Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Financial Fraud. Show all posts
Srilanka Treasury
Cyber Crime Financial Fraud Hacking Srilanka Treasury

Sri Lanka Treasury’s USD 2.5 Million Loss Ruled Cybercrime Fraud

 

Sri Lanka’s recent finding that a USD 2.5 million Treasury loss was the result of cybercrime highlights how vulnerable government financial systems have become in the age of digital debt repayments. The case underlines that cybersecurity failures are no longer just technical glitches; they now directly translate into sovereign-level financial and reputational risks. 

In this incident, hackers infiltrated official communication channels linked to Sri Lanka’s Finance Ministry and Treasury during a foreign debt repayment to Australia. By compromising email systems in the Public Debt Management or related units, the attackers were able to alter payment instructions so that funds intended for a legitimate creditor were instead wired to accounts controlled by cybercriminals. The money formed part of a larger bilateral repayment package, but the redirected USD 2.5 million simply never reached the intended recipient, exposing serious weaknesses in verification and authorization workflows inside the ministry. 

A parliamentary oversight body, the Committee on Public Finance (COPF), was tasked with investigating the diversion and has now formally ruled it a cybercrime-driven fraud, not a technical debt default or routine accounting error. The panel’s report points to operational lapses within the ministry rather than a single rogue actor, suggesting that controls around email, payment approvals, and cross-checking beneficiary details were either inadequate or poorly enforced. Questions around possible internal collusion were raised in political debate, but COPF stressed that its mandate was limited to financial and procedural review, leaving any deeper criminal probe to law enforcement and cybersecurity agencies. 

For Sri Lanka, the stakes go beyond the immediate financial loss. The episode has unfolded in parallel with ongoing debt restructuring and negotiations with international creditors, making any hint of default or mismanagement politically sensitive. Officials have emphasized that creditors are likely to treat the incident as cyber fraud rather than a failure to honor obligations, yet the breach still damages confidence in the state’s ability to protect critical financial infrastructure. It also illustrates how attacks on public finance systems can ripple out into diplomatic relations, market perceptions, and domestic political narratives. 

The COPF report calls for stronger cybersecurity, a special audit of foreign debt repayment processes, and upgrades to public debt management systems so similar attacks can be detected and blocked early. For governments worldwide, the Sri Lankan case is a warning that protecting payment systems, official email, and inter-agency workflows is now a front-line national security issue, not a back-office IT concern. As cybercriminals increasingly target high-value sovereign transactions, robust multi-layer verification, staff training, and real-time threat monitoring must become standard practice in every finance ministry.
Read more »
Identity Theft
AssuranceAmerica Data Breach Drivers license Financial Fraud Identity Theft

Nearly 7 Million Driver's License Numbers Exposed After AssuranceAmerica Data Breach

 


Nearly seven million people are being notified after a cyberattack on Atlanta-based auto insurer AssuranceAmerica exposed highly sensitive personal information, including driver's license numbers, Social Security numbers and insurance records, raising concerns about long-term identity theft risks.

According to the company's breach notice and filings submitted to state regulators, the incident began on March 16, 2026, when a threat actor gained unauthorized access to AssuranceAmerica's internal network using compromised employee credentials obtained through a phishing attack. The company detected suspicious activity the following day, secured the affected systems, and launched a forensic investigation to determine the scope of the compromise.

The investigation later revealed that the attackers had copied files containing personal information belonging to approximately 6.99 million individuals. The exposed data varies by person but may include names, residential addresses, driver's license numbers, Social Security numbers, taxpayer identification numbers, insurance policy and account details, claims information, as well as driver and vehicle records.

The scale of the breach makes it one of the larger disclosures involving government-issued identity documents this year. South Carolina alone reported that 611,046 residents may have been affected, according to the state's Department of Consumer Affairs.

Unlike passwords, driver's license numbers are not easily replaced after they are exposed. These identifiers are widely used to verify identity across banks, insurers, vehicle rental companies, government agencies and financial institutions. When combined with Social Security numbers and other personally identifiable information, they can enable criminals to apply for loans, open fraudulent accounts, submit false tax returns or impersonate victims during identity verification processes.

Law firm Edelson Lechtzin LLP, which announced an investigation into the incident, warned that the compromised information could be used to facilitate identity theft and other forms of financial fraud.

Although AssuranceAmerica identified the intrusion within roughly 24 hours, affected individuals were not notified until late June after investigators completed their review of the compromised data on June 15. The nearly three-month gap between the initial breach and customer notifications has drawn attention to the time required to determine exactly whose information had been accessed before notifications could be issued.

In its public notice, AssuranceAmerica said it disabled the compromised accounts, reset credentials, strengthened network monitoring and provided additional cybersecurity awareness training to employees. The company also engaged external forensic specialists to investigate the incident. However, it has not publicly confirmed whether all affected individuals will receive complimentary credit monitoring or identity protection services.

The AssuranceAmerica breach comes amid a growing number of incidents involving government-issued identity documents. In June, Texas disclosed a separate cyberattack affecting approximately three million driver's license and passport records maintained by the Texas Parks and Wildlife Department, adding to a broader trend of organizations reporting the theft of sensitive identification data.

The growing reliance on digital identity verification has also increased the amount of personal identification collected by businesses and online platforms. As governments and private organizations increasingly require users to upload driver's licenses and other official documents for account verification and age checks, cybersecurity experts warn that breaches involving these records can have lasting consequences because many of these identifiers cannot be easily changed once exposed.

Individuals who may have been affected are encouraged to closely review financial and insurance accounts for suspicious activity, consider placing a credit freeze or fraud alert with the major credit bureaus, monitor their credit reports for unauthorized accounts and remain cautious of phishing emails or phone calls that attempt to exploit information exposed during the breach. Victims should also follow guidance issued by their state consumer protection agencies and promptly report any suspected identity theft.

Read more »
Malicious Link
2FA Cyber Phishing Data Breach Financial Fraud Fraud Alert Identity Theft Malicious Link

Data Breach Alert: What It Means, Why It Matters, and How to Protect Yourself Immediately




Data breach notifications should never be ignored. Discarding them as junk mail can expose you to serious risks, including financial fraud, identity theft, and unauthorized access to your personal records.

These alerts are now extremely common. They often arrive as emails or letters from organizations such as banks, telecom providers, insurers, or even gyms. Because of their frequency, many individuals overlook them. However, the Identity Theft Resource Center reports that nearly 80 percent of people received at least one such notice in the past year, with many receiving several. This repeated exposure has led to what experts describe as “breach fatigue,” where individuals stop responding to warnings altogether.

The consequences of ignoring these alerts can be severe. Criminals may open credit accounts in your name, accumulate large debts within minutes, or misuse identification numbers to access services such as healthcare. For example, a recent breach involving a U.S.-based benefits administrator exposed Social Security numbers of 2.7 million individuals. In 2024 alone, 1.36 billion breach notifications were issued. While 2025 saw fewer victims overall, the incidents became more serious. Highly sensitive data, including Social Security numbers, appeared in two-thirds of cases, while financial details or driver’s license information were involved in roughly one-third.

Cybersecurity professionals, including Sandra Glading, Greg Oslan, and David Trapp, define a data breach as an incident where unauthorized actors gain access to systems and extract personal data. This information may include basic details such as names and contact information, or more sensitive data like passwords, banking details, or national identifiers. The level of risk increases significantly when multiple types of data are combined, as attackers can reconstruct identities and carry out complex fraud.

The scale of the issue has grown rapidly. The Identity Theft Resource Center recorded 3,322 breaches affecting more than 278 million individuals in the United States in 2025, marking the highest level on record and a 79 percent increase over five years. Two decades ago, such incidents were far less frequent. Around 2010, there were roughly 600 breaches annually, and attackers primarily targeted governments or large institutions. Today, the threat landscape has shifted toward mass exploitation driven by financial incentives. According to the Federal Bureau of Investigation, cybercrime losses reached $16.6 billion in 2024, demonstrating the scale of this criminal ecosystem.


How Do You Know If You’ve Been Affected?

In many countries, including the United States, companies are legally required to inform individuals when their personal data is compromised. Notifications may arrive via email, physical mail, or identity-protection services. In major incidents, the news media may report the breach before individuals receive direct communication.

However, this system is not foolproof. Experts warn that notifications often take months because companies need time to investigate. By the time you are informed, your data may already be in use by attackers.

At the same time, scammers exploit these situations by sending fake breach alerts. These messages may include links offering free credit monitoring or contact numbers. You should never act immediately on such messages. Always verify the information through the official website of the organization before clicking links or sharing personal data.


What to Do Immediately After a Data Breach

Security experts stress that speed matters. According to IBM, the average data breach remains active for 241 days, giving attackers an advantage before detection.

1. Identify What Information Was Exposed

Different types of data create different risks. For example, an exposed email address may lead to phishing attempts, while a leaked Social Security number can enable identity theft.

Carefully review the breach notification and locate the section that lists the compromised data. If the details are unclear, contact the organization directly. You can also use trusted breach-checking tools such as services provided by the National Cybersecurity Center or “Have I Been Pwned” to verify whether your email appears in known leaks.

2. Freeze Your Credit

A credit freeze prevents lenders from accessing your credit report, making it difficult for criminals to open new accounts in your name.

To do this, contact the three major credit bureaus:

• Experian

• Equifax

• TransUnion

This process is free and can typically be completed online within minutes.

3. Place a Fraud Alert

A fraud alert requires lenders to verify your identity before approving new credit.

You only need to contact one credit bureau, which will notify the others. Standard alerts last one year, while extended alerts for confirmed identity theft victims can remain active for up to seven years.

4. Monitor Financial Accounts Closely

Unauthorized transactions may appear quickly or after a delay.

Review your bank and credit card statements regularly for several months. Enable transaction alerts to receive real-time notifications of account activity. If you notice suspicious charges, report them immediately. Most financial institutions offer zero-liability protection, but timely reporting is essential.

5. Update Your Passwords

If login credentials are exposed, attackers often attempt to reuse them across multiple platforms.

Immediately change the password for the affected account. Then update any other accounts that use the same or similar credentials. Use strong, unique passwords for each account to reduce risk.

6. Enable Two-Factor Authentication

Two-factor authentication adds an additional layer of security by requiring a temporary code generated on your device.

Although it may seem inconvenient, it significantly reduces the chances of unauthorized access. Whenever possible, use authenticator apps instead of SMS-based codes, as they are more secure.


Additional Steps to Strengthen Long-Term Protection

After addressing immediate risks, you should adopt preventive measures:

• Use a password manager to create and store complex passwords.

• Enable passkeys, which rely on biometrics or device authentication instead of traditional passwords.

• Consider identity-protection services that monitor credit activity and data leaks.

• Stay alert to phishing attempts, especially after a breach, as attackers often impersonate trusted organizations. Avoid clicking unknown links or downloading unexpected attachments.

Experts also recommend tools like the Personal Cyber Advisor from the National Cybersecurity Center, which provides tailored guidance and alerts to help users reduce their risk.


Why This Matters Now

Data breaches are no longer rare or isolated events. They have become part of a large-scale, financially driven cybercrime ecosystem. The increasing frequency, combined with the growing sensitivity of exposed data, means individuals must take a more proactive approach to digital security.

Ignoring a breach notification is no longer a safe option. Acting quickly and following the correct steps can significantly reduce the potential damage.


Read more »
France
Cyber Attacks Data Leak FICOBA Financial Fraud France

French FICOBA Breach Exposes 1.2M Bank Accounts

 

A major cyberattack struck France's national bank account registry, FICOBA, exposing sensitive data from over 1.2 million accounts.The breach occurred in late January 2026 when hackers stole login credentials from a civil servant and impersonated an authorized user to access the database. This incident highlights vulnerabilities in government systems handling financial records.

FICOBA serves as France's central repository for all bank accounts opened in domestic institutions, storing identifiers like RIB and IBAN numbers, holder names, and postal addresses. Attackers extracted this information but could not access balances or perform transactions, according to officials. The French Ministry of Finance confirmed tax IDs were not compromised, though early reports varied.

Authorities detected the intrusion swiftly, immediately restricting access and taking the database offline temporarily.It was restored with enhanced security measures after collaboration with the National Cybersecurity Agency (ANSSI). A formal complaint was filed with the National Commission for Information Technology and Civil Liberties (CNIL), and notifications are underway to affected individuals and banks.

The exposure raises alarms for phishing scams and SEPA direct debit fraud, with banks already noting increased suspicious SMS and emails.Criminals could exploit IBANs and personal details for identity theft or unauthorized payments. French tax authorities warn they never request banking info via unsolicited messages.

Safety recommendations 

To protect yourself post-breach, monitor bank statements daily for unauthorized activity and enable transaction alerts. Change passwords on financial accounts, using unique strong ones via a password manager, and activate multi-factor authentication (MFA) everywhere possible. Avoid clicking links in unsolicited emails or texts claiming breach notifications—contact your bank directly through official apps or sites.

Further, freeze credit reports if available in your country to block new accounts in your name, and consider credit monitoring services. Report suspicious activity to your bank and local cyber police immediately.Regularly update software and use antivirus tools to prevent credential theft, emphasizing least-privilege access in organizations. These steps minimize risks from exposed data like in the FICOBA incident.
Read more »
money mules
Bank Accounts Cyber Fraud Financial Fraud Money Laundering money mules

Why Banks Must Proactively Detect Money Mule Activity



Financial institutions are under increasing pressure to strengthen their response to money mule activity, a growing form of financial crime that enables fraud and money laundering. Money mules are bank account holders who move illegally obtained funds on behalf of criminals, either knowingly or unknowingly. These activities allow criminals to disguise the origin of stolen money and reintroduce it into the legitimate financial system.

Recent regulatory reviews and industry findings stress upon the scale of the problem. Hundreds of thousands of bank accounts linked to mule activity have been closed in recent years, yet only a fraction are formally reported to shared fraud databases. High evidentiary thresholds mean many suspicious cases go undocumented, allowing criminal networks to continue operating across institutions without early disruption.

At the same time, banks are increasingly relying on advanced technologies to address the issue. Machine learning systems are now being used to analyze customer behavior and transaction patterns, enabling institutions to flag large volumes of suspected mule accounts. This has become especially important as real-time and instant payment methods gain widespread adoption, leaving little time to react once funds have been transferred.

Money mules are often recruited through deceptive tactics. Criminals frequently use social media platforms to promote offers of quick and easy money, targeting individuals willing to participate knowingly. Others are drawn in through scams such as fake job listings or romance fraud, where victims are manipulated into moving money without understanding its illegal origin. This wide range of intent makes detection far more complex than traditional fraud cases.

To improve identification, fraud teams categorize mule behavior into five distinct profiles.

The first group includes individuals who intentionally commit fraud. These users open accounts with the clear purpose of laundering money and often rely on stolen or fabricated identities to avoid detection. Identifying them requires strong screening during account creation and close monitoring of early account behavior.

Another group consists of people who sell access to their bank accounts. These users may not move funds themselves, but they allow criminals to take control of their accounts. Because these accounts often have a history of normal use, detection depends on spotting sudden changes such as unfamiliar devices, new users, or altered behavior patterns. External intelligence sources can also support identification.

Some mules act as willing intermediaries, knowingly transferring illegal funds for personal gain. These individuals continue everyday banking activities alongside fraudulent transactions, making them harder to detect. Indicators include unusual transaction speed, abnormal payment destinations, and increased use of peer-to-peer payment services.

There are also mules who unknowingly facilitate fraud. These individuals believe they are handling legitimate payments, such as proceeds from online sales or temporary work. Detecting such cases requires careful analysis of transaction context, payment origins, and inconsistencies with the customer’s normal activity.

The final category includes victims whose accounts are exploited through account takeover. In these cases, fraudsters gain access and use the account as a laundering channel. Sudden deviations in login behavior, device usage, or transaction patterns are critical warning signs.

To reduce financial crime effectively, banks must monitor accounts continuously from the moment they are opened. Attempting to trace funds after they have moved through multiple institutions is costly and rarely successful. Cross-industry information sharing also remains essential to disrupting mule networks early and preventing widespread harm. 

Read more »
US treasury
Cyber Crime Financial Fraud Investment fraud OFAC Scams US treasury

U.S. Sanctions Cybercrime Networks Behind $10 Billion in Fraud

 




The United States Treasury has announced sweeping sanctions against criminal groups accused of running large-scale online scams that cost Americans more than $10 billion last year. The targeted networks, mainly operating out of Myanmar and Cambodia, are accused not only of financial fraud but also of serious human rights abuses.


How the scams work

Authorities say the groups rely on a mix of fraudulent tactics to trick people into sending money. Common schemes include romance scams, in which criminals build fake online relationships to extract funds, and investment frauds that present convincing but false opportunities. Victims often believe they are dealing with legitimate businesses or partners, only to later discover that their savings have vanished.

Investigators also mentioned disturbing practices inside these scam compounds. Many operations reportedly force people, often trafficked across borders into working long hours under threats of violence. Survivors describe conditions that amount to modern-day slavery, with physical abuse used to maintain control.


Why sanctions were imposed

To disrupt these activities, the Treasury’s Office of Foreign Assets Control (OFAC) blacklisted nearly two dozen individuals and entities. Those sanctioned include property owners who rent out space for scam centers, energy suppliers that keep the compounds running, holding companies tied to armed groups in Myanmar, and organizers of money-laundering networks.

Once placed on the OFAC list, people and organizations lose access to any assets that fall under U.S. jurisdiction. They are also cut off from the American banking system and cannot transact in U.S. dollars. U.S. citizens and businesses are prohibited from dealing with them, and even non-U.S. companies typically avoid contact to prevent secondary penalties.


Scale of the problem

The Treasury noted that reported losses linked to Southeast Asian scams rose 66 percent in a single year, reflecting how quickly these operations are expanding. The scams have become highly sophisticated, with call centers staffed by English-speaking workers, slick websites, and carefully scripted methods for gaining trust. This combination makes them harder for individuals to detect and easier for the criminals to scale globally.


Implications for victims and prevention

Officials stress that the financial impact is only part of the damage. Beyond the billions stolen from households, thousands of people are trapped in the scam compounds themselves, unable to leave. The sanctions are designed to cut off the networks’ financial lifelines, but enforcement alone cannot stop every fraudulent attempt.

Experts urge the public to remain watchful. Requests for money from strangers met online, or platforms promising unusually high returns, should raise red flags. Before investing or transferring funds, individuals should verify companies through independent and official sources. Suspected fraud should be reported to authorities, both to protect oneself and to aid broader crackdowns on these networks.


Read more »
Social Media Safety
AI Misuse Cyber Fraud Cybersecurity Threats Deepfake Fraud Digital Literacy Financial Fraud Online Scams Social Media Safety

Deepfake Video of Sadhguru Used to Defraud Bengaluru Woman of Rs 3.75 Crore


 

As a striking example of how emerging technologies are used as weapons for deception, a Bengaluru-based woman of 57 was deceived out of Rs 3.75 crore by an AI-generated deepfake video supposedly showing the spiritual leader Sadhguru. The video was reportedly generated by an AI-driven machine learning algorithm, which led to her loss of Rs 3.75 crore. 

During the interview, the woman, identifying herself as Varsha Gupta from CV Raman Nagar, said she did not know that deepfakes existed when she saw a social media reel that appeared to show Sadhguru promoting investments in stocks through a trading platform, encouraging viewers to start with as little as $250. She had no idea what deepfakes were when she saw the reel. 

The video and subsequent interactions convinced her of its authenticity, which led to her investing heavily over the period of February to April, only to discover later that she had been deceived by the video and subsequent interactions. During that time, it has been noted that multiple fake advertisements involving artificial intelligence-generated voices and images of Sadhguru were circulating on the internet, leading police to confirm the case and launch an investigation. 

It is important to note that the incident not only emphasises the escalation of financial risk resulting from deepfake technology, but also the growing ethical and legal issues associated with it, as Sadhguru had recently filed a petition with the Delhi High Court to protect his rights against unauthorised artificial intelligence-generated content that may harm his persona. 

Varsha was immediately contacted by an individual who claimed to be Waleed B, who claimed to be an agent of Mirrox, and who identified himself as Waleed B. In order to tutor her, he used multiple UK phone numbers to add her to a WhatsApp group that had close to 100 members, as well as setting up trading tutorials over Zoom. After Waleed withdrew, another man named Michael C took over as her trainer when Waleed later withdrew. 

Using fake profit screenshots and credit information within a trading application, the fraudsters allegedly constructed credibility by convincing her to make repeated transfers into their bank accounts, in an effort to gain her trust. Throughout the period February to April, she invested more than Rs 3.75 crore in a number of transactions. 

 After she declined to withdraw what she believed to be her returns, everything ceased abruptly after she was informed that additional fees and taxes would be due. When she refused, things escalated. Despite the fact that the investigation has begun, investigators are partnering with banks to freeze accounts linked to the scam, but recovery remains uncertain since the complaint was filed nearly five months after the last transfer, when it was initially filed. 

Under the Bharatiya Nyaya Sanhita as well as Section 318(4) of the Information Technology Act, the case has been filed. Meanwhile, Sadhguru Jaggi Vasudev and the Isha Foundation formally filed a petition in June with the Delhi High Court asking the court to provide him with safeguards against misappropriation of his name and identity by deepfake content publishers. 

Moreover, the Foundation issued a public advisory regarding social media platform X, warning about scams that were being perpetrated using manipulated videos and cloned voices of Sadhguru, while reaffirming that he is not and will not endorse any financial schemes or commercial products. It was also part of the elaborate scheme in which Varsha was added to a WhatsApp group containing almost one hundred members and invited to a Zoom tutorial regarding online trading. 

It is suspected that the organisers of these sessions - who later became known as fraudsters - projected screenshots of profits and staged discussions aimed at motivating participants to act as positive leaders. In addition to the apparent success stories, she felt reassured by what seemed like a legitimate platform, so she transferred a total of 3.75 crore in several instalments across different bank accounts as a result of her confidence in the platform. 

Despite everything, however, the illusion collapsed when she attempted to withdraw her supposed earnings from her account. A new demand was made by the scammers for payment of tax and processing charges, but she refused to pay it, and when she did, all communication was abruptly cut off. It has been confirmed by police officials that her complaint was filed almost five months after the last transaction, resulting in a delay which has made it more challenging to recover the funds, even though efforts are currently being made to freeze the accounts involved in the scam. 

It was also noted that the incident occurred during a period when concern over artificial intelligence-driven fraud is on the rise, with deepfake technology increasingly being used to enhance the credibility of such schemes, authorities noted. In April of this year, Sadhguru Jaggi Vasudev and the Isha Foundation argued that the Delhi High Court should be able to protect them from being manipulated against their likeness and voice in deepfake videos. 

In a public advisory issued by the Foundation, Sadhguru was advised to citizens not to promote financial schemes or commercial products, and to warn them against becoming victims of fraudulent marketing campaigns circulating on social media platforms. Considering that artificial intelligence is increasingly being used for malicious purposes in this age, there is a growing need for greater digital literacy and vigilance in the digital age. 

Despite the fact that law enforcement agencies are continuing to strengthen their cybercrime units, the first line of defence continues to be at the individual level. Experts suggest that citizens exercise caution when receiving unsolicited financial offers, especially those appearing on social media platforms or messaging applications. It can be highly effective to conduct independent verification through official channels, maintain multi-factor authentication on sensitive accounts, and avoid clicking on suspicious links on an impulsive basis to reduce exposure to such traps. 

Financial institutions and banks should be equally encouraged to implement advanced artificial intelligence-based monitoring systems that can detect irregular patterns of transactions and identify fraudulent networks before they cause significant losses. Aside from technology, there must also be consistent public awareness campaigns and stricter regulations governing digital platforms that display misleading advertisements. 

It is now crucial that individuals keep an eye out for emerging threats such as deepfakes in order to protect their personal wealth and trust from these threats. Due to the sophistication of fraudsters, as demonstrated in this case, it is becoming increasingly difficult to protect oneself in this digital era without a combination of diligence, education, and more robust systemic safeguards.
Read more »
financial risks
AI Clonning AI cybersecurity AI Deepfakes AI technology Cloning Cyber Fraud Deepfake deepfake videos Financial Fraud financial risks

How Scammers Use Deepfakes in Financial Fraud and Ways to Stay Protected

 

Deepfake technology, developed through artificial intelligence, has advanced to the point where it can convincingly replicate human voices, facial expressions, and subtle movements. While once regarded as a novelty for entertainment or social media, it has now become a dangerous tool for cybercriminals. In the financial world, deepfakes are being used in increasingly sophisticated ways to deceive institutions and individuals, creating scenarios where it becomes nearly impossible to distinguish between genuine interactions and fraudulent attempts. This makes financial fraud more convincing and therefore more difficult to prevent. 

One of the most troubling ways scammers exploit this technology is through face-swapping. With many banks now relying on video calls for identity verification, criminals can deploy deepfake videos to impersonate real customers. By doing so, they can bypass security checks and gain unauthorized access to accounts or approve financial decisions on behalf of unsuspecting individuals. The realism of these synthetic videos makes them difficult to detect in real time, giving fraudsters a significant advantage. 

Another major risk involves voice cloning. As voice-activated banking systems and phone-based transaction verifications grow more common, fraudsters use audio deepfakes to mimic a customer’s voice. If a bank calls to confirm a transaction, criminals can respond with cloned audio that perfectly imitates the customer, bypassing voice authentication and seizing control of accounts. Scammers also use voice and video deepfakes to impersonate financial advisors or bank representatives, making victims believe they are speaking to trusted officials. These fraudulent interactions may involve fake offers, urgent warnings, or requests for sensitive data, all designed to extract confidential information. 

The growing realism of deepfakes means consumers must adopt new habits to protect themselves. Double-checking unusual requests is a critical step, as fraudsters often rely on urgency or trust to manipulate their targets. Verifying any unexpected communication by calling a bank’s official number or visiting in person remains the safest option. Monitoring accounts regularly is another defense, as early detection of unauthorized or suspicious activity can prevent larger financial losses. Setting alerts for every transaction, even small ones, can make fraudulent activity easier to spot. 

Using multi-factor authentication adds an essential layer of protection against these scams. By requiring more than just a password to access accounts, such as one-time codes, biometrics, or additional security questions, banks make it much harder for criminals to succeed, even if deepfakes are involved. Customers should also remain cautious of video and audio communications requesting sensitive details. Even if the interaction appears authentic, confirming through secure channels is far more reliable than trusting what seems real on screen or over the phone.  

Deepfake-enabled fraud is dangerous precisely because of how authentic it looks and sounds. Yet, by staying vigilant, educating yourself about emerging scams, and using available security tools, it is possible to reduce risks. Awareness and skepticism remain the strongest defenses, ensuring that financial safety is not compromised by increasingly deceptive digital threats.
Read more »
Malware Attack
Cyber Fraud Cyber Scams cybercriminals data security Financial Fraud Hacking WhatsApp Malicious Code Malware Attack

WhatsApp Image Scam Uses Steganography to Steal User Data and Money

 

With over three billion users globally, including around 500 million in India, WhatsApp has become one of the most widely used communication platforms. While this immense popularity makes it convenient for users to stay connected, it also provides fertile ground for cybercriminals to launch increasingly sophisticated scams. 

A recent alarming trend involves the use of steganography—a technique for hiding malicious code inside images—enabling attackers to compromise user devices and steal sensitive data. A case from Jabalpur, Madhya Pradesh, brought this threat into the spotlight. A 28-year-old man reportedly lost close to ₹2 lakh after downloading a seemingly harmless image received via WhatsApp. The image, however, was embedded with malware that secretly installed itself on his phone. 

This new approach is particularly concerning because the file looked completely normal and harmless to the user. Unlike traditional scams involving suspicious links or messages, this method exploits a far subtler form of cyberattack. Steganography is the practice of embedding hidden information inside media files such as images, videos, or audio. In this scam, cybercriminals embed malicious code into the least significant bits of image data or in the file’s metadata—areas that do not impact the visible quality of the image but can carry executable instructions. These altered files are then distributed via WhatsApp, often as forwarded messages. 

When a recipient downloads or opens the file, the embedded malware activates and begins to infiltrate the device. Once installed, the malware can harvest a wide range of personal data. It may extract saved passwords, intercept one-time passwords, and even facilitate unauthorized financial transactions. What makes this form of attack more dangerous than typical phishing attempts is its stealth. Because the malware is hidden within legitimate-looking files, it often bypasses detection by standard antivirus software, especially those designed for consumer use. Detecting and analyzing such threats typically requires specialized forensic tools and advanced behavioral monitoring. 

In the Jabalpur case, after downloading the infected image, the malware gained control over the victim’s device, accessed his banking credentials, and enabled unauthorized fund transfers. Experts warn that this method could be replicated on a much larger scale, especially if users remain unaware of the risks posed by media files. 

As platforms like WhatsApp continue working to enhance security, users must remain cautious and avoid downloading media from unfamiliar sources. In today’s digital age, even an innocent-looking image can become a tool for cyber theft.
Read more »
Pop-ups
Call Center Call Center Scam CBI Cyber Fraud Cyber Scam Fake Calls Fake IT Support Financial Fraud Japan Pop-ups

CBI Uncovers Tech Support Scam Targeting Japanese Nationals in Multi-State Operation

 

The Central Bureau of Investigation (CBI) has uncovered a major international scam targeting Japanese citizens through fake tech support schemes. As part of its nationwide anti-cybercrime initiative, Operation Chakra V, the CBI arrested six individuals and shut down two fraudulent call centres operating across Delhi, Haryana, and Uttar Pradesh. 

According to officials, the suspects posed as representatives from Microsoft and Apple to deceive victims into believing their electronic devices were compromised. These cybercriminals manipulated their targets—mainly Japanese nationals—into transferring over ₹1.2 crore (approximately 20.3 million Japanese Yen) under the pretense of resolving non-existent technical issues. 

The investigation, carried out in collaboration with Japan’s National Police Agency and Microsoft, played a key role in tracing the culprits and dismantling their infrastructure. The CBI emphasized that international cooperation was vital in identifying the criminal network and its operations. 

Among those arrested were Ashu Singh from Delhi, Kapil Ghakhar from Panipat, Rohit Maurya from Ayodhya, and three Varanasi residents—Shubham Jaiswal, Vivek Raj, and Adarsh Kumar. These individuals operated two fake customer support centres that mirrored legitimate ones in appearance but were in fact used to run scams. 

The fraud typically began when victims received pop-up messages on their computers claiming a security threat. They were prompted to call a number, which connected them to scammers based in India pretending to be technical support staff. Once in contact, the scammers gained remote access to the victims’ systems, stole sensitive information, and urged them to make payments through bank transfers or by purchasing gift cards. In one severe case, a resident of Hyogo Prefecture lost over JPY 20 million after the attackers converted stolen funds into cryptocurrency. 

Language discrepancies during calls, such as awkward Japanese and audible Hindi in the background, helped authorities trace the origin of the calls. Investigators identified Manmeet Singh Basra of RK Puram and Jiten Harchand of Chhatarpur Enclave as key figures responsible for managing lead generation, financial transfers, and the technical setup behind the fraud. Harchand has reportedly operated numerous Skype accounts used in the scam. 

Between July and December 2024, the operation used 94 malicious Japanese-language URLs, traced to Indian IP addresses, to lure victims with fake alerts. The scheme relied heavily on social engineering tactics and tech deception, making it a highly sophisticated cyber fraud campaign with international implications.
Read more »
pharma scam
Alkem Laboratories Cyber Fraud Cyber Security Email scam Financial Fraud Online Scam pharma scam

Alkem Laboratories Falls Victim to Rs 22.31 Crore Cyber Fraud

 

The pharmaceutical industry has been rocked by a major cyber fraud case, with Mumbai-based Alkem Laboratories suffering a financial loss of Rs 22.31 crore due to an elaborate scam. Fraudsters posed as executives from Alkem’s U.S. subsidiary, Ascend Laboratories LLC, to execute the scheme.

According to a Hindustan Times report, the incident began on October 27, 2023, when Alkem’s Mumbai office received an email seemingly from Amit Ghare, the head of international operations at Ascend Laboratories. The email claimed that a recent payment to Alkem would lead to significant tax liabilities. To circumvent these taxes, the company was asked to refund the amount to a different bank account.

On November 17, 2023, another email, allegedly from Mary Smith, Ascend Laboratories' accounting manager, provided details of a U.S.-based bank account for the refund. Acting on these instructions, Alkem’s treasury manager, Manoj Mishra, transferred Rs 51.30 crore to the specified account via a SWIFT transaction.

The fraud came to light on November 15, 2023, when Alkem received another email, supposedly from Ghare, requesting a refund of Rs 90 crore. Growing suspicious, Alkem officials contacted Ghare, who confirmed he had not sent the request. Further investigation revealed that the earlier emails originated from compromised email accounts with subtle alterations in the email addresses.

According to HT, U.S. authorities were able to recover Rs 28.98 crore from the stolen amount, which was returned to Alkem. However, the company still suffered a loss of Rs 22.31 crore.

Alkem Laboratories has reported the incident to the authorities, and an ongoing investigation aims to identify and apprehend the fraudsters while recovering the remaining funds. The company has also implemented enhanced cybersecurity measures to safeguard against similar threats, as reported by The Free Press Journal.
Read more »
Fraud Calls
Bengaluru call scams Cyber Fraud Cyber Scam Financial Fraud Financial Scam Fraud Calls

Bengaluru Woman Loses ₹2 Lakh to Sophisticated IVR-Based Cyber Scam

 

Cyber fraud continues to evolve, with scammers using increasingly sophisticated techniques to deceive victims. In a recent case from Bengaluru, a woman lost ₹2 lakh after receiving a fraudulent automated call that mimicked her bank’s Interactive Voice Response (IVR) system. The incident underscores the growing risk of technology-driven scams that exploit human vulnerability in moments of urgency. 

The fraud occurred on January 20 when the woman received a call from a number that closely resembled that of a nationalized bank. The caller ID displayed “SBI,” making it appear as though the call was from her actual bank. The pre-recorded message on the IVR system informed her that ₹2 lakh was being transferred from her account and asked her to confirm or dispute the transaction by pressing a designated key. Startled by the alert, she followed the instructions and selected the option to deny the transfer, believing it would stop the transaction. 

However, moments after the call ended, she received a notification that ₹2 lakh had been debited from her account. Realizing she had been scammed, she rushed to her bank for assistance. The bank officials advised her to report the fraud immediately to the cybercrime helpline at 1930 and file a police complaint. Authorities registered a case under the Information Technology Act and IPC Section 318 for cheating. 

Cybercrime investigators believe this scam is more sophisticated than traditional IVR fraud. Typically, such scams involve tricking victims into providing sensitive banking details like PINs or OTPs. However, in this case, the woman did not explicitly share any credentials, making it unclear how the fraudsters managed to access her funds. 

A senior police officer suggested two possible explanations. First, the victim may have unknowingly provided critical information that enabled the scammers to complete the transaction. Second, cybercriminals may have developed a new technique capable of bypassing standard banking security measures. Investigators are now exploring whether this scam represents an emerging threat involving advanced IVR manipulation. This case serves as a stark reminder of the need for heightened awareness about cyber fraud. 

Experts warn the public to be wary of automated calls requesting banking actions, even if they appear legitimate. Banks generally do not ask customers to confirm transactions via phone calls. Customers are advised to verify any suspicious activity directly through their bank’s official app, website, or customer service helpline. 

If someone encounters a suspected scam, immediate action is crucial. Victims should contact their bank, report the fraud to cybercrime authorities, and avoid responding to similar calls in the future. By staying informed and cautious, individuals can better protect themselves from falling prey to such evolving cyber threats.
Read more »
WordPress
fake websites Financial Fraud phishing PhishWP WordPress

Hackers Use PhishWP to Steal Payment Info on WordPress Sites

 



Cybersecurity researchers have uncovered a malicious WordPress plugin called PhishWP that transforms legitimate websites into tools for phishing scams. This plugin allows attackers to set up fake payment pages mimicking trusted services like Stripe, tricking users into divulging sensitive details, including credit card numbers, expiration dates, billing information, and even one-time passwords (OTPs) used for secure transactions. 


How PhishWP Works

PhishWP works by setting up fake WordPress sites or hacking into legitimate ones. It then generates phishing checkout pages that closely mimic real payment interfaces. Victims receive this interface with false site addresses, where they enter sensitive financial information, including security codes and OTPs.

The stolen data is sent to attackers in real time because the plugin integrates with Telegram. Therefore, attackers can use or sell the information almost immediately. The browser details captured by PhishWP include IP addresses and screen resolutions, which attackers can use for future fraudulent activities.


Key Features 

What has made the phishing plugin more advanced is that it ensures operations are seamless and almost undetectable. 

Realistic Payment Interfaces: The plugin mimics the appearance of trusted services like Stripe.  

3D Secure Code Theft: It fetches the OTP sent to everyone in the verification processes to successfully process fraudulent transactions.

Real-time Data Transfer: Telegram is used to send stolen information to attackers in real time.  

Customizable and Worldwide: Multi-language support and obfuscation features enable phishing attacks across the globe.  

Fake Confirmations: Victims receive fake emails that confirm purchases, which delays the suspicion.  


Step-by-Step Analysis  

1. Setup: Attackers either hack a legitimate WordPress site or create a fake one.

2. Deceptive Checkout: PhishWP personalizes payment pages to resemble actual processors. 

3. Data Theft: Victims unknowingly provide sensitive information, including OTPs. 

4. Exploitation: The stolen data is immediately sent to attackers, who use it for unauthorized transactions or sell it on dark web markets.


How to Protect Yourself

To avoid falling victim to threats like PhishWP:  

1. Verify website authenticity before entering payment details.  

2.  Look for secure connections (HTTPS) and valid security certificates.  

3. Use advanced tools like SlashNext’s Browser Phishing Protection, which blocks malicious URLs and identifies phishing attempts in real time.

Protecting your personal and financial data begins with understanding how cyberattacks work, don’t let hackers take the upper hand.



Read more »
Payment Scams
AI Scams Cyber Fraud deepfake scams Financial Fraud Identity Theft Online Safety Online Security Payment Scams

Protect Yourself from AI Scams and Deepfake Fraud

 

In today’s tech-driven world, scams have become increasingly sophisticated, fueled by advancements in artificial intelligence (AI) and deepfake technology. Falling victim to these scams can result in severe financial, social, and emotional consequences. Over the past year alone, cybercrime victims have reported average losses of $30,700 per incident. 

As the holiday season approaches, millennials and Gen Z shoppers are particularly vulnerable to scams, including deepfake celebrity endorsements. Research shows that one in five Americans has unknowingly purchased a product promoted through deepfake content, with the number rising to one in three among individuals aged 18-34. 

Sharif Abuadbba, a deepfake expert at CSIRO’s Data61 team, explains how scammers leverage AI to create realistic imitations of influencers. “Deepfakes can manipulate voices, expressions, and even gestures, making it incredibly convincing. Social media platforms amplify the impact as viewers share fake content widely,” Abuadbba states. 

Cybercriminals often target individuals as entry points to larger networks, exploiting relationships with family, friends, or employers. Identity theft can also harm professional reputations and financial credibility. To counter these threats, experts suggest practical steps to protect yourself and your loved ones. Scammers are increasingly impersonating loved ones through texts, calls, or video to request money. 

With AI voice cloning making such impersonations more believable, a pre-agreed safe word can serve as a verification tool. Jamie Rossato, CSIRO’s Chief Information Security Officer, advises, “Never transfer funds unless the person uses your special safe word.” If you receive suspicious calls, particularly from someone claiming to be a bank or official institution, verify their identity. 

Lauren Ferro, a cybersecurity expert, recommends calling the organization directly using its official number. “It’s better to be cautious upfront than to deal with stolen money or reputational damage later,” Ferro adds. Identity theft is the most reported cybercrime, making MFA essential. This adds an extra layer of protection by requiring both a password and a one-time verification code. Experts suggest using app-based authenticators like Microsoft Authenticator for enhanced security. 

Real-time alerts from your banking app can help detect unauthorized transactions. While banks monitor unusual activities, personal notifications allow you to respond immediately to potential scams. The personal information and media you share online can be exploited to create deepfakes. Liming Zhu, a research director at CSIRO, emphasizes the need for caution, particularly with content involving children. 

Awareness remains the most effective defense against scams. Staying informed about emerging threats and adopting proactive security measures can significantly reduce your risk of falling victim to cybercrime. As technology continues to evolve, safeguarding your digital presence is more important than ever. By adopting these expert tips, you can navigate the online world with greater confidence and security.
Read more »
Operation Serengeti
Afripol Cyber Crime digital scam Financial Fraud Interpol Operation Serengeti

Interpol and Afripol Arrest Kenyans Involved in Digital Scams

Interpol and Afripol Arrest Kenyans Involved in Digital Scams


Interpol and Afripol recently carried out “Operation Serengeti” a major international operation, cracking down on cybercrime throughout 19 African countries, arresting 1,006 and disrupting 134,089 malicious networks and infrastructures. The two agencies recovered USD 43,954,537, and more than 20 Kenyans were arrested in the two-month sting operation. The arrested Kenyans were involved in online credit card fraud. 

“Operation Serengeti shows what we can achieve by working together, and these arrests alone will save countless potential future victims from personal and financial pain,” said Valdecy Urquiza, Secretary General of INTERPOL. 

About Operation Serengeti 


The operation ran from September to October 2024, cracking down on various cybercrimes like business email compromise (BEC), ransomware, online scams, and digital extortion. The law agencies found 35,000 victims and cases linked to worldwide financial losses worth USD 193 million.  

The joint effort led to the disruption of cybercriminal activities and improved the efforts of law enforcement agencies in African Union member nations. 

Key events in Sting Operation 


The arrested Kenyans were involved in online credit card fraud and responsible for global banking systems losing US$8.6 million. 

The stolen money was sent via SWIFT to digital asset firms to countries Nigeria, China, and the UAE. The joint operation also resulted in the arrest of digital scammers in other countries Cameroon, Angola, Senegal, and Nigeria. 

“Through Serengeti, AFRIPOL has significantly enhanced support for law enforcement in African Union Member States. We have facilitated key arrests and deepened insights into cybercrime trends. Our focus now includes emerging threats like AI-driven malware and advanced attack techniques,” Jalela Chelba, AFRIPOL’s Executive Director said. 

Rise of financial fraud in Kenya 


TransUnion report analysis reveals Kenya is 10th in Digital Fraud suspects out of 19 countries in the first half of 2024. In the case of digital transactions carried out in Kenya, around 4.6% were traced as suspected Digital Fraud. 

Credit card fraud is the leading problem in the financial sector, scammers steal the card info of victims and access their accounts. They do this via application fraud and account takeovers.
Read more »
User Security
Cyber Scam Data Privacy Financial Fraud Mobile Security Phone Scam User Security

Here's How to Safeguard Yourself Against Phone Scams

 

Sophisticated phone scams are becoming more common and more relentless. The numbers are mind-boggling. According to the FTC, impostor fraudsters cost US consumers $2.7 billion in 2023, and the figure is rising year after year. 

These are merely the listed losses; many people who have been duped are embarrassed and refuse to acknowledge they fell for such a scam. You may believe that you will not be misled, yet many of those who are duped thought this before the incident. 

Scammers have refined their strategies to sound trustworthy and legitimate, and AI is just making matters worse. When combined with the strain or situation, it only takes a few moments to fall for it. 

The best defence against phone scams is to be prepared to face them, as they are likely to occur at some point. We've compiled a list of some of the most popular phone scams in 2024 and how to prevent them.

AI-powered scams

The most obvious example of fraudsters exploiting new technology to power existing scams is artificial intelligence (AI). For instance, scammers might use AI to: 

  • Generate more convincing and genuine sounding phishing emails and text messages. 
  • Create deepfakes of celebrities to lure victims into thinking they're investing in a good company or project.
  • Impersonate an employer and ask for private information. 

Student loan forgiveness scams 

The back-and-forth adjustments in student loan forgiveness create an ideal scenario for scammers. Fraudsters know that individuals want to believe that their student loans will be forgiven, and they will use this need for personal benefit.

For example, scammers may call you or set up fake application sites to steal your Social Security number or bank account information. They may put pressure on their victims by sending bogus urgent messages encouraging them to seek debt relief "before it's too late." Then they will charge you a high application fee. In reality, this is a scam.

Zelle scams

Scammers are using Zelle, a peer-to-peer payment tool, to steal people's money. The fraudster might email, text, or contact you, claiming to work for your bank or credit union's fraud department. They'll claim that a thief intended to steal your money via Zelle and that they need to walk you through "fixing" the issue. 

Subsequently, fraudsters may advise you to pay the money to yourself, but the funds will actually go to their account. Starting in mid-2023, Zelle began refunding victims of some frauds. However, you may not always be eligible for reimbursement, so be aware of these financial frauds. 

Prevention tips 

Avoid clicking on unknown links: Whether the link arrives in your email, a text or a direct message, never click on it unless you're certain the sender has good intentions. If the message says it's from a company or government agency, call the firm using a number that you look up on your own to confirm its legitimacy. 

Be skeptical: Scammers can spoof calls and emails to appear to be from a number of sources, including government institutions, charities, banks, and major companies. Do not provide any personal information, usernames, passwords, or one-time codes that others could use to gain access to your accounts or steal your identity. 

Don't refund or forward overpayments: Beware whenever a company or person asks you to refund or forward part of a payment. Often, the original payment will be fraudulent and taken back later. Following simple safety precautions and reviewing the most recent scam alerts might help you stay safe. However, mistakes might occur, especially when you are stressed or overwhelmed.
Read more »
User Security
Cash App Data Leak Financial Fraud Mobile Security User Security

Worried About Cash App Breach? These Three Steps Can Keep Your Financial Data Safe

 

You're not alone if the most recent Cash App data hack made you nervous. In 2022, the parent company of Block, the peer-to-peer payment platform, failed to prevent unauthorised access to Cash App customer accounts. 

Cash App agreed to a $15 million class action settlement in exchange. Even though it was an internal change, users' concerns about the app's security were not allayed, despite the fact that it was a positive step. To learn more about how to better defend themselves, users urged the cybersecurity specialists to provide some safety tips.

“One of the biggest problems with money apps like this is their popularity,” stated Neal O’Farrell, a digital security expert and CNET Money expert review board member. “Hackers follow the crowds, and the more people use these apps, the more time criminals will spend trying to exploit them.” 

Cash App actually includes an array of security safety features. The difficulty is that, while they can help you avoid fraudsters, they cannot always keep your data secure. O'Farrell observed that even the finest privacy safeguards can be undermined by an insider with access, as happened in the Cash App case. Whether you wish to avoid financial frauds on Cash App or protect your sensitive information after it has been disclosed, here are three security procedures you should take in addition to claiming any settlement money you are owed.

Secure your sign-on 

By default, Cash App makes signing in much safer by sending a code to your email address or phone number each time you log in. But there's a catch: after logging in, you must manually sign out of your account; otherwise, you can access your account from your phone without a code. I've signed out and signed back in without a code, which could be a concern if someone gains access to your phone and the app.

To be on the safe side, experts recommend logging out once you've finished completing transactions. You can add two-factor authentication as a second layer of account security, but you'll need to download a separate app, such as Google Authenticator. 

Don’t send money to strangers

From romance scams to tax scams, there are numerous ways for perpetrators to trick you into sending money using Cash App or other payment apps. Experts recommended not to send money to strangers and always double-checking their phone number or email address before sending. If you mistakenly send money to the wrong person or discover you were scammed on a Cash App, banks will often refuse to refund your money.

O'Farrell advises being wary of any messages you receive via payment apps. He frequently sees scams in which someone poses as a friend and asks for money or claims you owe them money. Others may attempt to steal access to your app and money by requesting that you verify your security code so that they can resolve a security issue with your account.

A few things can help you figure out who you're giving money to. Cash App's Incoming Requests option, available under the Security & Privacy menu, will only allow you to give money to a specific contact rather than everyone else on the app. You can also prevent people from finding your Cash App account by disabling the "$CashTag Cash.app" option in the same security page. 

Monitor your transaction activity 

Beyond data security, it's critical to monitor your account's behaviour. To receive text messages and emails about your transactions, enable push alerts under Cash App's 'Notifications' option. This allows you to track all of your payment activities and keep an eye out for anything odd.
Read more »
Senior Citizen Scam
₹6 Crore Scam 85-Year-Old Woman Cyber Fraud CyberCrime cybercriminals Digital Arrest Financial Fraud Hyderabad Fraud Senior Citizen Scam

Cybercriminals Place 85-Year-Old Woman Under 'Digital Arrest' in Hyderabad, Cheat Her of ₹5.9 Crore

 

Cybercriminals recently targeted an 85-year-old woman from the city, subjecting her to what can be described as a 'digital arrest' and extorting a staggering ₹5.9 crore from her. This elaborate scam involved convincing the elderly woman that her Aadhaar details were allegedly linked to serious money laundering cases involving Bollywood actress Shilpa Shetty and Jet Airways founder Naresh Goyal. 

The fraudsters, posing as officials from the Mumbai Cybercrime Wing, manipulated the woman into believing that her bank accounts and fixed deposits were under investigation and needed immediate verification by the Reserve Bank of India (RBI). Under this false pretext, they coerced her into transferring significant sums of money into specific accounts that they claimed were set up by the RBI for verification purposes.

When the woman attempted to contact her son for advice, the criminals threatened her, insisting that the matter was of utmost confidentiality. They warned that any attempt to inform her family would lead to severe consequences, including potential legal trouble for her son and the entire family. 

The incident came to light when her son, a software professional based in Bengaluru, visited her after about a week. He noticed her distress and learned of the fraudulent activities. Realizing his mother was in a state of psychological manipulation and fear, he immediately contacted the Telarigarra Cyber Security Bureau (TGCSB) to report the crime.

Fearful for her family's safety, the woman complied with their demands, transferring large sums into various accounts. It was only when her son arrived and intervened that the ongoing fraud was halted. He quickly reassured his mother, explaining that she had been deceived, and together, they reported the incident to the authorities. The police are now investigating the case, and efforts are underway to trace the criminals responsible for this heinous act.
Read more »
Transactions
Cyber Fraud Digital Payment Financial Fraud Fintech RBI Transactions

Fintechs Encouraged to Join National Cyber Fraud Reporting System


The Fintech Association of India (FACE) has urged its members to register on the Citizen Financial Cyber Fraud Reporting and Management System (CFCFRMS). This platform, part of the broader National Cybercrime Reporting Portal, facilitates the reporting and management of financial cyber frauds. By joining, fintech companies can better handle customer complaints and collaborate with law enforcement to prevent fraud.

This initiative by FACE is noteworthy, especially as it seeks approval to become a self-regulatory organisation (SRO) for fintech lenders. The Reserve Bank of India (RBI) is expected to announce its decision soon, with FACE and the Digital Lenders’ Association of India both in the running to be recognised as an SRO. The establishment of an SRO will likely lead to more stringent industry oversight, promoting higher standards of operation and better consumer protection within the fintech sector.

The push for fintechs to join the CFCFRMS comes at a critical time. As digital transactions grow more common, the opportunities for cyber fraud have increased. The convergence of various financial entities— such as banks, non-banking financial companies, insurance providers, and payment services—has created more potential points of vulnerability. The CFCFRMS is designed to coordinate the efforts of all stakeholders, enabling action to block fraudulent transactions before they can be completed.

RBI’s New Platform to Combat Payment Frauds

In a parallel effort to bolster cybersecurity, the RBI is developing the Digital Payments Intelligence Platform (DPIP). This platform aims to use cutting-edge technology to detect and prevent payment fraud. A committee led by A P Hota, former CEO of the National Payments Corporation of India, is currently formulating recommendations for the DPIP, which is expected to upgrade the ability to share real-time data across the payment ecosystem. This initiative is especially important in addressing frauds where victims are tricked into making payments or divulging sensitive information.

Alarming Increase in Cyber Fraud Losses

The importance of these measures is empathised by recent statistics from the Ministry of Finance. Financial losses due to cyber fraud have more than doubled in the last fiscal year, rising to Rs 177.05 crore in FY24 from Rs 69.68 crore in FY23. This sharp increase underlines the growing threat posed by cybercriminals and the need for more robust security measures.

Public Awareness and Digital Payment Safety

While the rise in cyber fraud is concerning, a survey by the RBI offers some reassurance. According to the survey, 94.5% of digital payment users have not experienced fraud. However, the risk remains, especially in semi-urban areas, where fraud attempts are slightly more common than in metropolitan regions. The most prevalent form of fraud is vishing, or voice phishing, where criminals trick individuals into revealing sensitive information over the phone. Other common tactics include phishing emails, misuse of payment requests, and remote access scams.

As digital payments become increasingly integrated into everyday life, ensuring their safety is crucial. Initiatives like CFCFRMS and DPIP are essential in building a secure and trustworthy digital financial environment. By building up on fraud prevention measures, these platforms can help maintain public confidence and encourage wider adoption of digital payment systems.


Read more »
User Security
Cyber Fraud E-Challan Scams Financial Fraud Indian Government User Security

Here's How Users Can Safeguard Themselves From E-Challan Scams

 

In light of the growing prevalence of e-challan scams, the Indian Computer Emergency Response Team (CERT-In) has released some crucial advice to prevent individuals from becoming victims and suffering financial loss. 

Nearly 4400 devices have been infected with malware, resulting in approximately Rs 16 lakh worth of fraudulent transactions, according to a recent PTI report. Users are tricked into falling for these scams by Vietnamese hackers who employ Android malware. 

As part of the campaign, the victims receive a fraudulent e-challan message on WhatsApp containing a fake payment link. By clicking the link, hackers are able to access the device. 

Modus operandi 

Phishing messages: You receive a text message or email claiming to be from an authentic traffic authority. The notification states that you have an unpaid traffic penalty and imposes a significant charge. 

Fake links: The mail will include a link that will prompt you to click to check the e-challan details or complete the payment. 

Spoofed websites: Clicking the link may direct you to a fraudulent website that appears to be an actual traffic authority website. This website is designed to steal your personal information, such as credit card information, login credentials, or Aadhaar numbers. 

Prevention tips 

Visit official site: The government security agency recommends users to only make e-challan payments using official websites. It's vital to note that each state has its own e-challan website. Legitimate e-challan websites typically end with a ".gov.in" domain extension. So, before making a payment, make sure you're using the right website.

Don't click on suspicious links: As previously said, it's best to avoid clicking on random links. This might have harmful software on it that could harm your device.

Use antivirus software: Antivirus software is able to search for, identify, and prevent this kind of malware from infecting the device. Make sure the antivirus program is updated and has the latest available database. 

If you have been a victim of financial fraud, you can file a report with your local police station as well as the cybercrime portal.
Read more »
Subscribe to: Posts (Atom)