x

Web Of Lies

Home »  Magazine »  Web Of Lies
Web Of Lies
Web Of Lies
Harsh Kumar - 28 June 2022

Imagine having Rs 1.27 crore in a cryptocurrency exchange, but not being able to withdraw it. Well, that’s exactly what has happened with a resident of Leh, who owns a family-diversified business and did not want to be named, and who is ostensibly a victim of a crypto fraud. He got lured into investing a hefty amount in a fake cryptocurrency exchange app through a “friend” (read Layers of Entrapment to know the details of his scary tale).

The case study throws up two main issues of how crypto frauds are being run in India—through fake websites, not necessarily of Indian origin, and entrapment, through individuals and/or masked organisations and their agents.

According to the 2022 Crypto Crime Report by Chainalysis, a Singapore-based Blockchain data platform, cryptocurrency-based crime hit a new all-time high in 2021, with illicit addresses receiving $14 billion over the course of the year, up from $7.8 billion in 2020. While there is no specific data for India, but some experts and reports indicate that crypto frauds are rampant. In 2021, Indian users visited crypto scam websites over 9.6 million times, according to the Chainalysis report. Some of the most visited fraudulent websites by Indians are coinpayu.com, adbtc.top, hackertyper.net, dualmine.com and coingain.app, which received about 4.6 million visits from Indian users.

The increase in the popularity of crypto investing among Indians, especially the millennials and the Gen Z, gives a peek into the scale of this trap. According to crypto industry estimates, the number of Indian users has crossed the 15 million mark. Further, the cryptocurrency market size is expected to grow from $1.6 billion in 2021 to $2.2 billion by 2026, at a compounded annualised growth rate (CAGR) of 7.1 per cent, according to a report by market research firm MarketsandMarkets Research.

Tactics Of Entrapment

Fake Websites: In April 2022, Adoni Mahesh, a 39-year-old businessman from Hyderabad was duped of Rs 80 lakh by fraudsters who allegedly operated a fake cryptocurrency exchange. He claimed that between December 2021 and April 2022, he invested in a crypto exchange whose URL ended with the extension “.ac.sh”. Mahesh had come to know about the exchange from a friend.

Mahesh lodged a complaint with the cybercrime unit. The Hyderabad police have now lodged a case under Sections 66-C and 66-D of the Information Technology Act, 2000 (IT Act), and Sections 419 and 420 of the Indian Penal Code against unidentified fraudsters for operating the fake exchange.

According to C.V. Anand, commissioner of police, Hyderabad, the modus operandi for fraudsters starts with creating fake websites.

Social Media Groups: Entrapment through social media groups on WhatsApp, Telegram and other platforms is another menace. Some common tricks include creating fake groups mimicking and using the logos of popular crypto exchanges, and using fake profiles of well-known persons. Scammers also create groups to pump-and-dump different cryptocurrencies, or try to gain access to the private keys of wallets on some pretext.

It usually starts with the victim getting an invitation to join a WhatsApp group, which has members discussing high returns. Eventually, the victim is also lured into investing. “In most of the cases, the fraudsters add the complainants to a WhatsApp group and lure the victims with the promise of high returns,” Anand says.  

He cites an example: One of the victims who reported the crime was added to a WhatsApp group, named ‘VIP 048’, by an unknown person. The victim noticed that people were earning high returns by investing through Binance, a crypto exchange. Later, the victim was sent a registration link, a user ID and other details to log in. The victim opened an account believing he was investing through Binance. This was a classic case of phishing, where fraudsters created a link and website that looked similar to the original Binance website, to capture the account details and other potential data of the user. Usually, the user realises later, sometimes after months, that there is no trace of the cryptocurrencies that he supposedly bought. Initially, the victim invested in 10 USDT and saw it doubling in a single day. “Later they lured the victim to invest in 1,000 USDT, and then more. Though the units increased on screen, withdrawal was not allowed. In this case, the victim lost a total of Rs 1.85 lakh. Another victim lost an amount of Rs 80 lakh in the same manner,” Anand adds.

In almost all the cases, the amount collected in the crypto wallet is impressive, but withdrawal is never a possibility.

Multi-Level Marketing: Some of the fraudsters also run crypto scams like ponzi schemes, wherein they identify gullible small investors, with little to no knowledge of financial instruments.

Not everyone can afford to buy a full unit of cryptocurrency. For instance, as on June 15, 2022, the price of a Bitcoin was around Rs 17.25 lakh, according to data from Giottus, a crypto exchange. These small investors do not realise that genuine cryptocurrency exchanges allow users to buy in minuscule fractions.

Fraudster usually promise them handsome returns to lure them. “They typically use multi-level marketing. The perpetrators usually identify small investors and ask them to subscribe to the scheme through a mobile app that charges a fee. They are told that these investments would give them 19-25 per cent return a month or around Rs 250-300 per day for every investment of Rs 15,000 per ticket of the transaction,” says Ramakrishna Srinivasan, founder and principal partner, Lex Genesis International Attorneys.

The money is collected using a payment gateway, and these accounts are usually connected to shell companies, which are not related to the identities of the actual perpetrators, adds Srinivasan.

Some of them also misuse the identity of Muslim investors in the name of “halal” investments. “They call investment in cryptocurrencies as a halal investment, as returns are generally seen as part of the profit and not as an interest component,” says Srinivasan.

The Fight Against Crypto Frauds

Though several people have lost lakhs of rupees in the last few years, a few experts we spoke to said that India seems to be on a sticky wicket in the fight against crypto frauds. One of the biggest challenges is the source of these frauds. as in a lot of cases, they are based abroad. Besides, law enforcers do not have the requisite infrastructure and there is absence of regulation and relevant laws, too.

Tracking Is A Challenge: The big problem is tracking, as most of the service providers and crypto exchanges are based abroad. Also, while local exchange cooperate with the investigations and share relevant data, that’s not always the case with foreign exchanges. “There is no response from them (most of the times) and the investigation ends without any clues in many cases,” says Anand.

“Indian exchanges share data and cooperate with us when we investigate crypto-related crimes, but many foreign exchanges hesitate in giving details, which makes it difficult for us to investigate,” says Bhagyashri Navtake, deputy commissioner of police, Pune Cyber Cell.

Lack Of Knowhow And Infrastructure: The cyber cells of various states are slowly learning the ropes, but there is a lot of ground to be covered.

“There is less knowledge about the tools (through which crypto wallets can be traced). Also, these tools are very costly,” says Navtake.

Uttarakhand Police says it conducts regular trainings, and is also purchasing new tools and software to deal with the menace. “Also, we have annual events like cyber hackathons to find new innovative solutions,” says Ankush Mishra, assistant commissioner of police, Uttarakhand Police.

The Uttar Pradesh police, however, seems to have found a way through outsourcing. “To follow such cases, we are now getting help from some companies which provide us with tools to trace them,” says Triveni Singh, superintendent of police, Uttar Pradesh Cyber Crime unit, who refused to give out the names of these companies.

Lack Of Regulation: The fact that India does not have a regulator for the crypto industry poses challenges. “The fact is cryptos are not receiving the kind of attention or importance. In India, we still have the mindset of closing our eyes when it’s mid-noon and expecting that it’s midnight. That mindset has to change and we have to come to the pragmatic realisation that crypto assets and cryptocurrencies are a reality and will stay so in the future,” says Pavan Duggal, a practising advocate at the Supreme Court and chairman, International Commission on Cyber Security Law.

Absence Of Relevant Laws: Both lawyers and law enforcement agencies believe that the existing IT Act is insufficient. “I don’t think the existing cyber law provisions are sufficient to deal with the rising cases of crypto crimes. The reason is that the Indian Information Technology Act, 2000, is old. In 2000, cryptos were not even born. The Act was amended once in 2008, when the early pages of crypto history were being written, but the amendments did not really have futuristic provisions. So today, if you’re looking at any crypto-related crimes, the requisite provisions are missing. Now, the government is trying to bring in secondary legislation to deal with it (crypto frauds problem),” says Duggal.

He says crypto crimes need to be specifically covered and mentioned either under the Indian Penal Code or under the Immigration Directorate or IDI (the government department responsible for laws regarding immigrants and immigration).

Sandeep Shukla, a professor of Computer Science and Engineering at IIT-Kanpur, and co-director of the National Blockchain Project, agrees that India needs a strong law to control crypto crimes.

“We need strong regulation and regulatory supervision over the entire crypto industry. If that’s not done in time, we will see precipitation of a financial crisis when a largescale hack of a large exchange happens, or a very large number of ‘greater fools’ succumb to the allure of crypto, but do not get out in time, leading to a financial crisis of its own kind,” he says.

A lot of experts are still of the vieww  that cryptocurrencies are not viable investing instruments, especially in the absence of regulation and relevant laws. “The fact that it is so complex for regulators or law enforcement agencies to do much, it is best to avoid crypto as an investment vehicle,” Shukla adds.

But those who are unwilling to heed such advice should tread with care and do their due diligence before investing via any website or app.

***

Layers Of Entrapment

Four years ago, a 32-year-old resident of Leh befriended a tourist  who  claimed  to  be from Hong Kong. After about  three  years  of  interaction on social media and taking holidays together, she told him about a cryptocurrency trading app, http://ubst.cc, which had helped her make huge gains. She showed him some screenshots to support her claim, and recommended that he should try it too. It didn’t take him much time to get convinced.

He downloaded the app in 2021 and transferred Tether (USDT) to the app’s wallet address, using Binance, one of the world’s largest crypto exchanges, as the app didn’t accept direct debits from India. Initially, he bought USDT worth a few thousand rupees. Eventually, he started investing more, at one point on a daily basis. This continued for about six months or so.

Trouble started somewhere in May 2022, when he realised his balance has grown to $1,59,508 or about Rs 1.27 crore and tried to withdraw his money. Since USDT is a stable coin, it can be assumed that the return portion in the sum must be nil or measly. The website blocked the amount, asking him to deposit a crypto tax of 30,000 USDT, which is equivalent to $30,000 in fiat currency. He found that odd and got in touch with his tourist friend, who assured him and even deposited USDT worth $5,000 in his wallet address to help him out. He also called the NSDL tax cell, which advised him to pay as per the law and didn’t go into his individual case. The Leh resident deposited another 15,000 USDT towards tax, but has been unable to arrange the rest.

At this point, he got in touch with this Outlook Money correspondent and tried to contact the customer support of ubst.cc. He was given the address of UBS Bank in Switzerland, which has no link with the app, and a Gmail address that doesn’t work. The correspondent realised that the website does not have any kind of cyber protection such as SSL certificate, https address, etc. The Leh resident is yet to file an FIR in the case.

 By Neelanjit Das


harsh@outlookindia.com

Is It The Fag End Of The Crypto Party?
DIY: Guide To File Your ITR