Mr. Alok Verma recently placed an order for a few items on a popular e-commerce platform, StyleSphere. A few days later, he received a call from someone claiming to be a delivery agent from RapidEx Couriers. The caller accurately recited his name, shipping address in Vidyut Nagar, Janakpur, and the exact details of his Cash on Delivery (COD) order, which amounted to Rs. 987.50. The “agent” stated that due to a logistical issue in his area, COD was not possible and requested Mr. Verma to make a prepaid payment to a provided link to ensure delivery.

Trusting the caller due to the accurate information they possessed, Mr. Verma paid the amount. The caller then claimed the system did not register the payment correctly and asked him to pay the exact amount again, promising an immediate refund for the first transaction. After the second payment, Mr. Verma grew suspicious as he received no confirmation email or invoice from StyleSphere. When he demanded a refund, the caller assured him that a customer service representative would call back to process it.

Shortly after, a woman claiming to be from the StyleSphere refund department called him. She guided him through a convoluted “refund process” on his UPI app. She instructed him to add a specific bank account (National Commercial Bank) and then enter a “verification code” of 19,550 in the amount field and enter his UPI PIN, assuring him that no money would be debited. Mr. Verma realised this was a fraudulent attempt to make him transfer Rs. 19,550 from his account. Fortunately, due to insufficient funds, the transaction failed. This incident highlights a sophisticated scam where criminals use leaked order data to manipulate customers. The primary concern is how these fraudsters gained access to sensitive order details, pointing to a potential data breach either at the e-commerce company, StyleSphere, or its courier partner, SwiftShip Logistics.

Advice in such cases

• Never make payments to personal numbers or unverified links for a COD order. Official companies will update the payment status on their app or website.
• Do not share your UPI PIN, OTPs, or any sensitive financial information with anyone claiming to be from customer service.
• Be wary of any process that asks you to enter an amount in the UPI app to “receive” money. To receive money, you never need to enter your PIN.
• Immediately report the fraudulent number to your telecom operator and on the National Cyber Crime Reporting Portal.
• Inform the e-commerce company and the courier service about the incident so they can investigate the data leak internally.
• Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation of come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think

Applicable Sections of Law

Such fraudulent activities involve several criminal offenses under Indian law. The primary statutes applicable are the Bharatiya Nyaya Sanhita (BNS), 2023, and the Information Technology Act, 2000.

• Section 318 of the Bharatiya Nyaya Sanhita (BNS), 2023: This section deals with ‘Cheating’. The act of dishonestly inducing a person to deliver any property or money constitutes cheating. The initial payments made by the victim fall under this section.
• Section 318(2) of the BNS, 2023: This covers ‘Cheating by personation’. The fraudsters pretended to be delivery agents and customer service executives, which is a specific offense under this clause.
• Section 66C of the Information Technology Act, 2000: This section pertains to punishment for identity theft. Using the victim’s personal information (name, address, order details) without consent to commit fraud is a form of identity theft.
• Section 66D of the Information Technology Act, 2000: This section punishes cheating by personation by means of any communication device or computer resource. This is directly applicable as the entire scam was orchestrated using mobile phones.

If you are the complainant

If you have been a victim of such a scam and have lost money, you are the complainant. Here are the steps you should take:

• File a Complaint: Immediately file a complaint on the National Cyber Crime Reporting Portal (cybercrime.gov.in) or by calling the helpline number 1930.
• Inform Your Bank: Notify your bank about the fraudulent transaction to see if the payment can be stopped or reversed.
• Register an FIR: Visit the nearest police station to register a First Information Report (FIR) under the relevant sections of the BNS and IT Act. You can also register an e-FIR in many states.
• Preserve Evidence: Keep screenshots of the transaction, call logs, fraudulent messages, and any other communication with the scammers.
• Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation of come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think

If you are the victim

Even if you did not lose money but were targeted, you are a victim of an attempted crime. Your actions can help prevent others from being scammed.

• Report the Incident: Report the phone numbers and the incident on the National Cyber Crime Reporting Portal. This helps authorities track and block these fraudsters.
• Inform the Companies: Formally write to the e-commerce platform and the courier company, putting them on notice about the potential data leak from their end. This creates a record and pressures them to improve their data security.
• Spread Awareness: Share your experience on social media (without revealing personal details) to warn others about the modus operandi of these scammers.
• Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation of come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think

How the police behave in such cases

The police, especially the cyber crime cells, are now more equipped to handle such cases. Upon receiving a complaint, they will typically register an FIR under relevant sections. The investigation involves tracking the digital footprint of the criminals, such as the mobile numbers used for the calls and the bank accounts or UPI IDs used to receive the fraudulent money. They may coordinate with banks and telecom service providers to gather evidence. However, due to the anonymous nature of such crimes and the use of fake identities, investigations can be complex and time-consuming.

FAQs people normally have

What evidence is required?

To build a strong case, you should provide the following evidence:

• Screenshots of the fraudulent transactions and messages.
• Bank statements showing the debited amount.
• Call recordings, if you have them.
• The phone numbers from which you received the calls.
• The UPI ID or bank account details to which you were asked to send money.
• A copy of your original order details from the e-commerce website.

How long will the investigation take?

The duration of a cybercrime investigation varies greatly. It can take anywhere from a few months to over a year. The timeline depends on factors like the complexity of the case, the ease of tracing the digital trail, inter-state jurisdiction issues, and the workload of the investigating agency. Tracing money trails and identifying culprits who often use fake SIM cards and bank accounts sourced from remote areas can be a prolonged process.

Advocate Sudhir Rao, Supreme Court of India