On off days, when he isn’t directing staff around the resort kitchen, chef Sumit Kumar dedicatedly watched investment videos. “It was on such a day in June that I happened to like a Facebook video from a financial advisor,” says Kumar. That one FB like would rob him of Rs 38 lakh, an amount he thought he was investing to send his daughter abroad for education.

In the weeks that followed, Kumar, a 59-year-old chef from Delhi currently working in Uttarakhand, would end up losing money borrowed from his wife and also from gold loans.

It wasn’t a split-second hijacking of the brain like in digital arrest cases, but an elaborate scam staged over weeks that robbed Kumar of his hard-earned money. The scam involved detailed websites, WhatsApp groups, text message updates on account balance and calls from offices of asset managers.

While Kumar was scammed of Rs 38 lakh, an elderly doctor from Indore was robbed of Rs 3.5 crore, and a Hyderabad-based software engineer of Rs 1 crorein September. A Noida-based engineer lost Rs 42 lakh as scammers made him invest through a fake trading platform, The Times of India reported on November 1.

Around 30,000 people across cities in India lost Rs 1,500 crore in the last six months to investment scams, according to a report by the cyber wing of the Home Ministry in October. Bengaluru, Delhi-NCR and Hyderabad accounted for nearly 65% of the cases.

Investment scams in which fraudsters impersonate popular wealth managers, finfluencers or officials from reputed wealth management companies are relatively new but have evolved with AI deepfake videos, say experts.

With the stock market in India gaining, people thought investing in shares would give better returns than traditional instruments like fixed deposits. This belief was reflected in the sharp rise in the number of retail investors in India, with Demat accounts reaching 200 million in June this year.

Scamsters took note of the trend. They set up websites mirroring those of wealth management companies, created fake videos of experts, employed mule accounts and impersonated experts to cheat unsuspecting people.

The person who got in touch with Sumit Kumar said she was calling from the office of Karan Bhagat, one of India’s most famous wealth managers and founder of 360 ONE WAM (formerly IIFL Wealth and Asset Management). Bhagat and 360 ONE WAM were aware of the scam, and issued cautionary notes on social media.

Sumit Kumar tells India Today Digital that he did his due diligence. “The website impersonating that of 360 One WAM even carried a registration number from market regulator Sebi,” he says.

Shubham Tripathi, cybersecurity engineer with Centre for Development of Advanced Computing (CDAC) in Noida, helped police track down Rs 19 lakh of the Rs 38 lakh scammed from Kumar. Tripathi says from Sebi registration numbers to personal data to current accounts with huge transaction limits, everything is on sale on the internet.

Kumar’s siphoned money, he says, was broken down and scattered to thousands of mule or fake accounts within hours.

Such is the ecosystem that by the time the victims realise they have been defrauded, the money has already been split, transferred, and converted across jurisdictions, says Gautam Mengle, AVP and security awareness strategist at CyberFrat, a Mumbai-based company specialising in cybersecurity.

“Even if investigators manage to freeze one of the early accounts, the amount left is often negligible. The masterminds remain safely out of reach,” he says.

In chef Kumar’s case, though Rs 19 lakh has been traced to such mule accounts and frozen. He faces an uphill task of reclaiming his own money. He has now filed a case at a court in Delhi’s Dwarka.

What also emerges in Kumar’s case is the tardiness with which the police move.

Kumar approached Delhi Police on July 15, and an FIR was filed on August 21. It took almost another month for the fake 360 ONE WAM website to be blocked. So, for three months of police knowing about the cloned website, it allowed it to be live, and exposed millions of people to scammers.

Though people lose hundreds of millions to investment scams every year, only scattered reports emerge in the news media. In this article, we will dive deep into how exactly people are manipulated to willingly hand over their hard-earned money to scammers and what can be done to prevent such frauds.

HOW THE INVESTMENT SCAM OF IMPERSONATION WORKS? A FIRST-HAND ACCOUNT

These investment scams usually start on social media, more specifically, Meta platforms like Facebook, Instagram and WhatsApp, by fraudsters pretending to be a well-known financial advisor, market expert, or Sebi-registered analyst, says Mengle of CyberFrat.

“Once you join the groups, they show screenshots of fake profits and nudge you to invest through a link or app that looks genuine. You transfer money, see fake gains on a dashboard, but when you try to withdraw, you’re told to pay ‘tax’ or ‘unlock charges’. Eventually, the scammers disappear,” says Mengle.

In the case of Sumit Kumar too, the fraudsters used Meta platforms to track his online activities and bait him.

Like most middle-class people, Kumar thought that the only wealth that he could give his daughter was a good education. He was looking to invest in the share market and grow his money to send his college-going daughter abroad for higher studies.

In June, he liked a Facebook post by Sanjana Sharma, a famous financial influencer and investment adviser. Within 10 minutes, he received a WhatsApp message from one Anjali Sharma, claiming she was from Karan Bhagat’s 360 ONE WAM. Kumar ignored it.

“I was then sent a profile of Karan Bhagat and his articles. She said investors were making 950% profit and a new group was starting a day later. I knew of Bhagat, and after some more persuasion, I agreed,” says Kumar.

Kumar was sent a link. He clicked on it and found a form of 360 ONE WAM, uploaded his PAN and Aadhaar cards. “Everything seemed like opening a bank account,” he says. He got a login and password for the cloned 360 ONE WAM website.

He was then added to a WhatsApp group with around 45 members, which included the numbers of Anjali Sharma and Karan Bhagat. That was where advice to buy and sell shares was given. Kumar was told he would have to give 15% of the profits as a “service charge”.

“Every day around 2.30 pm, Anjali Sharma would drop a message on the group to buy some particular shares. Then she would message at 9.30 am the following day to sell them. The other members in the group shared how they were making huge profits,” says Kumar. “I kept tracking the advice, and checked from BSE and business news websites that trading in those stocks was actually profitable.”

Kumar first invested Rs 2 lakh on June 18, and saw a return of 20% reflected in his account on the fake website.

“I became greedy,” admits Kumar. The scammers were encouraging him always to increase the investment, saying “that would change his life”. He then invested Rs 12 lakh and saw profits reflected in his fake account. Then he invested in “institutional stocks” and later in an “IPO”. In all, Kumar invested Rs 38 lakh, borrowing Rs 3 lakh from his wife and even taking a gold loan of Rs 25 lakh.

Kumar’s account on the fake website reflected Rs 3.4 crore on July 10 after he sold the “IPO” stocks. That very day he tried to withdraw Rs 1.7 crore. The money wasn’t credited to his bank account. He received a message that he needed to pay Rs 51 lakh as a “service charge” to claim the money. He was threatened with legal action if he didn’t pay up.

“That is when I realised I had been scammed. I was removed from the WhatsApp group. I then checked and found that each of the members were admins and fake investors,” says Kumar. A call to the real 360 ONE WAM office confirmed his doubt.

HOW FAKE INVESTMENT SCAMS WORK? CLONED WEBSITES AND MULE ACCOUNTS

“A cloned website looks very similar to the original one but has a minute change in the URL. Such a cloned account was used to dupe Sumit Kumar. Even the Sebi registration number was fake,” Tripathi, who is also an ethical hacker, tells India Today Digital.

Tripathi says mule or fake accounts play a big role in making the scammed money untraceable.

“An elderly doctor from Indore was duped of Rs 3.5 crore in investment fraud. We have been able to return him just Rs 6 lakh because the entire money has been circulated into thousands of mule bank accounts,” says Tripathi. “In the doctor’s case, we have been able to freeze Rs 37 lakh and will be approaching the court for orders for returning the money.”

But over Rs 3 crore has just disappeared in thin air. That’s because scammers transfer the money using up to 10 layers of bank accounts.

“In most cases, the money is withdrawn as cash in the first or second layer. Once withdrawn, that’s the end of the money trail,” says Tripathi.

In the chef’s case, the money was first transferred to 15 bank accounts from which it was sent to 250 accounts, and further scattered to over 20,000 accounts.

Many of those smaller accounts were linked to online gaming and gambling sites, now been banned in India. “I keep getting calls from all over India from the owners of those accounts, which have mostly been credited with Rs 1,000 or lesser, requesting help in getting the accounts unblocked,” says Sumit Kumar.

There are two types of mule accounts. The first are current or corporate accounts, and the second, nodal or merchant accounts.

“Fake current accounts with transaction limits of up to Rs 50-60 crore per day are being sold online and offline,” Tripathi tells India Today Digital.

Nodal or merchant accounts can function despite being flagged for fraud. Only the money in dispute is put on hold (marked lien), but the account keeps functioning.

“I know of several accounts against which there are over a lakh complaints each, but they are still active and receiving money from investment scams,” Tripathi tells India Today Digital.

While some of the accounts used by scammers are opened with stolen and fake identities, others are of people who allow their use for a cut.

“These are often students, gig workers, or job-seekers who respond to online ads promising easy work-from-home income. They’re told to receive money and forward it elsewhere, with little understanding that they’re enabling a financial crime,” says Gautam Mengle of CyberFrat.

He says that in many cases, the funds are eventually converted into cryptocurrency, which can be moved across borders in seconds with minimal oversight.

WHAT TO DO IF YOU HAVE BEEN SCAMMED BY CYBER CRIMINAL?

Speed of filing a report is key to the chances of recovering the money. In most cases, by the time investigators track and freeze accounts, the amount left is negligible.

If you lose money to cyberfraud, immediately file an online complaint at www.cybercrime.gov.in or call the pan-India helpline number 1930.

“Both these mechanisms set off a chain of events where your bank and the bank in which the money has been received are notified, the transaction is frozen so that the scammer can’t move the money further or withdraw it from an ATM and in a month’s time, after due process, the transaction is reversed,” Mengle tells India Today Digital.

In Sumit Kumar’s case, he was directed by those manning 1930 to approach the local police while his attempts to file a complaint on the National Cybercrime Reporting Portal immediately didn’t succeed as the “process was complicated, and it didn’t capture all transactions.”

WHAT CAN BE DONE TO PREVENT INVESTMENT SCAMS?

According to Shubham Tripathi of CDAC, people should be most careful on Fridays, because that’s the day when most cyber frauds take place. That is because bank branches don’t function for the next two days, giving the scammers ample time to vanish the loot.

But what can be done to bolster the system and check investment scams?

“There needs to be an audit of existing investment websites and apps. There must also be a robust system to verify individuals trying to open current accounts with high-transaction limits. This verification must be at multiple levels,” suggests Tripathi, who deals with such cases on a daily basis.

Artificial Intelligence (AI) tools have made the situation scarier. With AI, cybercriminals can now replicate an investment advisor’s or expert’s voice or video to dupe investors. “Scammers can also use AI chatbots to talk like the real advisor, to the point of replicating the same tone and financial lingo,” says Mengle.

There should be regular awareness drives for the general public to teach them how to protect themselves from cybercrooks in this digital age when most transactions happen online.

“One such initiative, the Information Security Education and Awareness (ISEA), is aimed at creating cyberwarriors and cyber-ambassadors,” says Tripathi.

The process of filing complaints on cybercrime.gov.in or the helpline should be smoothened because, according to several complainants, the website faces glitches and the process is complicated, and calls to 1930 don’t get connected.

Police action too isn’t instantaneous in most cases of fraud.

“I first went to Dwarka Cyber Police Station, near where I stay, and I was advised to go to Daryaganj Cyber Crime branch. Then I was sent to the Safdurjung Development Area cyber crime police station. I kept running between Dwarka and Daryaganj, and finally it is the Dwarka Cyber Police Station which is probing the case,” says chef Kumar.

He says his running around has revealed there is no SOP and the police personnel deputed to handle cyber fraud cases lack training and skills.

The Ministry of Home Affairs has realised this gap, and in 2023 introduced the Cyber Commando Training Programme. Under this project, 5,000 police personnel from across India will be turned into expert cyber cops with six months’ training.

However, the scammers seem to be ahead in the cat-and-mouse chase for now. And for most people who have fallen victim to cyberfraud and lost millions, it is an uphill task in getting back their money.

“I need to repay the gold loan and get the jewellery back. That’s the priority now,” says Chef Sumit Kumar.

On September 18, Kumar filed a case at Dwarka chief magistrate’s court for recovery of the money that Shubham Tripathi and his team helped track and freeze. The next hearing is on December 8. But that’s just Rs 19 lakh of the Rs 38 lakh he had been defrauded of. The rest Rs 19 lakh, like the Rs 3 crore in the Indore doctor’s case, has been swallowed by the giant black hole of investment scams in India.

– Ends