Win trust, exploit greed: Chinese mafia modus operandi to siphon off crores

As he battles for life in an intensive care unit, an FIR was filed at the Vadodara cyber crime police station based on Shah’s wife’s complaint. As the police began investigating the case, unmissable similarities came across with four other FIRs currently under investigation. The police believe that Shah was trapped in a perfect web created by a China-based cybercrime mafia that has been siphoning off hundreds of crores of rupees daily from “gullible” Indian victims. They exploit the victims’ “greed” after winning their “trust”, the police said.

Further probe into Shah’s devices has brought to the fore the same modus operandi — establishing contact over WhatsApp to convince him that he could earn lakhs of rupees if he graduated to an upper level in the task in lieu of a “recharge balance” to unlock the target levels of the task. After convincing the victims to download the bait app from the Playstore or API provided in the message, the fraudsters share a unique referral code. The app accesses the victim’s phone location, contact list, message, gallery and camera, among others, police said.

Simultaneously, Shah was added to multiple Telegram groups by his perpetrators with several “fake members” posting screenshots of “successful withdrawals of profit”, leaving Shah even more convinced about the opportunity.
Vadodara Cyber Crime Assistant Commissioner of Police HS Makadiya says that Shah’s case is just the tip of the iceberg of a scam as investigations into four identical FIRs have led the Vadodara police on a trail of the modus operandi of China-based cyber mafia that has been siphoning off hundreds of crores of rupees daily from Indian victims.

“It is greed that makes victims of cybercrime fall for the ambitious promises of making money… Because they trust the app when they receive small amounts such as Rs 1,200-1,500 for the tasks, they deposit funds… The modus operandi is such that once the victim has deposited the money, he/she will be continuously asked to deposit more sum under the pretext of taxes and fees to withdraw the full profit, which could even be double the sum deposited,” he explains.

The mafia is not only placing bait for victims but also on a recruitment spree of agents in India to open shell companies and current accounts in banks that are crucial in the execution of transnational financial fraud. Besides the pay-for-work scam, the same hierarchy of agents also simultaneously operates the instant loan app scam where victims are eventually blackmailed with morphed photos and pushed to pay extortion money.

The Vadodara cybercrime has also run into 219 cybercrime complaints registered with the National Crime Records Bureau (NCRB) from across India against a bank account opened by an accused arrested in another pay-for-work scam in Vadodara and 123 NCRB complaints of cybercrime from across the country have been found against an account opened by another accused in a loan-app scam — all linked to Chinese mafia bosses.

In an FIR filed in April based on a Vadodara resident’s complaint against cyber harassment and blackmail for extortion by “agents” of a Chinese loan application, the Cybercrime police arrested eight persons, including a prime accused Umang Patel — a college dropout from Sankheda who worked in the Agricultural Produce & Livestock Market Committee (APMC) yard. He entered the “business” after his elder brother fell victim to a cyber fraud last year.

The investigators have found that the gang was involved in siphoning off crores of Indian rupees for the Chinese mafia through transactions to Chinese crypto accounts and IP addresses involved in the scam traced to locations in Hong Kong and China. The police have also found evidence of Umang Patel having personally met the Chinese mafia in Kuala Lumpur in March to hand over the biggest tool for the crime — bank account kits of shell company “directors”. Some of the transactions in the said loan app FIR were also made through the accounts opened by Umang himself, giving the police the much-needed breakthrough to establish China connect.

Umang had opened 10 shell companies and 30 accounts in his own name and the victim’s money was credited in two of his accounts in a total transaction of about Rs 15 crore, out of which he earned a commission of Rs 15 lakh, the police said. Umang was arrested in a similar case by the Rajkot cyber crime police station earlier this month.
A total of 20 accused have been arrested so far in four similar cases. All of them, including Umang, are now out on bail while the investigation continues. The Vadodara cyber crime police have now fanned out to nab more players in the hierarchy of the scam being operated from China. An accused-turned-witness in the case of the loan-app scam has also received a notice from the Telangana cyber crime cell in another pay-for-work scam case.

The Chinese interact with their “agents” only through Telegram, police said. “It is the job of the Chinese mafia to develop the applications and the websites that are used as bait for susceptible victims… The China-based mafia also establishes mass contact with victims through social media advertisements and bulk SMSes, which also have links to lead the victim to the fake pages of the ‘tasks’. The ‘agents’ have been specifically asked to open current accounts by creating shell companies, to facilitate payment gateways and aggregators as well as provide SIM Cards. They also run call centres for making harassment calls and for accounting,” Makadiya says.

He adds that Rahul Shah, who was arrested in another pay-for-work scam FIR this year, had appointed agents who opened over 50 current Indian bank accounts for the Chinese that are used to transact with the victims. “The hierarchy is so intricate and well-organised that even college students are involved in opening the current bank accounts. In fact, the Chinese operate like recruiters, setting bounty targets and lucrative commissions for those joining the chain of opening accounts — some are into a full-time job of opening bank accounts,” he says. The police investigation has revealed that the “profit”, the crime money, is layered in the current accounts of the shell companies and immediately transferred into the accounts of the payment aggregators and then to crypto traders using intermediaries in lieu of the amount received through other sources such as angadias. The cryptocurrency is then transferred to the Tronscan account of the Chinese bosses.