Cyber fraud: You will pay a heavy price if you fall for 'discount sales' | Part-2

(This is the second part of a series on financial cybercrimes. Click to read the first part)

Not long ago, there were notices and advertisements that said ‘export quality’ garments that could not be sold in the factories in North India due to floods were being sold in Kerala for one-tenth the price.

Such 'discount sales' almost came to a halt after floods affected Kerala. But, now, there are new setups that offer a smartphone worth Rs 1 lakh for just Rs 10,000! This is not the price being quoted by some store wanting to beat the online shopping sites that advertise great offers. This is part of the business of Udayraj Gujjar, who introduces himself as a Customs officer at the Visakhapatnam port.

We found him on a Telegram channel that has the Customs’ logo and the name of Mumbai Customs and has 93,600 followers.

This is how Udayraj Gujjar introduces himself: “I am employed in the internal audit division at Customs House in Visakhapatnam. I clear the loads of electronics items that arrive at the port. But I withhold some of the items saying they are either smuggled or stolen goods or were damaged while shipping. I use Telegram to sell these items for a small amount. The money raised through such sales is shared with colleagues. We sell only brand new products. We also provide warranty.”

We approached him pretending that we were interested in buying an iPhone. He said, “The price of the iPhone is Rs 10,000, it is new. You have to pay an advance of Rs 5,000. The remaining Rs 5,000 can be paid after you get the phone. The amount can be transferred via Google Pay or to my account.”

"Okay, how can we trust you? Do you have any ID proof?”

We received a message that showed the PAN card and Aadhaar card of a person named Udayaraj Gujjar, son of Dattatreya Ramachandra Gujjar, a native of Satara in Maharashtra. Along with it, there were videos of iPhones that were piled up and thank-you messages from what the 'Customs official' claimed were people who bought his products.

"Can you show us your Customs ID card?"

“That's not possible, there is a risk that the ID could be misused."

“What if a friend in Visakhapatnam comes to see you in-person to pay you?”    

“That will also not be possible, sir. We can't take the goods out of the office. If we are caught, we will lose our job. We will send the product by courier. We will send you the courier tracking link as soon as you pay the advance.”

We ended the conversation there for the moment and did an investigation. 

If you believe the words of ‘Udayraj’ and give the advance amount, you will be sent a link to track the ‘courier’ as soon as the payment is made. But the links are generated through fraudulent sites like PackageBhejo and Logitech. While the link will provide you ‘updates’ about the courier passing through various cities, it is certain that you will never receive the item.

It is logical to assume that the ID proofs sent by Udayraj belong to some other person of the same name. Finally, we couldn’t resist asking him: ‘How much do you earn per day through this scam?”

"I do not indulge in any scam. I will block you if you talk too much.”

He kept his word; he blocked us the very next moment. ‘Udayaraj’ probably still continues with his ‘discount sales’ unhindered through Telegram.

'Buy one meal, get two free'

The other kind of discount sales offers like 'buy 1, get 1 free'.  

S Suresh of Kent Paradise, Thammanam in Kochi, called the number that he saw with an advertisement on Facebook of a restaurant offering the famous Rajasthani thali meals. He was told there was an offer — buy one meal for Rs 350 and get two free. Besides, home delivery was also available. 

Suresh then received a link via an SMS to make the booking by paying Rs 10. The link was for a Google document in which details of the card being used for payment, including the card's number, its expiry date, and CVV (three-digit code of the card), were to be filled. 

Suresh did not make the payment as he wondered if so many details were needed to order just a lunch. The fraudsters started calling him when they did not get the payment.

Later, when Suresh called the Mumbai headquarters of the restaurant chain and enquired about its services, he was told that a lot of fraud was taking place in its name and that it had lodged a complaint with the police.

It is obvious that the fraudsters were trying to swindle all the money in an account by collecting credit card or debit card details. 

Suresh did not get cheated because he was alert. But the question is how many people are similarly cautious?

The other kind of scam are those ‘discount sales’ that offer to get you things using stolen credit card information. You just have to pay a small amount. 'Carding' is the name given to the scam perpetrated through e-commerce websites by using credit card information that is up for sale in the Internet underworld (Darknet).

Once the specified amount is transferred, the fraudsters will order expensive products using the hacked credit card information and get it delivered to your address through any of the e-commerce websites. You will have to bear the risk, though. If caught, you’ll go to jail because the address is yours. 

You are promised products worth lakhs at a low price if you are ready to take this risk. But, in most cases, the products are not delivered and the amount paid is also lost. Also, keep in mind that even if the product actually arrives, the police will follow suit.

Welcome to the fake customer care

Many of us have the habit of searching for customer care numbers when something goes wrong with online services. But what if the number you find belongs to a fraudster? Crores of rupees are being swindled through fake customer care call centres.

This is what our investigations revealed.

'Will there be a refund?'

Fake customer care number: 83XX80XX05

We called a so-called Google Pay ‘customer care’ number that we found on Twitter saying we accidentally recharged another phone number using Google Pay and that we would like a refund. The amount will be refunded, the person said in Hindi. This was followed by a question: how much do you have in your bank account? Rs 25,000, we lied. The next moment we received a Google Pay notification mentioning this amount.

It was actually a request demanding Rs 25,000 and not a refund. Since the remarks section of the notification says ‘refund’, many will think it is an option to get the money refunded. If we complete the transaction by entering the UPI PIN, the amount will get transferred from our account to the fraudsters' accounts. Google Pay has nothing to do with such 'customer care' numbers.

‘Didn’t get the ordered biryani’

Fake customer care number: 98XX540XX4

We called the fake 'customer care' number of a food delivery platform with a 'complaint' that we had not received the Rs 450 biryani we had ordered. The ‘customer care’ executive said the order has been cancelled and the money would be refunded through either Google Pay or PhonePay. The moment we said ‘fine’, we got a payment request for Rs 450 with the remarks saying 'refund'. If you enter the UPI PIN, that amount will go to the account of the fraudster.

‘Fixing Windows operating system'

Fake number: + 1–8XX-212-5XX1

A friend got a browser notification saying there were security issues with Windows and that he should call Microsoft's support centre immediately to get them fixed. The friend called the number.

The ‘support executive’ spoke in Hindi mixed with English and wanted remote access of the computer through ‘TeamViewer’ to check the problem. The person said some software will have to be bought from them to fix the glitch. The ‘executive’ found issues in a computer that had no problem and was running smoothly. The friend did not fall into that trap because he knew the danger of giving a stranger the permission to take control of his computer remotely.

E-vigilance

• Here's how you can safeguard yourself from such frauds: 

• Only call the customer care numbers given on the official websites.

• Do not rely on customer care numbers found on other websites or through Google search.

• There is less probability of major e-commerce websites and food delivery apps having special customer care numbers. Many of them offer the option to send complaints through their own apps or websites.

• Do not share bank details or passwords during customer care calls.

Contributed by: K Jayaprakash Babu, Ajay Ben, Jiku Varghese Jacob.

Compiled by: A Jeevan Kumar.