Smoke & Mirrors: Scammed And Scarred, How Seniors Navigate Cyber Traps

The 2020 movie, I Care A Lot, is a grisly tale of a ruthless professional exploiting senior citizens to siphon off their wealth. At the heart of this black comedy-cum-thriller is the vulnerability of senior citizens to frauds, which can lead to financial destitution and trauma for the victims and can affect their relatives, too, in complicated ways.

The movie is a work of fiction, but cases of fraud and cheating with senior citizens as victims are all too common in real life, too.

According to data from the National Crime Records Bureau report of 2022, forgery, cheating and fraud (FCF) constitute 11 per cent of the crimes committed against senior citizens. Maharashtra, Telangana and Karnataka are among the top three states in terms of the number of FCF crimes against senior citizens.

A recent survey by Netrika Consulting India Pvt. Ltd, a Gurgaon-based cybersecurity and risk management firm, highlights that India is among the top five countries in cybercrime. The second edition of its cybersecurity preparedness survey released in February 2023, quoting data from the Indian Computer Emergency Response Team (CERT-In), reported that a staggering 1.40 million cybersecurity-related incidents occurred in 2021 alone. Another report of Microsoft’s Global Tech Support Scam Research in 2021 estimated that India accounted for 31 per cent of the total money lost in tech-support scams globally in that year, compared to 18 per cent in 2018.

“Losses from online fraud in India are estimated to be of billions of dollars annually. This mind-boggling loot is a grim reminder that scammers may strike anytime and even succeed in escaping the police net. Although banks have begun a two-way verification involving one-time passwords (OTPs) to access bank accounts, which afford some safeguards, it has complicated the lives of senior citizens,” says advocate Jesse Cornelius, a cybercrime specialist at Lexicon Law Partners.

In the end, it’s a saga of vulnerability and deep emotional scars with fraudsters becoming innovative and coming up with new tricks to con, and law enforcement agencies unable to keep up with the changes.

Mesh Of Manipulation…

Increasing loneliness, the need for emotional support, gullible disposition, and lack of awareness are some of the common reasons why senior citizens fall prey to frauds, according to various experts.

“While official statistics do not indicate that older people are at an increased risk of online financial crime, among certain groups of older people, there is an increased risk due to a combination of factors, such as low familiarity with technology, isolation, and/or cognitive impairment,” according to a research carried out by the Dawes Centre for Future Crime at University College London (UCL).

According to Sushil Kumar, Superintendent of Police, Nodal Cyber Cell, Bihar, women and older people are common targets of online scams. “Cybercriminals most frequently target this susceptible group, and they commonly perpetrate crimes in the late evening or early morning hours when individuals are not likely to use their phones,” he says.

What makes them even more vulnerable is that most of them are sitting on huge retirement corpuses. “They can have large deposits in banks in the form of retirement funds, which makes them an easy target for organised crime,” says Kartikeya Tripathi, assistant professor at the Department of Crime and Security Science at UCL, who has a body of research on seniors and cybercrime.

Loneliness is real in old age—there’s no professional life to look forward to, children move out of home to work in other cities or countries abroad, and, in some cases, even the spouse passes away. Fraudsters prey on this aspect. “Senior citizens use Facebook and WhatsApp a lot. There are innumerable cases where they get friendship requests on these platforms. The fraudsters, typically, try and establish an emotional connect with them. These people usually pose as younger, from the opposite sex and as being settled abroad. Once that happens, there are various ways to extort money from them,” says Anyesh Roy, former Deputy Commissioner of Police, Cyber Prevention Awareness Detection (CyPAD), a specialised unit of Delhi Police, and currently, DCP, Economic Offence Wing, Delhi Police.

He explains the modus operandi through an example. Say, the victim is 60 years old; the fraudster will pose as someone in their 30s or 40s, and would reach a point of friendship, where they would volunteer to help the victim financially. They would offer to send money, even if the victim protests. In some days, the victim would get a call from, say, the customs department, saying there’s an illegal stash of money that has landed in their name, and they would have to pay a penalty. “They will then get caught in a web of lies, where different fake officials from different departments, such as income tax, foreign exchange, etc. will call them, and keep demanding money for different purposes, all to patch the legal issue they have purportedly fallen into,” says Roy.

There are cases where people have lost Rs 70 lakh and more to such cases. But what makes them keep on paying? It’s something called ‘escalation of commitment’, he explains. It’s a behavioural pattern where the victim continues to take irrational decisions, despite negative outcomes, to justify earlier decisions and actions, and in the false hops of finding a solution at the end of the road.

There are several cases of extortion, too, which begin from establishing an emotion connect on WhatsApp. “In such cases, after earning the victim’s trust, they may prompt for video calls and record the person in a compromising position. It’s usually very sophisticated and is called sexual extortion,” says Roy. This too escalates into fake calls from the police etc. ending into a never-ending demand for money.

Gullibility to false promises and assurances also works against the victims. Sandeep Kumar (name changed), 65, a Delhi-based retired professional who spoke to Outlook Money on the condition of anonymity, ended up depositing several tranches of money in a bank account. “He used to get calls from different numbers, who would promise him big returns if he deposited money in a particular account. He thought he will make profit and leave a legacy for his children and grandchildren, and was totally convinced by the callers despite us telling him not to heed to such calls,” says his daughter, who teaches at a college in Delhi University.

When such gullibility is combined with a fake financial emergency situation and an authority figure, the problem gets compounded. “Senior citizens are more trusting of supposed figures of authority (for example, getting a call from someone pretending to be a bank officer),” says Tripathi.

Grirish Macwan, 64, a retired engineer, who lives in Pune’s Pimpri-Chinchwad area with his wife Sudha, got duped of Rs 1.23 lakh in a phishing scam in January 2023. “It was around 12.20 pm during the day and I was busy with my daily prayers. My wife attends the calls during my prayer. The caller told my wife that we had not paid the electricity bills, so the power supply will be disconnected. My wife pleaded with him and promised to pay the bills at the earliest. Then, the caller said, to avoid disconnection, she should click the link he had sent and share the OTP, which she did, thinking the executive was helping her,” says Girish, whose son is settled in the US.

The fraudster used Girish’s Netbanking facility and created an overdraft against his bank fixed deposit. “I immediately contacted the bank and blocked all my accounts or else it could have cost me more money,” he adds.

He has lodged a complaint with the local cyber-crime unit, but no money has been recovered so far.

A barrage of text messages and calls also flummoxes senior citizens who may not be tech-savvy. It often purplexes them and drives them to make incorrect decisions. “Senior citizens are not well equipped to deal with the sudden boom in technology, nor are they tech-savvy with their mobile phones. Therefore, they find it difficult to do banking either on the Internet or through mobile devices,” says Cornelius.

Recently, several HDFC Bank customers received messages prompting them to update their know-your-customer (KYC) information, failing which they would lose access to their bank accounts. The scammers sent them masked web links which would have hacked into customers’ sensitive data if clicked. These are followed up by voice calls that prompt them to share OTPs. Armed with all the information, “they hack their mobile phone and change the password and other details, and transfer all their savings to a different account”, says Cornelius. Similar tactics can be used to access debit and credit card accounts, and Netbanking facility.

Another problem is newer ways of fraud. In the second season of the Netflix series, Jamtara: Sabka Number Ayega, protagonists Sunny and Gudiya devise a new plan to make money to fund the elections.

Says Sanjay Kaushik, managing director of Netrika Consulting: “Fraudsters keep innovating new ways to defraud people. We have seen educated folks or even bankers falling to the tricks of these fraudsters. They always seem to be two steps ahead of the curve. Most of the times senior citizens are not aware of new techniques of cyber frauds.”

Moreover, newer sites of fraud are fast developing. Kumar says there are many hotspots in Bihar apart from Jamtara. These cyber hotspots operate from five districts of Bihar—Navada, Nalanda, Gaya, Shekhpura and Patna.

Mumbai-based Ramesh Kulkarni (name changed), 59, who has been a stockbroker for nearly 30 years, was defrauded of nearly Rs 20 lakh in an online scam in June 2022.

The fraudster lured him into believing that he was interacting with a Citibank customer care executive from the Diners Club International desk offering him a credit card with enhanced limits, cashbacks and free global access to airport lounges. Initially, Ramesh had doubts as he knew that CitiBank was planning to exit India, but the crook got the better of him as he already had access to a lot of his financial details, such as transaction history, address etc. Also, since Ramesh often travels abroad, he thought the card would come handy.

It turned out to be an elaborate scheme. As part of the plan, the fraudster sent him a new phone. Once Ramesh inserted his SIM into the new phone, the data got hacked. “The phone was used before and doctored; it had a TeamViewer kind of app preinstalled. So, when I inserted the SIM, the menu was instantly ready for use, unlike the new phones, where you are asked to follow a few verification processes before the functions are available,” he says.

“I am quite conscious about such things because I have been doing all kinds of financial transactions all my life. But as you grow older, you start trusting people. The fault was largely mine, as I gave away my credentials.”

…Leads To Deadends

In a lot of these cases, the money goes unrecovered despite victims going through a web of processes and multiple institutions, from the financial institution to the police, to legal authorities.

The first place to go to is of course your bank or financial institution, or the e-commerce website or platform where the fraud has occurred. “As per the Reserve Bank of India (RBI) rules, if illegal transactions are reported immediately, the bank will pay back the lost amount, if there is no fault with the account holder,” says Cornelius.

When Ramesh finally realised he had lost money and called the customer care, it was too late. As per RBI guidelines, the entire process was authenticated by OTPs, so the bank couldn’t help block the funds.

“This guy had tons of my financial information, yet the OTP and card details stolen from the phone are not their problem. At the end of the day, the bank has to take some culpability for this fraud, because that couldn’t have been done without the cooperation of someone in the bank,” alleges Ramesh.

But for all other cases of impersonation, extortion, cheating, forgery or fraud, which lead to financial loss, the next recourse is to go to the police, says Roy.

Ramesh lodged a complaint with the police cyber cell in Mumbai, but he was asked to register a dispute with the bank. The bank refused to enter a dispute initially, saying it was authenticated through an OTP.

That was just the start of a long-drawn battle for justice, during which Ramesh ran from pillar to post, contacted several top Citibank officials in India and abroad, exchanged numerous emails with the bank, consulted lawyers, and made multiple visits to the police cyber cell, but to no avail.

While several arrests occurred during the police investigation, the masterminds remained scot-free, says Ramesh. Meanwhile, after three months, the bank informed him that it found no dispute in its internal enquiry. By then, Ramesh was fed up with the situation because of the constant follow-ups with the lawyers and the police. He decided to settle the dispute on his credit card by paying the bank.

The experience left Ramesh in deep shock and a state of helplessness that a cybercrime victim could be left with limited or no recourse to salvage the losses after a fraud.

While no fixed timeline can be laid down, the cybercrime cells of local police do take immediate action, say experts. “It is important to remember that cybercrime is one of the toughest crimes to be solved due to the challenges faced, such as underreporting, the jurisdiction of the crime, public unawareness, and the increasing costs of investigation due to technology,” says Kaushik.

Law enforcers clarify that closing such cases is very difficult. “They are technologically resolvable, as everything online has a trail and record, and can be traced. The problem arises when a foreign entity is involved; then getting the details becomes challenging. Data collection is also a challenge when multiple platforms are involved. Sometimes, it becomes difficult to reach the end beneficiary. It can be a very time-consuming process with many dead-ends, which can be demotivating,” says Roy.

Kaushik, however, adds that the requisite number of police personnel are not dedicated to this, even though the number of cybercrime cases are rising. “We hardly see cases getting solved, until it is either a large case, or the media is giving some attention to it, or the fraud has happened with some influential person,” says Kaushik.

Advocate Prashant Mali, Cyber Law and Privacy Expert Lawyer at the Bombay High Court, says the government and the police are unable to comprehend or act in a decisive manner to give justice to senior people. “What can perhaps help is further strengthening of the KYC process, especially of SIM card issuance, as mobile phones are often used for frauds,” says Kaushik.

…And A Lifetime Of Scars

Instances of fraud and the associated struggle don’t just cause financial damage, but can also leave deep emotional scars, especially among senior citizens.

A 2021 publication of Canada-based Western University, What Do We Know About Senior Citizens As Cybervictims? A Rapid Evidence Synthesis, written by Laura Huey and Lorna Ferguson, draws upon the work of Tripathi and others. The paper says: “They found that frauds had caused significant financial and emotional impacts. Some victims had lost retirement funds and monies set aside for health and other emergencies. These losses, and a lack of supportive responses from police and banks, led to persistent and unresolved feelings of shame, depression, and anxiety. Thus, there appears to be some psychological impacts resulting from Internet-based victimisation for seniors.”

Tripathi adds to that while interacting with Outlook Money. “Senior citizens are affected far more negatively by online fraud than younger victims. They have a deep and lingering sense of shame and loss of trust and unwillingness to talk about their victimisation. All this can lead to depression and mental health issues that can last long after the victimisation. There’s an impact on physical health, including hospitalisation, too,” he says, adding that it can lead to further isolation.

But what has also been observed is the unwillingness to report a crime by senior citizens, especially when it comes to cases of sextortion and others. Ramesh feels horrified that he was a victim of such an elaborate scam despite being aware of such things. It took a toll on his physical and mention health, he shares.

The Western University paper says, “…Tripathi and colleagues’ (2019) exploration of victim experiences of online fraud in India, including having to navigate challenging reporting processes instituted by police and banks. Through interviews with seniors who had been defrauded online, the researchers observed that victims spoke of their frustrations over significant delays in their ability to report events to local police and have their reports taken seriously. Similar obstacles were reported by victims who attempted to notify banks of fraudulent activity.”

What Should You Do?

The government is doing a lot of work on spreading awareness. It’s important to keep yourselves updated. For instance, RBI has been making significant efforts to increase public awareness on cybersecurity through campaigns, such as “Kahta Hai” and “Paisa Bolta Hai”. As part of its cybersecurity framework, RBI has requested banks to publish newspaper advertisements and publish “do’s and don’ts” on their websites. Banks also need to send messages about cybersecurity to customers along with a statement of accounts, either physical or online, and through SMS.

Banks routinely send messages to all customers, including senior citizens, warning them not to respond to any weblinks or messages seeking KYC updates or asking them to reveal their bank accounts details and passwords. Still it doesn’t seem to be enough. “A lot still needs to be done I think. We haven’t even achieved 30 per cent, when it comes to the work on awareness,” says Mali. Moreover, the law is common for all and there’s nothing specific for senior citizens.

Keeping that in mind, a lot of the responsibility lies at the doors of the seniors themselves.

While banks still allow seniors to visit bank branches, it is essential for them to take the next step and learn about Internet banking and other digital transactions, if they are not already familiar, as that is the way forward towards enhanced financial security.

Fraudsters are becoming innovative and coming up with new tricks. Therefore, senior citizens also need to keep abreast with the changes, either by themselves or by seeking help from others, and be wary of sharing any sensitive details with strangers or friends they don’t know properly (see Dos and Don’t’s).

“Senior citizens should exercise utmost caution in responding to any messages asking for KYC or passwords especially in the middle of the night, and even generally. Additionally, they should keep their respective bank’s helpline number, as also the Cyber Crime Cell’s telephone numbers handy in case they fall victim to such type of banking-related cybercrime,” says Cornelius.

It’s also important to rely upon family, friends and loved ones for support. If your children are not living in the same city, seek out the children of family members or trustworthy friends to check the basics. “Rely on trustworthy family members and friends to negotiate cyberspace safely,” advises Tripathi.

Remember that self-blame won’t solve anything. If you’ve had a bad experience, speak out; it may help others learn a lesson from your experience. Even family members need to be sensitive to the seniors to ensure they speak freely. “Do not blame them for the loss. Recognise that they have been victims of a crime and they deserve your support,” says Tripathi.

Technology has opened new doors, but has also introduced new risks for people, including senior citizens. For senior citizens, it becomes essential to  tread with care and seek help whenever needed.

Nidhi Sinha with Sanjeeb Baruah and Kundan Kishore

nidhi@outlookindia.com