and Bathinda. In the Faridabad case, a 57-year-old woman had been cheated of Rs 7.59 crore; in Noida, a businessman lost Rs 9.09 crore; and in Bathinda, a doctor lost Rs 5.93 crore, the agency said.

The modus operandi

The ED said that the first step of the scam involved luring the victims via various social media platforms, including Facebook, Instagram, WhatsApp, and Telegram, by giving false promises of high returns on investments, allotment of IPOs through special quota etc.

Once the victims showed interest, the scamsters would add their numbers to fake WhatsApp or Telegram groups that also had ‘fake members’ who shared fabricated success stories. These WhatsApp groups would have names similar to well-known apps or financial institutions like ICICI Securities, GFSL Securities, SMG Global Securities, Blackrock Capital, JP Morgan etc to create an impression that these groups were genuine, the agency said.

Once the victims were convinced, the scamsters asked them to install fraudulent apps. To install the apps, the scamsters then shared links with the victims. The names of various stocks, futures, options, forex etc. shown in the apps were the same as well-known companies (e.g. Reliance, Tata Power) to create an impression that the apps were genuine, the ED said.

According to the ED, the scamsters then encouraged the victims to invest in various fake IPO stocks, fake stocks etc. and made them transfer their money to the bank accounts of shell companies created for the specific purpose of collection of cybercrime proceeds.

To further build trust, the victims would initially get good returns on their investments as shown in the dashboard of the app, which gave them confidence and encouraged them to invest more. However, these returns were fictitious and were just numbers shown on the fake apps, the ED said.

As the victims invested more funds, they eventually realised that they were unable to withdraw their funds. When the victims tried to withdraw their money, the scammer asked them to pay statutory taxes, brokerage fees, etc. Once the fraudsters extracted as much money as possible, they would cut off all communication and disappear, leaving the victim with no recourse, the ED said.

Illegal SIM cards, mule bank accounts

According to the ED, the fraudsters contact various individuals within India via Telegram groups to acquire hundreds of SIM cards illegally. Once activated, these SIM cards are shipped abroad. They are either linked with the bank accounts of multiple shell companies or used to create and run WhatsApp accounts for defrauding victims, the agency said.

Scammers also incorporate hundreds of shell companies to acquire and siphon off proceeds of crime generated from these cyber scams, the ED said. They use the addresses of coworking spaces to provide a physical or virtual address for the incorporation of these shell companies. Further, it is revealed that during the filing of Form INC-20A (required to be filed for commencement of business by a company), fraudsters submit forged bank statements as proof of share subscription by shareholders, the agency said.

The ED’s investigation has further revealed that the scammers operate through a network of mule bank accounts rented through channels such as Telegram. The proceeds of crime are finally converted into cryptocurrency and siphoned off abroad to avoid detection and recovery, the agency added.

The funds are moved from the victim’s account through several intermediary accounts, including mule accounts taken on rent, and the numerous transactions between accounts create a convoluted web that conceals the source of the funds, the ED said. Small transaction amounts of less than Rs 5 lakh are used to avoid triggering alerts for suspicious activity and the illicit funds are routed through these shell companies, the agency added.

“A key finding of the investigation is that the proceeds of these fraudulent activities were mostly converted into cryptocurrency. This conversion was a deliberate strategy employed by the accused to further obscure the origins of the illicit funds and to facilitate their transfer out of India. By converting the proceeds into cryptocurrency and transferring them abroad, the perpetrators aimed to avoid detection, tracing, and recovery by law enforcement agencies,” the ED said.