Inside India's Digital Arrest Scam: How Fraudsters Target the Wealthy Through Financial and Psychological Manipulation

On a sweltering August morning last year, 77-year-old retired Indian Air Force officer Biren Yadav received a call while alone at his Gurugram home. The caller, a woman claiming to represent the Telecom Regulatory Authority of India, recited his personal details with alarming accuracy—his address, national ID, and tax account number. She delivered a chilling message: "One of your phones is transmitting antinational messages. Unless the cyberpolice clears your name, we have to freeze all your numbers."

This marked the beginning of Yadav's "digital arrest," a sophisticated scam targeting India's affluent citizens. The scale is staggering—one former banker reportedly lost 230 million rupees ($2.6 million) in August, with government data showing collective losses of 25.8 billion rupees ($290 million) since 2022 across 242,000 documented cases. Yet these figures likely underestimate the true extent of the problem. Research by the Global Anti-Scam Alliance found that only 28 percent of financial-scam victims report their experiences to law enforcement, while one in five don't even attempt to recover their losses.

Recovery attempts rarely succeed outside countries like the US, UK, Canada, and Australia. In India, police often discourage victims of smaller scams from filing complaints, knowing that even after lengthy judicial proceedings, victims typically recover only pennies on the dollar. Many victims, either traumatized by the experience or embarrassed by their gullibility, conceal their losses even from family members.

The digital-arrest scam has flourished in India's environment of high youth unemployment, widespread corruption, and stark wealth inequality. Its impact extends far beyond financial loss, inflicting psychological trauma with lasting effects. Banks face a growing crisis of confidence as criminals operate fraudulent accounts that siphon victims' savings. Many of these criminal syndicates operate from outside India, creating potential national security challenges. With emerging factors like artificial intelligence and cryptocurrencies entering the mix, the situation threatens to worsen considerably.

When Yadav answered that fateful call, he initially assumed his personal data had been compromised—that someone had used his credentials to register an unfamiliar phone number. He agreed to be transferred to the supposed cyberpolice to resolve what he believed was a simple misunderstanding.

The scenario then took a darker turn. Another official-sounding voice informed Yadav that the government suspected him of being part of a 246-person conspiracy working with Naresh Goyal, founder of what was once India's largest private airline. With Goyal out on bail facing bank-fraud charges, his alleged co-conspirators were being rounded up, the "police officer" claimed. According to this impostor, Yadav's only option was to prove his innocence to the Central Bureau of Investigation via video call—or face arrest for concealing 300 million rupees ($3.4 million) of Goyal's alleged illegal funds in his accounts.

According to GASA, scams constitute a $1 trillion annual global industry. Shopping fraud—where victims pay for goods they never receive—remains most prevalent. Another common technique is "pig butchering," where victims are lured with small financial gains before scammers deliver a devastating blow that drains their accounts. Digital arrests, however, deliver an immediate psychological knockout—making vulnerable individuals feel the full weight of law enforcement bearing down on them. The criminals don't demand bribes; they demand proof of innocence. Overcome by fear and psychological shock, victims seek relief by voluntarily transferring large sums through legitimate banking channels.

While authorities occasionally help wealthy industrialists recover their funds, most recovery efforts yield little. Law enforcement typically targets the account holders who received the victim's transfers—but by then, scammers have withdrawn or moved the money. These accounts are primarily "mules," owned either by individuals unaware their identities have been stolen or by people who knowingly rent their accounts to criminals for payment. Police have uncovered WhatsApp and Telegram groups where corrupt bank officers offer mule accounts to cybercriminals for substantial commissions.

The actual perpetrators operate within complex, diffuse networks that evade easy detection and dismantling, especially when controlled from overseas. An investigation by news site Scroll revealed thousands of young Indians trafficked to Cambodia, where they're held captive and forced to participate in extortion schemes. Bloomberg columnist Karishma Vaswani describes Asia as experiencing a "scamdemic," with Cambodia, Laos, and Myanmar as its epicenter. Indeed, investigators eventually traced Yadav's scammer's number to Cambodia.

India presents fertile ground for online fraud. A digital revolution is transforming the world's fifth-largest economy, but without adequate data privacy safeguards, this transformation brings collateral damage. Indians authenticate billions of transactions monthly using their unique Aadhaar digital ID, creating a massive repository of personal data—including biometrics—that authorities claim is completely secure.

Evidence suggests otherwise. In October 2023, US cybersecurity firm Resecurity revealed that personal information of 815 million Indians was being sold on the dark web, traced to a hack of the Indian Council of Medical Research. While the government acknowledged "evidence of leakage," it denied any information theft. Police arrested four individuals.

These inadequately protected databases tempt many unemployed, tech-savvy youth. With manufacturing jobs scarce and AI threatening white-collar employment, India offers limited pathways to middle-class stability, let alone affluence. For some, digital crime becomes the answer.

Even without hacker involvement, the government's handling of sensitive personal information raises concerns. Tax officials possess broad powers to examine people's emails, chats, and social media. Opposition politicians, student leaders, and activists face extended detention without trial on various charges brought by the same investigating agencies whose names scammers invoke to intimidate digital arrest victims. Caught between fear of government surveillance and rampant online misinformation, even educated, successful individuals have lost confidence in their judgment about what to believe.

For Usha Goswami, a retired marine biotechnologist living in Goa, this confusion enabled a grueling four-day digital arrest in June. When scammers showed Goswami her Aadhaar card, she initially thought, "Anybody can fake it." But when they claimed her bank accounts were being used by human traffickers for money laundering and police were coming to arrest her, fear took over. To prove her funds were legitimate, her handlers insisted she transfer money to "government-approved accounts" for verification. The 80-year-old scientist lost 9.7 million rupees ($109,000), according to her police report. By the time Goswami and her Singapore-based daughter secured a court order to recover the funds, Yes Bank Ltd. had released a significant portion to another claimant. Most of her savings disappeared—potentially forever.

Several hours into his digital arrest, Yadav agreed to a Skype interrogation with someone claiming to be a junior CBI officer. (Skype was commonly used for this scam until Microsoft retired the service in May; Goswami's digital arrest occurred via WhatsApp.) Yadav was told he would now meet the "senior officer" who would decide his fate.

The actor playing this role sat behind a large desk in full uniform, India's national emblem displayed on the wall behind him. People continually entered with files as he issued commands. He demanded of his junior: "Why haven't you arrested this man yet?" He knew precise details of Yadav's savings. "He was shouting at me and at one stage even threatened to seize my children's property. That's when I lost it," Yadav recalls.

Over two days, Yadav's handler directed him to visit four different banks, transferring his life savings to supposed "government-approved accounts" for "inspection." Each time, the pensioner received banking instructions via WhatsApp audio call in plain view of bank tellers.

This aspect particularly troubles Yadav: "Have our banks failed so badly, or were they a party to it?" He lost 15.95 million rupees ($180,000). No one at these branches, where he was a known customer, questioned why he was accepting penalties for early withdrawal of time deposits or writing transfer orders to entities like "Leopard Race Private Limited."

Suspicions of bank complicity aren't unfounded. Samudrala Venkateswarlu, a former director of Sreenivasa Padmavathi Cooperative Urban Bank, remains in judicial custody connected to the digital arrest of an advertising executive—Yadav's neighbor. Nearly 85 percent of the 58.5 million rupees ($659,000) extorted from the executive eventually reached 11 fraudulent accounts at this small Hyderabad bank. Two accounts, belonging to a carpenter and a tailor, have been named in multiple cybercrime complaints, while several other account holders are untraceable with fake addresses. Venkateswarlu, accused of opening and operating some of these accounts, was denied bail for a third time in September despite claiming innocence. During bail proceedings, Venkateswarlu implicated the cooperative bank's chairman, P. Srinivas Kumar, who has denied involvement.

The advertising executive has approached India's Consumer Disputes Redressal Commission, accusing major Indian lenders of providing deficient service. HDFC Bank Ltd., which transferred funds from the executive's accounts, told the commission the victim is deflecting blame for their own negligence. ICICI Bank Ltd., which received the money, claims no obligation to non-customers; Federal Bank Ltd., whose money-transfer network was used by the cooperative bank, hasn't yet responded. None answered my inquiries.

Law enforcement struggles with appropriate responses, while banks appear indifferent to their prevention responsibilities. Lenders sometimes process transfers despite National Cyber Crime Reporting Portal injunctions and often refuse to reverse fraudulent transactions even under court orders. This delayed response gives criminals ample time to withdraw stolen funds and convert them to cryptocurrency.

The proliferation of mule accounts compounds the problem. Under the government's financial inclusion initiative, approximately 550 million new bank accounts have been created over the past decade. Despite banks' insistence that they follow the Reserve Bank of India's customer authentication guidelines, many accounts clearly facilitate fraud. Digital banking acceleration has also simplified theft—not just through smartphone payments but through high-value transfers that settle instantly, around the clock. While this benefits legitimate commerce, instantaneous money movement means instantaneous loss.

In Yadav's case, HDFC Bank is contesting a court order to return 3.8 million rupees ($43,000) it secured before scammers could move it elsewhere, arguing not all funds belong to the air-force veteran. Court documents reveal that Yadav wasn't the only victim that day—the suspicious account, which held just $6 that morning, received over 37 million rupees ($417,000) in a single day. By evening, most funds had disappeared. The bank has not explained why its surveillance system failed to detect these obvious fraud indicators.

Yadav eventually recovered some stolen funds. Ironically, that's when his bank finally intervened—freezing his pension account upon detecting incoming tainted funds. Nearly a year later, it remains locked.

Defeating digital arrests requires addressing both psychological and technological vulnerabilities.

When facing threats, most people experience fight-or-flight responses—either challenging criminals before they set their trap or disconnecting their phones to escape. However, a third stress response often occurs: the motor system freezes, creating a deer-in-headlights effect. Digital arrests succeed when this paralysis persists. The advertising executive from Gurugram, whose ordeal lasted five days, described their rational thinking simply shutting down.

Even small interventions that redirect control from the amygdala (threat-detection center) to the prefrontal cortex (reasoning faculty) can significantly help. India's telecom regulator could require communication services to display warnings during unusually long calls: "Your call has lasted more than an hour. Be careful. No law-enforcement activity takes place on our platform."

Banks could implement similar alerts—some already are. Recently, while adding a new recipient via online banking, I received a warning about digital arrests. Last year, Prime Minister Narendra Modi even played a hoax clip during his monthly radio broadcast to raise public awareness. While these initiatives help, they're insufficient.

This is because the actual money transfers occur offline, in physical branches. Banks typically impose cooling-off periods for online payments to newly added accounts, but no such restrictions exist for in-branch transfers. Additionally, many customers feel secure in local branches among familiar employees. The economy will suffer if financial institutions don't take immediate steps to maintain this trust, says Venkatanarayanan Anand, a Bengaluru-based internet security researcher. Having witnessed numerous digital arrests while consulting for state agencies, Anand has moved his savings to money market funds outside the banking system. "I have advised my parents to do the same," he says.

Goswami has already lost faith in banks: "I now worry even about the safety of my documents in their fixed-deposit boxes." To maintain middle-class confidence in traditional financial institutions, banks must invest in anti-scam technology. AI and machine learning could analyze branch CCTV footage and correlate it with suspicious account activity to identify customers under duress. State Bank of India, the country's largest deposit-taking institution, plans to install AI-enabled cameras across more than 22,000 branches to detect unusual behavior. No other bank has such extensive monitoring capabilities or the market influence to establish industry standards.

India's banking regulator should examine how other countries combat financial crime. Last year, Singapore established shared-responsibility guidelines for scam transactions, requiring payment providers to block attempts to withdraw more than 50 percent of account balances within 24 hours. Telecommunications services must implement anti-scam filters for suspicious bulk messages. Non-compliant companies must fully compensate customers. Similar laws are emerging elsewhere. Hong Kong banks failing to help customers identify and prevent scams may soon face liability. Since October 2022, UK banks must reimburse up to €85,000 ($114,000) to customers tricked into sending money to fraudsters' accounts, with banks bearing the burden of proving customer negligence.

Indian laws and regulations should offer comparable protections. Banking can be either slow—as when intercity checks took days to clear across India's vast geography—or fast, as in today's digital environment. But its foundations must remain trust and free will. Bank CEOs must earn the former while ensuring customers exercise the latter.

Most urgently, banks must improve recovery rates to encourage more victims to come forward. After a year of persistent effort, Yadav has recovered only 10 percent of his stolen money. He reluctantly accepts the 60 percent that scammers converted to cash or cryptocurrency as lost. What truly embitters him is the 30 percent frozen in various banks, inaccessible despite court orders. Though Yadav's digital arrest has ended, with so much money still in limbo, true freedom remains elusive.

(Andy Mukherjee is a Bloomberg Opinion columnist covering industrial companies and financial services. He previously was a columnist for Reuters Breakingviews. He has also worked for the Straits Times, ET NOW and Bloomberg News.)

Disclaimer: These are the personal opinions of the author.