Hong Kong IP addresses, crypto funds to Dubai: First arrests in fake courier scam are just tip of iceberg

The revelations emerged during the course of investigations over the last month into one of the 250 fake courier scam cases registered in the city this year.

Eight people — four each from Bengaluru city and Davangere district — were nabbed in the case last month. They were accused of operating dozens of bank accounts, created using the credentials of unsuspecting people, to receive funds from the scam.

The complainant in this case, Nataraj Rao, 58, described to North Bengaluru Police what appeared to be a well-oiled operation — one that went well beyond the account operators and still continues to scam people.

On November 10, Rao received a WhatsApp call from an “employee” of the courier company FedEx. This “employee” told him that illegal items — including expired passports and 140 grams of the narcotic substance MDMA — had been found in a parcel being sent in his wife’s name from Mumbai to Thailand.

Then, a person claiming to be a deputy commissioner of police in the Mumbai Police Narcotics Cell contacted Rao on Skype, claiming his wife was suspected to be involved in money laundering and drug peddling.

Rao was then asked to provide his bank statements and “temporarily” transfer money to accounts designated by the “police officer” for “Reserve Bank verification”. The victim transferred Rs 1.08 crore in two batches before realising that he had been had.

Police investigations in the case revealed that nearly Rs 9.34 lakh of the Rs 1.08 crore was transferred to an RBL bank account and withdrawn in Davangere in central Karnataka. Police examined CCTV footage at the bank to determine the identity of the suspects, who physically collected part of the stolen money.

Based on the leads in Davangere, police picked up the eight persons beginning November 17, seized Rs 13.17 lakh in cash, and froze Rs 19 lakh in accounts linked to the accused. They found that the alleged operators used 11 mobile phones and 148 bank accounts to launder as much as Rs 8.5 crore.

The arrested people from Davangere were identified as Wasim N, 30, Habeebullah M, 35, Nizamuddin, 24, and Mushraff Khan, 24. Nurullah Khan, 53, Mohammed Umar, 44, Syed Ahmed Moula, 27, and Syed Hussain, 22, were from Bengaluru. Among the arrested are the owners of a medical store in Davangere and small businessmen from Bengaluru.

“This is the first ever arrest in the country in a case of the fake courier scam,” Bengaluru police commissioner B Dayananda said after the announcement of the arrest on December 1.

“The arrests were possible because the accounts where some of the funds from the crime were transferred were in Karnataka and this facilitated investigation of the persons who withdrew the money in cash,” additional commissioner of police (east) Raman Gupta said.

“The arrest of these persons has led to links for 75 cases logged on the National Cyber Crime Portal (NCRP). Two cybercrime cases registered with the North CEN police have also been linked to this group,” Bengaluru North DCP Saidulu Adavath said.

Police found that the arrested people were recruited through a Telegram group. Besides operating the accounts, they were tasked with withdrawing money from accounts under their control and converting them into cryptocurrency for payments in Dubai. The operators were paid commissions on the basis of the amount they helped launder, police said. Police found USDT (Tether) cryptocurrency worth Rs 4,500 in the possession of the arrested men.

As much as Rs 52 lakh stolen from the senior citizen in November was paid in cryptocurrency in Dubai before the suspects were detained in mid-November, police said.

“The persons who have been arrested are only aware of the money laundering component of the crime. They were recruited on Telegram. They worked in a silo that had no links to the tele callers who tricked victims into parting with funds by claiming to be policemen, narcotics agents or other segments of the crime. The arrests in Bengaluru are only a small fraction of the persons involved in the crime,” a police source said.

“The men arrested in Karnataka were aware that they were dealing with fraudulent funds in the bank accounts they operated since some of the accounts they created previously were frozen for receiving scam money,” a senior police official said.

Another police officer said: “The investigations and analysis of the network seems to suggest that Hong Kong-based IP addresses were used to make the VoIP (Voice over Internet Protocol) calls to the victim in the Bengaluru North case. In some of the other cases the IP addresses (in cases in Telangana) that were used to make the calls were traced to Cambodia but in this case on the basis of analysis it seems to have emerged from Hong Kong.”

On December 11, a local court granted bail to six of the eight arrested persons, denying bail to Bengaluru-based Syed Ahmed and Syed Hussain.

“The accused persons are involved to get illegal money and convert the same to Binance (a crypto firm) currency. They have connections with Dubai-origin culprits and a detailed investigation to that effect is required,” the local court observed this week.

Investigations indicate that the back end of the scam works in a similar manner to fake online jobs scams — with multiple layers (where one layer is not aware of the other) and stolen funds being transferred to the UAE through cryptocurrency and the main operatives of the scam possibly operating from bases in east Asia.

Despite the arrests in the North Bengaluru case, the courier scam continues unabated. On December 7, a 52-year-old businessman Tarak Shah filed a complaint in South East Bengaluru stating he was duped of Rs 1.98 crore between December 2 and 7. The victim and his wife were allegedly harassed in the name of interrogation by callers who claimed to be Mumbai crime branch policemen.

In many of the cases, the callers continue to harass the victims even after they have realised they have been cheated. The callers, masquerading as law enforcement officials, demand more payments even when police cases have been registered for the frauds, police said.

Nithin Kamath, the founder and CEO of the Bengaluru-headquartered financial services firm Zerodha, also reported on social media on June 23 the prevalence of the courier scam through an experience undergone by a colleague.

“There’s a new scam in the name of FedEx, Blue Dart, and other courier companies that you need to be aware of. A colleague got a call from a person claiming to be from FedEx saying that a parcel had been confiscated by the police because drugs were found in it,” Kamath said on his social media account earlier this year.

“Since he was expecting a courier from an e-commerce platform, he panicked. He then got a video call from someone claiming to be the police and issued this official-looking letter. They shared the bank details to transfer funds to release the package,” he said on social media.

“Since the fake police had his AADHAR number, this made the entire ordeal more convincing. This person panicked & transferred the money immediately. If this can happen to a person working in a company that constantly sensitises everyone to cyber fraud, it can happen to anyone,” Kamath said.

“In a situation like this, the best thing is to say, I will get my lawyer to speak to you; it doesn’t matter even if you don’t have a lawyer. Most fraudsters prey on people who panic and react instinctively. Slowing down before reacting is the key.”