By Shilpi Sharan and Shilpi Sinha
Introduction
Digital payment methods have seen an increase in use in recent years. Lockdowns triggered by Covid-19 accelerated this trend. In addition to making life easier for customers, it helped the government achieve its goal of increasing financial inclusion in the country as a whole. There has also been an increase in the number of retail financial transaction scams and financial fraudsters, since transactions have become faster and easier. Newcomers to the usage of digital platforms, who are unfamiliar with the techno-financial eco-system, are particularly vulnerable to financial fraudsters’ inventive tactics of defrauding them of their hard-earned money.
Beware, A Booklet on Modus operandi of financial fraudsters, Office of the RBI ombudsman (2022)
With the goal of providing as much useful information as possible to persons who are unfamiliar with digital and electronic forms of financial transactions, RBI Ombudsmen developed this booklet from numerous reports of fraud and complaints received at RBI Ombudsmen’s offices.[1] The booklet’s purpose is to educate the general public on the methods fraudsters use to swindle and mislead them, as well as the safeguards they should take when transacting money. Be wary of unknown phone calls, emails, and messages; practise due diligence when conducting financial transactions; and change your secure credentials and passwords frequently. This emphasises the importance of keeping one’s personal information, particularly financial information, confidential at all times.
Modus Operandi adopted for Fraudulent Transactions for Bank Related Transactions
By Banks
1. Phishing Links
Third-party phishing websites seem like legitimate websites, such as a bank’s website, an e-commerce site, or a search engine, for example, but are actually a third-party scam. Fraudsters disseminate links to these sites by SMS, social media, email, instant messaging, and other means of communication. Many users click on the link without inspecting the detailed URL and input security credentials, such as Personal Identification Number (PIN), One Time Password (OTP), Password, etc., which are collected and exploited by the fraudsters to steal money from their accounts.
Take the necessary steps to prevent becoming stuck. If you receive an email or text message from an unknown sender, do not open it and quickly delete it to avoid accessing it by mistake in the future. Before deleting emails with links to a bank’s, e- commerce’s, or a search engine’s website, unsubscribe from and block the sender’s email ID. Visit the official website of your financial institution or service provider at all times. Verify all information on the website, particularly any fields that ask for credit card information. If the website does not have the secure sign (https with a padlock symbol), do not submit any sensitive information. Verify the spelling of URLs and domain names that you receive via email. Report anything that looks fishy.
2. Vishing Calls
Imposters pretend to be bank tellers, corporate executives, insurance agents, government officials, and so on when they contact or approach people over the phone or through social media. By sharing some personal information about customers, imposters try to build trust. Imposters may use urgency or deception to compel consumers to provide personal information, such as passwords, one-time passwords, personal identification numbers (PINs), and card verification values (CVVs), in order to get access to sensitive data. To swindle the clients, these credentials are subsequently put to use.
Confidential information such as login / password / card data / CVV / OTP should never be shared with bank employees / financial institutions / RBI / any real organisation / Even family members and friends should not have access to this information.
3. Frauds using online sales platforms
Using online sales platforms, fraudsters pretend to be customers and express an interest in the seller’s products. To garner trust, scammers sometimes pose as military personnel stationed in far-flung locales, such as the Middle East or Africa. A UPI PIN is required for sellers who want to accept a request for payment rather than pay directly through a payment method like a credit card or bank transfer. Money is sent to the fraudster’s account as soon as the seller inputs the PIN.
When utilising online sales platforms to buy or sell things, use caution at all times. Keep in mind that receiving money does not necessitate the use of a PIN or password. A PIN is required to conduct a transaction in UPI or any other app, which means you will be sending money rather than getting it.
4. Frauds due to the use of unknown/unverified mobile apps.
Fraudsters disseminate app URLs disguised to seem like legitimate ones via SMS, email, social media, instant messaging, and other means. Unknown or unverified programmes can be installed on customer’s mobile devices, laptops, and desktops by scammers who deceive customers into clicking on such links. The fraudster has full control of the victim’s smartphone after the fraudulent software has been downloaded. Messages and one-time passwords (OTPs) received before or after the app’s installation are examples of this type of private information.
You should never download an application from an unconfirmed source or a person you don’t know. Before installing, it’s a good idea to look out information on the app’s publishers and owners, as well as customer reviews and other feedback. You should always double-check the permissions and the data that an app wants access to before you install it. Make sure you only grant the permissions needed to run the programme you’re trying to utilise.
5. ATM card skimming
Skimming devices are placed in ATMs by fraudsters in order to obtain the cardholder’s personal information. To steal an ATM’s PIN, fraudsters can use a fake keypad or a pinhole camera that is hidden from view. When a consumer inputs their PIN into an ATM, scammers claiming to be another customer standing nearby may be able to get their hands on it. A replica card is made using the customer’s personal information, and funds are taken directly from their account.
6. Frauds using screen sharing app / Remote access
Screen sharing apps are used by fraudsters to dupe customers into downloading them. Fraudsters can monitor and take control of a customer’s mobile device or laptop, allowing them to access their financial information. They utilise this information to make payments or transfer funds through the customer’s Internet banking / payment applications without the customer’s permission.
7. Cloning or swapping SIM cards
Customer Subscriber Identity Module (SIM) card or electronic-SIM may be obtained by fraudsters who get access to the customer’s bank account-linked mobile phone number. It is possible for fraudsters to exploit the OTP obtained on a fake SIM card to make fraudulent transactions. Fraudsters often pose as a phone or mobile network employee and ask for the customer’s personal information in the name of an offer, such as a free upgrade of the customer’s SIM card from 3G to 4G or an additional benefit for the customer’s SIM card.
8. Compromise of credentials on search engine results to commit fraud
Customer care numbers and contact information for their bank, insurance business, Aadhaar update centre, etc. can all be found on search engines. These search engine contact information are frequently constructed to look as though they are from the actual company, but they are not. When customers use search engines to get bank or corporate contact information, they run the risk of calling unfamiliar or unconfirmed numbers belonging to scammers. When clients phone these contact numbers, the imposters ask for the customers’ card credentials / data to verify their identity. Customers fall susceptible to scams because they believe the scammer to be an official representative of the RE.
9. Scam through QR code scan
Forgers frequently contact consumers under a variety of guises in order to fool them into scanning Quick Response (QR) codes using applications on their phones. Customers may unwittingly authorise fraudsters to take money from their accounts by scanning such QR codes.
10. Impersonation on social media
Fraudsters utilise the personal information of social media users, such as Facebook, Instagram, Twitter, etc., to establish bogus accounts. As a result, scammers make a request to the user’s acquaintances, requesting money for medical bills or other urgent needs. Fraudsters can gradually acquire the trust of their victims by contacting them and providing them with false information. In order to blackmail or extort money from users, fraudsters exploit personal or private information that they get from the users.
Modus Operandi adopted for NBFC related Transactions
1. Fake advertisements for extending loans by fraudsters
Fake ads for personal loans with low interest rates, no collateral requirements, or simple repayment choices are common among con artists. Fake loan offers are sent to borrowers in emails that invite them to contact the scammers. Email addresses that appear to be those of well-known and legitimate Nonbank Financial Institutions (NBFIs) are used to entice unsuspecting borrowers and build trust (NBFCs). In the event that borrowers approach loan scammers, the fraudsters acquire money from the borrowers in the guise of different upfront costs like processing fees, GST, intercity charges, advance Equated Monthly Instalment (EMI), and so on, before ever releasing the funds. When individuals look for information on loans, fraudsters construct bogus website links to appear in search engine results.
2. Scams via text message, email, instant messaging, and phone calls
Fake communications about appealing loans are circulated in instant messaging applications, SMS, and social media platforms by fraudsters, who use the logo of any renowned NBFC as a profile image in the mobile number supplied by them to imply legitimacy. Aadhaar/Pan cards and bogus NBFC ID cards may even be shared by the con artists. The fraudsters then phone random persons and provide bogus sanction letters, copies of false checks, etc., and demand different costs after sending such mass messages, SMS, and emails. Once the borrowers have paid these fees, the scam artists have taken off with their money.
3. Frauds with One-Time Passwords (OTPs)
Fraudsters posing as NBFCs send SMS/messages to NBFC/bank clients, offering loans or increasing credit limits on their loan accounts, and asking them to contact them on a cellphone number. When clients contact these lines, scammers persuade them to complete out forms so that they may obtain their financial information. – Once the OTP or PIN data have been shared, the fraudsters use them to make illegal transfers from the clients’ accounts.
4. Fake loan websites / App frauds
Untrustworthy lending applications are created by con artists that promise quick cash. The debtors are deceived by these applications, which may potentially charge them exorbitant loan rates. Fraudsters advertise “limited time incentives” and pressure borrowers into making quick judgments in order to entice naive borrowers.
5. Fraud in money-circulation in multi-level marketing (MLM)
In order to lure unsuspecting victims, con artists employ MLM, Chain Marketing, and Pyramid Structure scams, all of which promise easy or rapid money in exchange for signing up new participants. To capture the trust of naive people and attract new investors through word of mouth marketing, the schemes promise great profits and pay the first few payments (EMIs). More individuals are encouraged to join the chain / organisation because of the schemes. The enroller receives commission not on the sale of things, but on the number of individuals who join the programme. Eventually, the model becomes unsustainable as the number of new participants declines. Afterwards, the fraudsters shut down the scam and walk away with their victims’ money.
Conclusion
The surge in the digital modes of payments witnessed in the past few years gained further momentum during the Covid-19 induced lockdowns. Digital payments enhance customer convenience by improving ease of doing financial transactions. They also contribute to promotion of financial inclusion. However, fraudsters are finding new ways to defraud the gullible public through various ingenious methods and therefore, it is important to understand their modus operandi in order to avoid getting duped by such tactics. In light of this, RBI released a booklet named ‘Beware’. The above held discussion summaries the modus operandi suggested by the RBI in its report.
[1] Beware, A booklet on Modus operandi of financial fraudsters, Office of the RBI ombudsman (2022), https://icmai.in/upload/BI/Booklet_RBI_2607_21.pdf.
Related Pos
TYPOSCAMS! PHISHING! TYPOSQUATTING in light of COVID-19 – Watch what you read!