Fraud Alert: Sextortion; Loan App Traps and Aadhaar Fingerprint Cloning

Yogesh Sapkale 13 May 2022

Technology is a boon and a great leveller because it does not differentiate between users. However, fraudsters and cheaters are way ahead of ordinary people when it comes to using technology for fraud. This week, we will see how Instagram/ Facebook messages followed by nude video calls are being used to blackmail the recipient. We will also check how loan apps are making life difficult for borrowers even for a small repayment issue and how a gang created fingerprints of people to siphon money through the Aadhaar Enabled Payment System (AEPS).

Fingerprint Cloning from Aadhaar to Siphon Money

Fingerprints were first used for crime detection. Over time, it also became clear that fingerprinting was not as fool-proof as its advocates would suggest. Yet, in India, biometrics or fingerprinting was introduced through the Aadhaar number identification system.

Cloning of fingerprints is very easy; several video tutorials are easily available online and Moneylife Foundation even demonstrated it at a webinar in October 2016!

A gang of people, registered as common service centres (CSCs) for e-governance services through municipalities and villages in the Gwalior district, learned this technique very fast. By stealing thumb impressions of villagers, they cloned fingerprints and withdrew money through AEPS.

Police told the Times of India that the gang siphoned Rs5 lakh from the accounts of 23 people. Police also found fingerprints of 98 people in the gang's possession. The gang, now arrested, bought the equipment for making cloned fingerprints from online shopping websites. They had a biometric machine, rubber thumb impression printer, gelatin, temperature modulator and other chemicals to make a clone.

AEPS enables a person to withdraw money from their bank account using a local business correspondent anywhere in the country and this also makes it easy to cheat people.

Loan App Traps: How Borrowers Continue To Be Harassed for Recovery

The cyber security wing of the Coimbatore police has warned residents against mobile apps that are luring people into loan traps. According to the police, even just downloading these loan apps could lead to trouble.

There are more than 300 such loan apps and the biggest issue with all of them is they collect contact details of everyone in the person's phonebook and transfer the entire data available in the gallery to the loan app account. In case the borrower does not pay the loan on time, the app company badgers the borrowers' contacts, including sending messages asking them to pay, as well as abusive and defamatory messages and even morphed nude images of the person. They also use social media like WhatsApp to shame borrowers over not repaying a loan.

Sometimes, recovery agents continue to extract money from the borrower, under one pretext or the other, even after the entire loan is repaid. The Coimbatore police have registered at least 30 such complaints. Two people from Mumbai have had a similar experience using loan apps called Koko and Janecoin. They continued to receive threatening messages even after repaying the full amount. In both cases, the app agents threatened to defame their near and dear ones.

A report in Mid-Day says, a defaulting borrower's wife was sent a morphed image of his wife and a text message filled with profanities. Pelhar and Kurar police stations have registered first information reports (FIRs) against the users of the mobile phone numbers that the recovery officers used under Sections 420 (cheating), 500 (defamation), 504 (provoking breach of peace) and 506 (criminal intimidation) of the Indian Penal Code (IPC), and relevant sections of the Information Technology (IT) Act.

"Hello Friend. Is It You in the Video!"

This is the new avatar of fraud messages that many people have received from friends, colleagues, or relatives on WhatsApp or, more often, Facebook messenger. Through this message (Is that you in the video), the fraudsters try to evoke curiosity and a sense of urgency in their victims to click on the link. They also appear safe or harmless since they do not evoke 'fear' or 'greed'.

However, this is part of a bigger scam. People click the link in the message to check if they are in the video. This requires them to use their login and password. The video itself is immaterial; the login process gives the fraudster the victim's login details and password. This is then used to gather more information about the victim and cause losses, including but not limited to financial.

Do not rush to click on every link you receive, even from a person you might know. When in doubt, simply call the sender to ask about the legitimacy of the message. Nothing is ever so urgent that you cannot make a quick phone call to check facts. It would definitely save you a whole lot of trouble.

Message, Nude Video Calls & Blackmail

This is how it works. First, the victim receives a message or a friend request on Facebook or any other social media. Then a video call and chat. This is soon followed by a series of morphed nude messages of the victim with a threat to make it public. This is known as a sextortion scam. They immediately cause shame and panic and are often so unsettling that they have even had tragic consequences.

In the original sextortion scams, emails mislead victims into thinking that the attacker owns a recording of their screen and camera and that the recording contains images or videos of the potential victim in sexually explicit situations.

However, scamsters, who operate at the tri-junction of Haryana, Uttar Pradesh and Rajasthan, have modified the modus operandi. A report from Indian Express reveals how a 33-year-old executive from a social media marketing company received a friend request from a woman on Instagram and then how it became a bigger scam.

As soon as the executive accepted the request, the lady made video calls. "Initially, I ignored the calls, but after seven or eight of those, I answered the phone. On the other side was a naked woman performing obscene acts. It took me around 15 seconds to figure out what was going on. And then, I disconnected the call," he told the newspaper.

Next, the woman sent him messages threatening to make the video public. However, the executive ignored the message and deleted the woman from his friend list on Instagram.

Fifteen minutes later, he started receiving messages and frantic calls from family and friends about a 'video' they had got. "The scamsters had taken a picture of my face from the video call I had with them and superimposed it on someone else's body. In the video they shared, it appears as if I am having a sex chat," he says.

Agra cyber police arrested three men from Mewat who were allegedly involved in various forms of cybercrime, including making "nude video calls to blackmail people". Police believe that it is this same gang that targeted the executive.

A Mumbai-based lawyer was also a victim through Facebook.

The trick here is to stay calm, not fall for the threats and report the matter to the cybercrime police immediately. Ideally, have a lawyer present. Often, the police advise people to simply block the caller after telling them the matter has been filed with the police and nothing further is heard from the fraudsters thereafter.

Remember, the fraudsters emphasise the humiliation and embarrassment of the situation to blackmail the victim into paying them money. So do not respond and do not pay any money.

In short, while using social media, you need to follow some basic rules. This includes the one that your mother told you—to stay away from strangers.

Comments