AI Scams in 2026–2027: Deepfake Voice Cloning, Fake Video Calls, Digital Arrest, UPI Fraud & How to Protect Yourself

Attackers synthesize the voice of a son, daughter, grandchild, or spouse using a 5-second social media clip. They call parents or grandparents claiming an urgent catastrophe (road accident, arrest, hospital ICU, gang hostage) demanding immediate cash transfer.

1. Criminals harvest a sample of the victim’s relative’s voice from Instagram Reels, TikTok, YouTube, or voicemail.
2. They research family ties on social media to identify elderly relatives who live in a different city or country.
3. Using a voice-cloning engine, they generate a distress call with crying, sobbing, and muffled background sounds.
4. A fake lawyer, police inspector, or doctor takes the phone, claiming money must be sent immediately via UPI, wire transfer, or crypto to avoid prison or save a life.

• ✕Extreme urgency demanding immediate wire transfer or UPI within 10–15 minutes.
• ✕The caller explicitly forbids hanging up, calling other family members, or verifying.
• ✕The call originates from an unknown number, international VoIP, or private number, claiming the relative’s phone is broken or seized.
• ✕The voice clone quickly hands the phone to an "officer", "attorney", or "doctor" to prevent extended back-and-forth conversation.
• ✕Request for payment to personal UPI handles, mule bank accounts, cryptocurrency wallets, or gift cards.

• ✓Ask the caller for your pre-established Family Emergency Secret Codeword. If they cannot answer or deflect, hang up immediately.
• ✓Ask a hyper-specific offline question that cannot be scraped online: "What is your third-grade teacher's name?" or "What color sweater did grandma gift you last Diwali?"
• ✓Immediately hang up the incoming call and dial your relative on their established, regular phone number via direct cellular line (not WhatsApp/internet call).
• ✓Call their roommate, university warden, college department, or spouse to cross-verify physical whereabouts.

• 🔒Set up an offline Family Emergency Codeword with all immediate family members today. Never write it in email, cloud notes, or WhatsApp chats.
• 🔒Make social media profiles private; avoid public reels with unedited, high-clarity solo voice narration.
• 🔒Instruct elderly parents and grandparents: Any emergency call demanding money must trigger an immediate second-channel verification call before any rupee or dollar is sent.

• !Immediately call 1930 (National Cyber Crime Helpline in India) within the 1-hour Golden Hour to initiate recipient account freeze on CFCFRMS.
• !Contact your sending bank fraud desk to report an unauthorized/coerced transaction and request a recall request (Lien mark).
• !Lodge a formal complaint on cybercrime.gov.in with bank statement, UPI UTR numbers, call logs, and phone recordings.
• !Notify your telecom operator and lodge a report with your local police station cyber cell.

Criminals deploy real-time facial puppetry software inside video call platforms (Skype, Zoom, WhatsApp Web, Teams) to impersonate relatives asking for urgent financial assistance or senior corporate executives commanding urgent wire transfers.

1. Scammers compile dozens of high-resolution facial images of an executive or family member from interviews, webinars, or social media.
2. A real-time deepfake pipeline (e.g. video face swap) streams the animated face into a virtual camera input during a scheduled or sudden video call.
3. The call is kept intentionally brief (under 60 seconds), citing bad network connectivity or sudden meetings, before asking the victim to complete an urgent payment.

• ✕Short call duration: The caller disconnects abruptly or insists on switching back to text after briefly showing their face.
• ✕Visual artifacts: Glitching around the jawline, unnatural or nonexistent eye blinking, teeth appearing as a solid white mass, blurriness when a hand passes in front of the face.
• ✕Audio-video desynchronization: Lip movements slightly lag behind the spoken syllables.
• ✕Bypassing established enterprise procurement workflows or family consultation.

• ✓Instruct the caller to perform physical live tests: "Turn your face 90 degrees sideways", "Wave your hand back and forth across your nose", or "Touch your chin". Real-time deepfake algorithms heavily distort and glitch when occluded by hands or extreme angles.
• ✓Terminate the video call and dial the executive or relative back on their verified enterprise telephone extension or encrypted enterprise line.
• ✓Require dual-custody authorization for all wire transfers above established monetary thresholds.

• 🔒Institute a strict corporate policy: Video calls alone never authorize financial disbursement or banking coordinate changes without independent out-of-band verification.
• 🔒Disable external meeting joins without secondary domain authentication.
• 🔒Train employees to recognize deepfake edge warping, unnatural lighting contrasts between the face and neck, and metallic audio compression.

• !Notify corporate IT Security and Financial Treasury immediately to initiate SWIFT / wire recall.
• !Contact beneficiary bank compliance and anti-money laundering (AML) units to freeze recipient funds.
• !Lodge an enterprise cyber incident report with CERT-In (cert-in.org.in) within mandatory reporting timelines.
• !File a formal report on cybercrime.gov.in and with the jurisdictional police commissionerate cyber crime wing.

Criminals impersonate police officers, CBI, ED, Narcotics Control Bureau (NCB), Telecom Regulatory Authority of India (TRAI), or Customs officials over Skype or WhatsApp video calls. They claim an illegal parcel containing narcotics or passports was intercepted in your name, placing you under a completely fake "Digital Arrest" and extorting your life savings.

1. The victim receives an automated IVR call claiming their mobile number, Aadhaar, or FedEx parcel is linked to terror financing, money laundering, or illegal contraband.
2. The call transfers to a fake police inspector seated in a staged studio looking like a real police station with state insignia, uniforms, and walkie-talkies.
3. The scammer shows fake Supreme Court arrest warrants, CBI seal letters, or RBI seizure orders with the victim’s Aadhaar number.
4. They claim the victim is under "Digital Arrest" and must remain on camera 24/7 without contacting anyone, or face immediate SWAT raid.
5. They instruct the victim to liquidate mutual funds, fixed deposits, and bank accounts, transferring the funds to a "Government Safe Reserve Account" for "RBI financial verification", promising refund within 48 hours.

• ✕THE BIGGEST FACT: "Digital Arrest" DOES NOT EXIST under Indian law or any international legal system. Neither the Supreme Court, CBI, Police, ED, Customs, nor NIA ever conducts arrests, interrogations, or trials over video calls.
• ✕Demands that you stay on video call continuously, sleep with the camera on, and keep it secret from family or lawyers.
• ✕Display of forged government letters, "CBI Investigation Notice", or fake Supreme Court emblems sent via WhatsApp or Skype.
• ✕Demands that you transfer your personal savings to a "secure government account", "RBI escrow", or "verification account". Government agencies NEVER accept money transfers to clear criminal cases.

• ✓Disconnect the call immediately. You are not under arrest, and nobody is raiding your house.
• ✓Visit your nearest local police station in person with the phone number and explain the call.
• ✓Dial the National Cyber Helpline 1930 or 112 (National Emergency Helpline in India) to report the extortion attempt.
• ✓Report the suspicious phone numbers and WhatsApp profiles to the Government Chakshu facility on Sanchar Saathi (sancharsaathi.gov.in).

• 🔒Remember the cardinal rule: No law enforcement agency in the world settles criminal cases or conducts arrests over Skype or WhatsApp video.
• 🔒Never disclose Aadhaar, PAN, bank account details, or passport numbers to unsolicited callers claiming to be courier or telecom companies.
• 🔒Educate senior citizens, retired professionals, and homemakers about the fake "Digital Arrest" modus operandi.

• !If money was transferred, immediately dial 1930 within the Golden Hour to initiate recipient account freeze.
• !Immediately file a comprehensive cybercrime report on cybercrime.gov.in attaching all fake letters, Skype IDs, and bank account numbers provided by the scammers.
• !Visit your local police station cyber cell and submit a physical complaint with UTR transaction slips.
• !Alert your bank manager in writing to dispute the transfer as extortion under duress.

Criminal syndicates produce deepfake videos of prominent business leaders (e.g. Mukesh Ambani, Narayana Murthy, Elon Musk), news anchors, or ministers promoting automated AI trading platforms, fake stock IPO allocations, or crypto arbitrage schemes.

1. Attackers download authentic broadcast news clips or business interviews.
2. Using lip-syncing neural models and synthetic voice cloning, they alter the speech so the celebrity appears to praise a "revolutionary AI trading software with guaranteed 300% monthly returns."
3. The deepfake video is launched as a sponsored advertisement on Facebook, Instagram, YouTube, and X.
4. Victims clicking the ad are led to cloned news websites (mimicking The Times of India, NDTV, BBC, or Forbes) with a sign-up form.
5. Victims are added to private WhatsApp or Telegram "VIP Wealth Circles" where fake dashboards show soaring profits, coaxing them into depositing tens of lakhs before blocking all withdrawals.

• ✕Celebrities, industrialists, or political leaders supposedly guaranteeing risk-free, astronomical returns on trading apps.
• ✕Unnatural lip sync and minor robotic glitching around the speaker’s mouth in the video.
• ✕Articles hosted on random URLs that look like reputable news sites (e.g., `times-finance-daily-news.online` instead of `timesofindia.indiatimes.com`).
• ✕Pressure to communicate exclusively over WhatsApp or Telegram investment groups.
• ✕Demands for "advance tax", "processing fees", or "security deposits" to withdraw your own money.

• ✓Verify with regulatory registries: In India, all legitimate stock brokers, portfolio managers, and investment advisers MUST be registered with SEBI (sebi.gov.in). Check the SEBI Intermediaries Database.
• ✓In the US, verify with the SEC Action Lookup (sec.gov) or FINRA BrokerCheck (brokercheck.finra.org).
• ✓Cross-check the supposed news story on the authentic news outlet’s official website or YouTube channel.

• 🔒Never trust any video ad claiming guaranteed returns or secret trading bots, regardless of whose face is on screen.
• 🔒Never transfer investment capital into individual personal savings bank accounts or third-party proprietary UPI IDs.
• 🔒Report fraudulent ads directly to the social media platform and to SEBI SCORES (scores.sebi.gov.in).

• !Immediately cease sending any further money (never pay "tax" or "withdrawal clearance fees").
• !Dial 1930 and lodge a complaint on cybercrime.gov.in citing the fake investment syndicate and recipient bank accounts.
• !File an investor fraud complaint on SEBI SCORES portal (scores.sebi.gov.in).
• !Preserve all WhatsApp/Telegram chat exports, payment slips, and web screenshots for police investigation.

Scammers buy Google Search sponsored ads and manipulate search results so that when users search for helpline numbers of airlines, banks, courier services (Blue Dart, DTDC), or food delivery apps (Swiggy, Zomato), the scammer’s fake number appears at the top. When called, scammers use AI interactive scripts to steal money via remote access or UPI.

1. Fraudsters create fake websites and Google Ads targeting search queries like "SBI customer care number", "IndiGo refund helpline", or "Amazon courier delivery problem number".
2. When the victim calls, an AI IVR or professional scammer answers pretending to be customer support.
3. They claim your refund or package is stuck and instruct you to download an app (AnyDesk, TeamViewer, RustDesk) or enter a UPI transfer to "verify your identity".

• ✕Customer care numbers listed as personal 10-digit mobile numbers (+91-9xxxxxxxxx) rather than verified 1800 toll-free numbers or official app portals.
• ✕Customer care asking you to install remote desktop apps (AnyDesk, TeamViewer, RustDesk) on your phone.
• ✕Customer care asking you to enter your UPI PIN, scan a QR code, or approve a collect request to RECEIVE money.
• ✕Customer care asking for full debit card numbers, CVV, or net banking OTP.

• ✓NEVER search for customer care numbers on Google, social media, or forum comments. Access customer support EXCLUSIVELY through the official installed mobile app or the official bookmarked website.
• ✓Verify bank customer care numbers on the back of your physical ATM / debit card.
• ✓Legitimate companies never use personal Gmail/Yahoo addresses or direct WhatsApp chats for customer resolution.

• 🔒Bookmark official support pages for your primary bank, airline, and shopping portals.
• 🔒Install an ad-blocker or avoid clicking "Sponsored" results when searching for service hotlines.
• 🔒Never install screen-sharing software at the behest of any unsolicited or search-result caller.

• !If a remote app was installed, immediately turn on Airplane Mode, uninstall the remote access app, and disconnect Wi-Fi.
• !Call your bank immediately from another device to freeze your net banking, debit cards, and UPI access.
• !Call 1930 and file a complaint on cybercrime.gov.in.
• !Factory reset your phone if you suspect malware or keyloggers were installed during the remote session.

Scammers exploit the common misconception that entering a UPI PIN is required to receive money. They pose as buyers on OLX, Facebook Marketplace, or rental portals and send a UPI "Collect Request" disguised as a payment confirmation.

1. The scammer contacts a seller on an online marketplace (OLX, Quikr, Facebook Marketplace) showing extreme eagerness to buy an item without negotiation.
2. They claim: "I am sending you the payment via Google Pay / PhonePe / Paytm."
3. Instead of sending money, the scammer initiates a "Collect Request" (Pull Transaction) from their UPI app to the victim's VPA/phone number.
4. The notification says: "XYZ has requested ₹15,000 from you. Enter UPI PIN to approve."
5. The moment the victim enters their UPI PIN thinking they are accepting funds, the money is instantly deducted from their bank account.

• ✕THE GOLDEN NPCI RULE: Entering your UPI PIN is NEVER required to receive money. UPI PIN is used EXCLUSIVELY to debit money from your bank account or check your account balance.
• ✕Buyer is overly eager, does not negotiate, and insists on paying before seeing the product in person.
• ✕Claims to be an "Army Officer", "CISF Personnel", or "Police Officer" using forged military ID cards as a trust badge.
• ✕Receiving a notification with the word "COLLECT", "REQUEST", or "PAY" when you are expecting to receive funds.

• ✓Check your official bank SMS or open your banking app independently to see if your account balance has actually increased.
• ✓Never trust screenshots sent by the other party showing "Transfer Successful"—these are easily fabricated using dummy UPI receipt generator apps.
• ✓Refuse all electronic payments from unverified online buyers; demand cash on delivery or instant in-person UPI after inspecting the item.

• 🔒Memorize and teach everyone in your family: "PIN is for SENDING money. If you type your PIN, money leaves your pocket."
• 🔒Decline and report any suspicious "Collect Requests" received on PhonePe, Google Pay, or Paytm.
• 🔒Never conduct business with buyers who refuse phone calls or insist on strange payment gateway links.

• !Act within the Golden Hour: Dial 1930 immediately with the transaction reference / UTR number from your bank SMS.
• !Block the scammer's UPI ID and mobile number in your payment app and report it as fraud inside PhonePe / Google Pay / Paytm.
• !File an official report on cybercrime.gov.in under "Financial Fraud - UPI/Net Banking".
• !Contact your home bank branch to submit a formal written dispute and request recipient bank lien placement.

Criminals tamper with physical merchant QR codes in retail stores or send malicious QR codes via WhatsApp/SMS claiming scanning the QR will deposit a prize, lottery, cashback, or electricity bill refund.

1. Physical Tampering: Scammers paste fraudulent QR code stickers over genuine shopkeeper QR standees (merchant quishing) to divert customer payments.
2. Digital Quishing: Scammers send an image of a QR code via WhatsApp with text like "Scan this QR code to claim your ₹3,500 electricity subsidy refund" or "Scan to receive payment for your marketplace product."
3. When scanned with a camera or payment app, the QR code redirects to an automated intent link that triggers a debit payment or opens a phishing credential harvester.

• ✕Scanning a QR code opens a screen prompting you to "Pay" or "Enter UPI PIN". (Scanning a QR code NEVER deposits money into your account).
• ✕Physical merchant QR code stands that show signs of bubbling, double-layering, peeling, or misalignment.
• ✕Any QR code received via email, WhatsApp, or SMS claiming to be a refund, prize, or lottery payout.

• ✓For shopkeepers: Check that the merchant name displayed in customer payment apps matches your exact business name. Enable audio voice boxes (e.g. Paytm Soundbox, PhonePe Speaker) to audibly confirm credits in real time.
• ✓For customers: After scanning any merchant QR code, inspect the registered business name shown on the confirmation screen before entering PIN.

• 🔒Merchants: Periodically inspect your physical QR standees for sticker tampering. Use acrylic-sealed or laser-printed QR displays.
• 🔒Consumers: Never scan a QR code sent over chat to receive money. Reject the transaction immediately.
• 🔒Use mobile browsers that preview the destination URL before opening links embedded inside QR codes.

• !If money was debited, call 1930 immediately to freeze the recipient mule account.
• !Report the fraudulent QR code and recipient VPA inside your UPI payment app.
• !File an official cyber fraud complaint on cybercrime.gov.in attaching photos of the fraudulent QR code and transaction slips.

Criminals post high-paying remote job listings on LinkedIn, Telegram, and job portals. They conduct fully automated, AI-generated synthetic video or text interviews, and issue forged employment offer letters before demanding "laptop security deposits" or bank account details.

1. Scammers post listings for data analysts, translators, content writers, or remote customer support offering lucrative salaries (e.g., ₹85,000/month for freshers).
2. Applicants receive an invitation for an automated video screening or an interview conducted by an AI avatar or cloned executive.
3. The candidate receives a congratulations letter bearing corporate logos of reputable firms (Google, Amazon, Deloitte, TCS).
4. Before the first day of work, the candidate is told to deposit ₹15,000–₹50,000 for "company laptop insurance", "mandatory background verification", or "training software licenses".

• ✕Legitimate companies NEVER ask job seekers to pay money for equipment, interviews, background checks, or training.
• ✕Interviews conducted exclusively via Telegram, WhatsApp, or automated questionnaires without genuine interactive dialog.
• ✕Emails sent from free webmail domains (`@gmail.com`, `@outlook.com`) or misspelled domains (`@tcs-careers-portal.com`).
• ✕Offer letters issued within hours without reference checks or technical assessments.

• ✓Visit the company’s official corporate career portal directly (e.g., `careers.google.com`) and search for the job requisition ID.
• ✓Reach out to genuine employees or recruiters from the company on LinkedIn via verified company profiles to confirm the opening.
• ✓Check email header domains to verify valid SPF, DKIM, and DMARC alignment from the company’s authentic root domain.

• 🔒Never pay any money under any pretext to secure a job or remote equipment.
• 🔒Never share bank account login credentials, OTPs, or signatures on unverified employment portals.
• 🔒Be suspicious of job offers with unusually high salaries for entry-level remote tasks.

• !If funds were paid, immediately call 1930 to report financial cyber fraud.
• !If personal identity documents (Aadhaar, PAN, Passport) were submitted, report identity compromise to local police and lock your Aadhaar biometrics on the UIDAI portal.
• !Report the fake recruiter profiles to LinkedIn, Indeed, or Naukri.com, and lodge a cybercrime.gov.in complaint.

Scammers message victims on WhatsApp or Telegram offering ₹3,000–₹8,000 per day for simple tasks like liking YouTube videos, reviewing hotels on Google Maps, or rating products. Victims are lured into a predatory "prepaid task" Ponzi trap, losing lakhs.

1. The victim receives an unsolicited WhatsApp message from an international number (+84, +62, +234, +1) offering part-time remote work.
2. Stage 1 (Hook): The victim is asked to like 3 YouTube videos and send screenshots. The scammer actually pays ₹150–₹500 via UPI to build trust.
3. Stage 2 (Lure): The victim is invited to an exclusive VIP Telegram group with hundreds of members (mostly bots) celebrating huge payouts.
4. Stage 3 (The Trap): The scammer introduces "Prepaid Investment Tasks"—pay ₹3,000 to earn ₹4,500; pay ₹10,000 to earn ₹14,000.
5. Stage 4 (The Extortion): When the victim tries to withdraw their accumulated "earnings" of ₹1,00,000+, the scammer locks the dashboard and demands higher deposits (₹50,000 "tax", ₹1,00,000 "score recovery") until the victim is completely drained.

• ✕Unsolicited WhatsApp/Telegram job invitations from international numbers offering exorbitant money for clicking buttons or rating hotels.
• ✕Initial small payments made to your account to establish false credibility (a classic Ponzi hook).
• ✕Transitioning to Telegram channels where other "members" share ecstatic screenshots of earnings (fabricated bots).
• ✕Requirements to transfer money (prepaid tasks) to earn higher rewards.
• ✕Inability to withdraw your capital without paying "rectification fees", "taxes", or "channel upgrade fees".

• ✓No legitimate digital marketing agency pays hundreds of rupees per YouTube like or Google Maps review.
• ✓Review manipulation violates Google, YouTube, and Amazon terms of service and constitutes deceptive commercial practice.

• 🔒Enable "Silence Unknown Callers" and restrict "Who can add me to groups" in WhatsApp settings to "My Contacts".
• 🔒Never accept money or engage in conversations with unknown international numbers offering work.
• 🔒Immediately block and report any user asking you to join Telegram channels for investment tasks.

• !STOP sending money immediately. Understand that you will never recover funds by paying the scammer’s "unlock fees".
• !Dial 1930 immediately to freeze the recipient bank accounts before funds are laundered through crypto or mule chains.
• !File an official cybercrime report on cybercrime.gov.in providing all Telegram handles, group screenshots, and UPI UTR records.

Scammers feed compromised business dossiers, vendor invoices, or personal data into LLMs to generate hyper-realistic, context-aware phishing emails and SMS messages that mimic executive writing styles, tax authorities, or trusted vendors without typical spelling errors.

1. Attackers breach a vendor or monitor social accounts to obtain real business context (e.g. recent contracts, travel schedules, family events).
2. An LLM drafts an email in the precise tone, vocabulary, and formatting of the impersonated sender.
3. The email contains a malicious link leading to an AitM (Adversary-in-the-Middle) phishing proxy that captures both credentials and live 2FA session cookies.

• ✕Mismatched sender email addresses (e.g., display name says "Income Tax Dept", but actual address is `noreply@tax-refund-portal-gov.in.co`).
• ✕Links that lead to domains slightly different from official portals (typosquatting, lookalike unicode characters).
• ✕Urgent threats of immediate negative consequences (disconnection of electricity, tax penalty, account closure).
• ✕Requests to verify credentials, passwords, or OTPs on external web forms.

• ✓Inspect the raw email headers: Check SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC alignment status.
• ✓Hover over links before clicking to inspect the true destination URL in your browser’s status bar.
• ✓Never click links in SMS; navigate to the official portal independently by typing the verified URL in your browser.

• 🔒Deploy FIDO2 / WebAuthn hardware security keys (e.g., YubiKey) or passkeys, which are cryptographically immune to AitM phishing.
• 🔒Implement enterprise DMARC enforcement with `p=reject` on corporate email domains.
• 🔒Educate staff: Even grammatically perfect, highly personalized emails must be treated with zero trust if they demand credentials or payment.

• !If you entered credentials, immediately change your password from another uncompromised device.
• !Revoke all active sessions and refresh tokens in your Google / Microsoft / social account security center.
• !Notify your organization’s IT Security / SOC team immediately to isolate your machine and inspect sign-in logs.

Scammers blast millions of panic-inducing SMS messages and WhatsApp alerts claiming: "Dear customer, your SBI/HDFC/ICICI account is blocked today due to pending KYC update. Click here to verify your PAN."

1. Attackers use bulk SMS gateways or SIM farms to send spoofed SMS using sender headers like `SBI-IN`, `HD-BNK`, or random numbers.
2. The SMS contains a short link leading to a phishing website that mirrors the official net banking portal.
3. When the victim enters their username, password, date of birth, and OTP, the scammer enters them simultaneously on the real banking site to empty the account.

• ✕Banks NEVER send SMS containing links to update KYC details or enter passwords. RBI regulations strictly prohibit banks from seeking KYC updates via web links in SMS.
• ✕The sender is an ordinary 10-digit mobile number rather than an official registered telecom header (e.g., `VK-HDFCBK`, `AX-SBIBNK`).
• ✕The web address in the link ends in `.xyz`, `.top`, `.online`, `.site`, or contains hyphenated keywords (`sbi-update-kyc.com`).
• ✕Extreme urgency demanding compliance within a few hours.

• ✓Visit your local bank branch in person or log in through your bank’s official, bookmarked net banking URL or official mobile app.
• ✓Check the telecom sender ID: Legitimate bank SMS in India always use a 6-character alphanumeric header assigned by TRAI (e.g. `AD-SBIINB`). Ordinary mobile numbers sending bank alerts are 100% fraudulent.

• 🔒Never click on any link in an SMS regarding banking, KYC, electricity bills, or SIM card deactivation.
• 🔒Report the phishing SMS directly on the Government Chakshu portal (sancharsaathi.gov.in) to disconnect the fraudster’s SIM cards.
• 🔒Never share OTPs with anyone, even if the caller claims to be your branch manager.

• !Immediately call your bank’s 24/7 emergency toll-free number (printed on your debit card) to block all net banking access and freeze your debit cards.
• !Dial 1930 within the Golden Hour to trigger CFCFRMS lien freeze on the beneficiary account.
• !Lodge a cyber fraud complaint on cybercrime.gov.in.

Scammers hijack a friend’s or family member’s WhatsApp account, then message you claiming: "I mistakenly sent my 6-digit verification code to your phone, please forward it to me quickly!" Forwarding the code hands over your own WhatsApp account to the attacker.

1. The attacker registers WhatsApp on a new phone using the victim’s phone number, prompting WhatsApp to send a 6-digit registration SMS to the victim.
2. Simultaneously, using a previously compromised contact’s account, the attacker messages the victim: "Hey! I am locked out and WhatsApp sent my code to your number by mistake. Can you send me the 6 digits?"
3. The victim trusts their "friend" and sends the code. The attacker instantly logs into the victim’s account, enables two-step verification PIN, and locks the true owner out.
4. The attacker then messages all contacts in the victim’s phonebook asking for urgent emergency money transfers via UPI.

• ✕Any contact asking you to forward an SMS verification code or OTP.
• ✕The SMS you received explicitly says: "Your WhatsApp code is xxx-xxx. Do not share this code with anyone."
• ✕Sudden, urgent financial requests from friends or relatives over WhatsApp claiming a medical or travel emergency.

• ✓Call the friend or relative directly via regular cellular call (not WhatsApp call) to verify if their account was compromised.
• ✓Always read the actual text of every SMS containing an OTP before taking action.

• 🔒Enable WhatsApp Two-Step Verification immediately: Go to WhatsApp Settings -> Account -> Two-Step Verification -> Turn On, and set a private 6-digit PIN and recovery email.
• 🔒Never forward any SMS code to anyone under any circumstances, even family members.

• !Re-register WhatsApp on your phone: Open WhatsApp, enter your phone number, and verify with the new 6-digit SMS code. This automatically logs out the attacker.
• !If the attacker set a two-step PIN you don't know, you must wait 7 days to reset the PIN, but the attacker is immediately disconnected upon your SMS verification.
• !Immediately email support@whatsapp.com with the subject "Lost/Stolen: Please deactivate my account" and your full phone number in international format (+91...).
• !Post on other social channels (Instagram, Facebook) or send SMS alerts warning your contacts that your WhatsApp was hijacked and to ignore money requests.

Illegal, unregistered instant lending apps advertise "Instant loan of ₹50,000 approved in 2 minutes without CIBIL check". Upon installation, the malware app steals the user’s contact list, private photos, and Aadhaar card, issuing predatory 50% weekly interest and blackmailing contacts with deepfake nude photos.

1. Victims download an instant loan APK from social media ads or third-party web stores.
2. The app demands intrusive permissions: access to all phone contacts, photo gallery, location, and camera.
3. A tiny fraction (e.g. ₹3,500 of a promised ₹10,000) is credited, but after 5 days, recovery agents demand ₹8,000.
4. If payment is delayed by even a few hours, AI face-swapping software morphs the victim’s face onto obscene pornographic photos.
5. The scammers create WhatsApp groups with the victim’s parents, colleagues, and friends, threatening to circulate the defamatory images unless ransom is paid.

• ✕Lending apps downloaded from external APK websites or promoted via WhatsApp/Instagram rather than verified official app stores.
• ✕Apps demanding permissions to your entire contact list, media gallery, and camera as a condition for a financial loan.
• ✕Lending entities that are NOT registered as Non-Banking Financial Companies (NBFCs) with the Reserve Bank of India.
• ✕Loan tenures shorter than 90 days with exorbitant daily processing fees (RBI mandates minimum tenures for consumer lending).

• ✓Check the official RBI List of Registered NBFCs on the Reserve Bank of India website (rbi.org.in). If the lender is not an RBI-registered NBFC or regulated bank, it is illegal.
• ✓Check digital lending apps against the verified digital lending whitelist maintained by the RBI and Indian Ministry of Finance.

• 🔒Never install loan apps distributed via APK links on WhatsApp, Telegram, or social media ads.
• 🔒Never grant contact book or media gallery permissions to any financial or loan application.
• 🔒Borrow exclusively from regulated commercial banks and verified, registered NBFCs.

• !DO NOT PAY EXTORTION MONEY. Paying extortion guarantees further demands; the syndicate will never delete your data.
• !Immediately uninstall the malicious app and revoke all permissions. Back up threat messages and extortion phone numbers.
• !Lodge an immediate complaint on cybercrime.gov.in under "Cyber Blackmail / Extortion".
• !Inform your close contacts proactively: Send a broadcast message stating: "My phone was targeted by a cyber blackmail app that stole contacts. Please block and report any abusive messages or fake images originating from unknown numbers."

Criminal syndicates use generative AI to synthesize hyper-attractive profile personas, complete with synthetic voice notes, realistic daily selfies, and empathetic conversational models. Over weeks of emotional grooming on dating apps, matrimonial portals, or Instagram, they steer victims into fraudulent crypto/forex trading platforms.

1. Scammers build complete synthetic digital identities using AI image generators (e.g. Midjourney) and voice synthesis.
2. They initiate contact on Tinder, Bumble, Shaadi.com, LinkedIn, or via "wrong number" WhatsApp messages.
3. The scammer builds deep emotional or romantic intimacy over weeks without ever meeting in person (making excuses for camera glitches or overseas work).
4. Eventually, the scammer casually mentions their wealthy lifestyle derived from "algorithmic gold arbitrage" or a "special crypto trading node", offering to teach the victim.
5. The victim deposits small amounts, sees fake profits, and is persuaded to invest life savings, borrow loans, or mortgage property before the scammer vanishes.

• ✕The person professes deep romantic affection very quickly without meeting in person.
• ✕They consistently avoid live video calls, or their video calls suffer from severe lag, freezes, or last only a few seconds.
• ✕The conversation inevitably pivots from romance to financial investments, cryptocurrency, gold trading, or forex arbitrage.
• ✕They insist on secrecy and advise you not to consult your friends or family.

• ✓Perform a reverse image search on their profile pictures using Google Lens or TinEye to check if the face is recycled or stolen.
• ✓Demand a live, uninterrupted video call and ask them to perform live verification gestures (e.g. holding up a specific number of fingers next to their ear).

• 🔒Never take financial, crypto, or investment advice from someone you have only met online.
• 🔒Never transfer money or invest in trading platforms recommended by an online romantic acquaintance.

• !Stop sending money immediately. Do not pay any "tax" or "security bond" to withdraw funds.
• !File an urgent report on cybercrime.gov.in (India) or IC3.gov (USA).
• !Preserve all chat transcripts, crypto wallet addresses, transaction hashes, and bank statements.

Attackers harvest normal family photos or selfies from public social media profiles (Instagram, Facebook) and use AI nudification / deepfake tools to generate explicit synthetic nude images or videos. They then threaten to send these fabricated images to the victim’s family, friends, or school unless money is paid.

1. Scammers scrape facial images from public Instagram accounts, school sports teams, or LinkedIn.
2. Using automated AI image-to-image stripping models, they paste the victim's face onto explicit pornographic material.
3. The scammer contacts the victim via Instagram DM or WhatsApp, attaching a preview of the morphed image along with screenshots of the victim's follower list.
4. They demand immediate payment (typically ₹10,000–₹50,000 or gift cards) within 24 hours, promising to delete the material upon receipt.

• ✕Extortion messages threatening reputational damage with manipulated or authentic media.
• ✕Demands for payment via non-reversible channels (UPI, crypto, gift cards).
• ✕Artificial countdown timers (e.g., "You have 30 minutes").

• ✓Recognize that the media is an AI synthetic creation. Close examination will reveal skin tone mismatches between the neck and chest, unnatural lighting angles, and digital blurring around the hair and jawline.

• 🔒Lock your social media profiles: Set Instagram and Facebook to "Private". Prevent strangers from downloading or screenshotting photos.
• 🔒Never engage in video calls with strangers who begin stripping or ask you to undress.
• 🔒Use StopNCII.org (Stop Non-Consensual Intimate Images): Generate cryptographic hashes of your photos to proactively prevent them from being uploaded to participating social media platforms (Meta, TikTok, Reddit).

• !DO NOT PAY. Criminals NEVER delete the image after receiving money; paying confirms that extortion works and leads to endless escalation.
• !Do not delete the chat or block the scammer immediately: Take clear screenshots of the threats, the scammer's profile, phone number, and UPI IDs for legal evidence.
• !Report to the police immediately: In India, sexual extortion involving synthetic or real media is a severe offense under the Information Technology Act (Sections 66E, 67, 67A) and BNS. File an urgent report on cybercrime.gov.in under "Women & Child Related Crime".
• !Use TakeItDown.ncmec.org (for minors under 18) and StopNCII.org (for adults) to hash and block the media globally across platforms.

Criminals build cloned shopping websites mimicking luxury fashion brands, high-end electronics, or Indian ethnic wear stores. They use AI image generators to create photorealistic product catalogs and run targeted Facebook/Instagram ads offering 80% to 90% discounts.

1. Scammers use AI website builders and synthetic product photography to generate full-featured e-commerce stores in under an hour.
2. They run sponsored ads with headlines like "Factory Clearance Sale – 85% Off Today Only!"
3. When shoppers purchase items using credit cards or UPI, either nothing is delivered, or a worthless counterfeit item (e.g. a broken brick or dirty rag) is shipped via Cash on Delivery.
4. The website shuts down within weeks, only for the scammers to re-launch under a fresh domain name.

• ✕Discounts that defy economic reality (e.g., 85% to 95% off luxury brands or brand new iPhones).
• ✕Domain registered recently: Check Whois domain lookup; if the e-commerce store was registered 12 days ago, it is almost certainly a scam.
• ✕No physical address, no valid GST number, and no customer service phone number (only a generic web form or free Gmail address).
• ✕Customer reviews written in unnaturally repetitive, glowing language with AI-generated profile photos.

• ✓Search the domain name on consumer review platforms: "domain-name.com scam" or "domain-name.com reviews".
• ✓Verify the company's registered GSTIN number on the official GST portal (services.gst.gov.in).
• ✓Inspect the URL carefully: Fraudulent stores often use domain extensions like `.shop`, `.top`, `.store`, or misspell reputable brand names.

• 🔒Shop exclusively from established, verified e-commerce platforms or verified direct-to-consumer brand portals.
• 🔒Use virtual credit cards or credit cards with chargeback protection rather than direct UPI or debit card payments on new websites.

• !If you paid via credit card, immediately contact your card-issuing bank to file a chargeback dispute under "Goods Not Received / Fraudulent Merchant".
• !If paid via UPI, report the merchant UPI ID on 1930 and file a complaint on cybercrime.gov.in.
• !Report the fraudulent advertisement to Meta (Instagram/Facebook) or Google to protect other users.

Syndicates lure victims into sham investment apps and websites that promise automated profits through AI algorithmic trading, institutional foreign exchange pools, or cryptocurrency staking, manipulating dashboards to simulate astronomical returns.

1. Victims are added to WhatsApp or Telegram investment groups managed by a "Professor" or "Chief Analyst".
2. Group members (orchestrated by the scammer syndicate) continuously post screenshots of luxury cars and massive bank credits.
3. The victim is told to register on a proprietary trading platform (an app distributed via an APK link or specialized web portal).
4. The app dashboard shows artificial, fabricated profits calculated by simple client-side scripts.
5. When the victim attempts to withdraw funds, the platform freezes the account and demands 20% to 30% advance tax, legal clearance fees, or currency conversion charges.

• ✕Investment apps not downloaded from the official Google Play Store or Apple App Store (distributed via APK files or web browser shortcuts).
• ✕Demands to transfer investment funds into personal savings bank accounts belonging to diverse individuals (mule accounts) rather than a registered corporate brokerage account.
• ✕Guaranteed daily or weekly returns (e.g. "3% daily guaranteed"). All legitimate investments carry market risk.
• ✕Requirements to pay money to withdraw your own existing funds.

• ✓Check the SEBI Registered Intermediaries Directory (sebi.gov.in). In India, only SEBI-registered brokers, mutual funds, and research analysts can legally solicit investments.
• ✓In the US, check SEC Action Lookup (sec.gov) and CFTC Red List.
• ✓Verify that bank transfer beneficiary accounts are in the corporate name of a recognized clearing corporation or regulated broker.

• 🔒Never invest money through WhatsApp or Telegram recommendations.
• 🔒Never install investment applications from external APK links.
• 🔒Remember: If an investment claims guaranteed high returns with zero risk, it is 100% fraudulent.

• !Do not send any further money for "tax", "fees", or "release charges".
• !Immediately call 1930 to initiate recipient bank account freezing.
• !Lodge a formal cybercrime report on cybercrime.gov.in and a securities fraud report on SEBI SCORES (scores.sebi.gov.in).

Attackers combine spoofed or compromised executive email accounts with synthesized AI voice notes or phone calls from the CEO or CFO, instructing corporate accounting personnel to divert large vendor payments or execute confidential corporate acquisitions.

1. Attackers monitor corporate leadership changes, supplier relationships, and pending contracts using OSINT and email eavesdropping.
2. They send an urgent email appearing to come from the CEO: "I am in confidential board negotiations. Please execute the attached vendor payment immediately."
3. To seal the deception, the accountant receives an AI-cloned voice message or brief phone call in the CEO's exact voice: "Hey, I just sent you an urgent email regarding the vendor wire; please ensure it goes through before the bank cutoff."
4. The accounting staff bypasses standard dual-authorization protocols due to executive pressure, transferring corporate funds into the attacker's offshore mule account.

• ✕Urgent, confidential instructions from executive leadership demanding immediate financial wire transfers.
• ✕Bypassing established enterprise internal purchase order (PO) and dual-signature verification controls.
• ✕Sudden changes to supplier or vendor banking account coordinates sent via email or voice note.
• ✕Email domain lookalikes (e.g. `@company-tech.com` instead of `@company.com`).

• ✓MANDATORY OUT-OF-BAND VERIFICATION: Always contact the vendor or executive on a pre-established, trusted telephone number or in person before altering banking coordinates or processing unbudgeted transfers.
• ✓Never verify account changes using phone numbers or email addresses provided inside the suspicious email or invoice.

• 🔒Establish a formal corporate policy: All vendor bank detail changes and transfers above ₹1,00,000 (or $5,000) require dual-custody authorization and out-of-band verbal confirmation.
• 🔒Deploy email security gateways with advanced DMARC, DKIM, and display-name spoofing detection.
• 🔒Conduct regular executive impersonation simulations for finance and procurement teams.

• !Execute SWIFT / wire recall immediately through your originating bank’s treasury and SWIFT operations desk within the first 2 hours.
• !Contact the beneficiary bank’s anti-money-laundering (AML) division to freeze the recipient account.
• !File an enterprise cyber fraud report with CERT-In (cert-in.org.in) and cybercrime.gov.in.
• !Engage external forensic incident responders to determine whether corporate email systems were breached.

Scammers posing as bank technicians, telecom customer care, or electricity department officers convince victims to install legitimate remote desktop applications (AnyDesk, TeamViewer, RustDesk, QuickSupport) on their phone or computer, gaining complete remote control to drain bank accounts.

1. The victim receives a call or clicks a search result regarding an unsettled refund, pending electricity bill, or blocked SIM card.
2. The scammer claims: "Our technical server cannot connect to your mobile device. Download the QuickSupport / AnyDesk utility from the Play Store so our engineer can calibrate your connection."
3. Once installed, the scammer asks the victim to read out the 9-digit or 10-digit session code.
4. The scammer connects to the victim’s phone screen, instructs them to log into their banking app or Google Pay, views their password and OTP on the live screen, and executes unauthorized fund transfers.

• ✕Any unsolicited caller instructing you to install AnyDesk, TeamViewer, RustDesk, LogMeIn, or AirDroid.
• ✕Asking you to read out a multi-digit session ID or grant screen-recording permissions.
• ✕Instruction to open your banking app or UPI app while a remote support session is active.
• ✕The phone screen turning black or displaying a "Screen is being monitored" security warning.

• ✓Official customer support from banks, telecom providers (Jio, Airtel), and government electricity utilities NEVER require remote screen-sharing access to resolve billing or payment issues.

• 🔒NEVER install remote control applications at the direction of any incoming caller or unverified customer care number.
• 🔒If an app displays a warning: "This app allows complete control of your device", cancel installation immediately.
• 🔒Educate seniors: Screen-sharing is equivalent to handing your unlocked phone to a stranger on the street.

• !IMMEDIATE EMERGENCY ACTION: Turn on Airplane Mode or power off the phone immediately to sever the remote connection.
• !From another phone or computer, immediately call your bank to freeze net banking, block UPI, and deactivate debit cards.
• !Power on the phone in Safe Mode or without internet, and immediately uninstall AnyDesk, RustDesk, or suspicious APKs.
• !Dial 1930 and file a complaint on cybercrime.gov.in.
• !Factory reset your smartphone to ensure no hidden persistent remote access tools or keyloggers remain.

Scammers create cloned government portals (mimicking PM Kisan, Ladli Behna, PMAY, or Income Tax) and circulate fake WhatsApp messages announcing free laptops, solar panel subsidies, or cash welfare transfers. Victims submit their Aadhaar, PAN, and biometric data, which are then used to open mule accounts and take out fraudulent loans.

1. Attackers register misleading domains with government keywords (e.g. `pm-kisan-yojana-2026.org` or `gov-subsidy-online.in`).
2. They broadcast viral WhatsApp messages claiming: "Central Government offering ₹5,000 monthly allowance to all students/women. Register before midnight."
3. Victims fill in detailed personal dossiers: full name, Aadhaar number, PAN, bank account number, mobile number, and upload copies of identity documents.
4. The portal demands a ₹250 "registration fee" or "processing charge" via UPI.
5. The stolen identity documents and OTPs are used by cybercrime syndicates to issue fake SIM cards, open mule bank accounts for laundering cyber fraud money, or take instant consumer loans.

• ✕Government schemes promoted via WhatsApp forwards with web addresses that DO NOT end in `.gov.in` or `.nic.in`.
• ✕Requirements to pay "processing fees" or "registration charges" via personal UPI handles to claim government welfare.
• ✕Websites with grammatical errors, broken footer links, or hosted on free blog platforms (`.wordpress.com`, `.blogspot.com`, `.firebaseapp.com`).

• ✓ALL authentic Government of India and State Government websites strictly end with `.gov.in` or `.nic.in`. If the URL ends with `.com`, `.org`, `.in.net`, or `.site`, it is NOT an authentic government portal.
• ✓Verify government welfare schemes through the official Press Information Bureau Fact Check portal (pib.gov.in / X: @PIBFactCheck).

• 🔒Never upload Aadhaar cards, PAN cards, or bank account passbooks to unverified websites.
• 🔒Lock your Aadhaar biometrics using the official UIDAI mAadhaar app so that nobody can misuse your Aadhaar for biometric authentication.
• 🔒Use Masked Aadhaar (which hides the first 8 digits) for all non-statutory verification purposes.

• !Lock your Aadhaar immediately via the UIDAI portal (uidai.gov.in) or mAadhaar app to prevent unauthorized authentication.
• !Check your CIBIL / credit report (cibil.com / Experian) to ensure no fraudulent loans have been sanctioned in your name.
• !File an official report on cybercrime.gov.in and lodge an incident with your local police station to document identity theft for legal protection.