UPI and Wallet Scams - Chapter II

After writing about scams on UPI and Wallets in my previous post, I wasn't expecting to write another post on the same topic. But such is life.

Today I received a call from another number: 8099319108. After my previous experience, I installed TrueCaller on another number, keeping aside all privacy issue (Used a non seeded gmail account for Android login so that no known contacts are present on this device).

Context: I am selling my recliner, for which I posted advertisement on OLX. In chat, an interested buyer requested number couple of days back. UPI is a peer to peer money transfer technology launched by Govt. Paytm is India's most widely accepted digital wallet.

Part I: How the calls went:

8.30 AM: Short missed call from scamster
8.56 AM: I call back (No response)
9.14 AM: Another short missed call from scamster
9.15 AM: Scamster calls

Conversation- 1:
Scamster: Sir maine aapka ad dekha OLX pe (Saw your advertisement on OLX)
Me: Haan bhaiya batau (Yeah, tell me)
Scamster: Thoda kam kar sakte hai price? (Can you lower the price)
Me: Bhaiya 14500 ka recliner already half price se kam pe daal rakha hai 7000 me, 3 saal hi purana hai, aur kya kam hoga (I've already put the recliner on less than half price, can't go lower)
Scamster: 14000 tak hi de paunga (I can give 14000 only)
Me (realizing the con was a pawn): Bhaiya aapne meri post bhi padi hai? Kitna rate likha hai usme? (Have you read my post, whats the rate mentioned)
Scamster (Fumbling): 1 minute... Mai dusri post dekh raha tha (Was seeing another post)
Me: Bhaiya to batao fir (Tell me)
Scamster: 6500 ho sakta hai? (Can we do the deal at 6500)
Me: Not possible
Scamster: Theek hai, 7000 me leta hu. Aap address or number do payment ka, mai naukar bhejunga. (ok, I will buy it in 7000 then. Send me your address and number for online payment, will send a servant to pick up)
Me: ok, Whatsapp message karo ek baar (Send me a whatsapp message once).

9.20 AM: Few minutes later, I get the whatsapp message.
9.23 AM: I ask him to send the money on Paytm Wallet
10.01 AM: Scamster calls 2nd time

Conversation-2: 

Scamster: Bhaiya paytm nahi, UPI chahiye hoga. (I don't have paytm, only UPI)
Me: I don't have UPI, only paytm. Aap cash de dena nahi to. (Give me cash or paytm wallet transfer)
Scamster: Nahi bhaiya, mere paas selling machine hai, uspe sirf card se transfer hota hai, and wo sirf UPI me transfer karegi (I have a POS machine which allows for card to UPI transaction - white lie).
Me: Bhaiya dekh lo, paytm hi kar do, UPI to hai nahi
Scamster: card payment pe mujhe 2% point aate hain

10.03 AM: At this point, scamster disconnected call.
10.29 AM: I was having some spare time, so decided to try other tactics to learn more about modus operandi of this scamster. Gave him a missed call.
10.54 AM: Received a call back from the scamster

Conversation-3:

Me: Bhaiya aap recliner me interested ho na? (Brother you are interested in recliner right)
Scamster: Haan (Yes)
Me: To ek kam karo, mai price thodi kam kar leta hu, aap cash me deal kar do 6000 me (I will lower the price, please pay in cash, I will take the hit of extra points you would've got)
Scamster: Nahi mai sirf online hi karta hu, cash hai nahi mere paas (Only online options)
Me: Arey bhaiya, aap kis cheez ka kaam karte ho (oh, what is bursiness)
Scamster: Furniture showroom hai mera, JP Nagar me 
Me: Kis naam se (what is the name of business)
Scamster: Krishna Furnitures
Me: Arey bhaiya tab to aapko pata hoga thoda theek karke iske 10-12 mil jayenge aapko, dono ka fayda hai (Trying to sell him the recliner - its a winwin if I lower the price)
Scamster: paytm nahi hai mere paas (don't have paytm)
...  After some more time ...
Scamster: (Puts Call on hold for a minute, then disconnects)

11.00 AM: I try to callback
11.03 AM: Scamster picks my call

Conversation-4:

Me: Wo call disconnect ho gaya tha - dekh lo bhaiya try karo (the call got disconnected - can you try paytm)
...  After some more time ...
Scamster: Theek hai mai dekhta hu (I will try once)

12.47 PM: No call from scamster - I have some spare time again. I get an idea, why don't I pose as a customer looking to exchange things? Let me ask him for a study table of 5-6k in the  place of recliner. Another win-win
12.47 PM: I call the scamster again

Conversation-5

Me: Bhaiya wo recliner ke liye phone aaya tha aapka (Brother I had received a call for the recliner from you)
Scamster: Haan bhiaya bolo (yes tell me)
Me: Paytm hua (Did Paytm work)
Scamster (getting frustrated, I'm wasting his precious day time): Nahi bhaiya aapko kaha na sirf UPI (No brother told you only UPI works)
Me: Bhaiya acha aapka furniture ka store hai na (You have a furniture store right?)
Scamster: Haan (Yes)
Me: 1 kaam karo na, mujhe study table chahiye, aapka servant recliner lene aaye to uske sath bhej dena. Aap photos whatsapp kar do mujhe (Do one thing, I wanted to buy a study table, when your servant comes, he can get that in place of a payment)
Scamster (I think he is finally catching up): Bhaiya mera 2nd hand furniture shop hai (I've a second hand furniture shop)
Me: Haan Haan, mujhe bhi purani study table chalegi (Yes, I am ok with an older used study table)
Scamster (Disconnects call)

12. 49 PM: I call back again

Conversation-6

Me: Bhaiya mai wo exchange ki baat kar raha tha (I was talking about exchange)
Scamster: Arey ham koi pehli baar business thodi kar rahe hai, lakho ka daily ka kaam hai
Me: Haan bhaiya to mai to dono ka fayda dekh raha hu na (I'm going for winwin of both)
Scamster: Arey kyu pareshan kar raha hai (Why are you troubling me)
(Call disconnected)

1.39 PM: I am not fully satisfied with the conversations, now I want to do another call :D

Conversation-7

Me: Bhaiya wo kar lo final deal - study table kar do recliner ke badle (Let's finalise the deal)
Scamster: Arey bhaiya nahi lena keh to diya. Ham cash nahi karte, na hi kuch aur bhej sakte hain (can't do anything other than UPI)
Me (try to convince him for a couple more minutes)
Scamster (fully frustrated): arey keh diya na nahi le rahe, kisi aur ko bech do, kahe gaand fad rahe ho. (Told you can't take it, sell it to someone else, some **** slang)
Scamster (puts the phone away somewhere)
Scamster (not realising call is still on, talking to another person nearby): Ham sabki maarte hain ye hamari hi raid mar raha hai

Part II: Why UPI and not PayTM

Some time back, such scams were also popular on Paytm. But now, UPI has replaced the place. Why?

Because Paytm requires full KYC as per RBI guidelines for wallet to wallet transfer. And being a private entity, Paytm is much more sensitive towards such scams, so has built in many checks (such as multiple authentications, screening of sellers) etc. Also, I believe Paytm money can't be transferred back to bank account without some fees, so the money stays within the PayTM wallet ecosystem. Whereas, UPI, by design supports peer to peer transfers and tries to enable digital transfers for genuine sellers as well, which is misused by such scamsters by a mix of gaslighting as well as process unclarities and ignorance of general masses. Also, UPI enables shifting of funds from one to another bank, making tracking of funds a much harder process because one needs to look into multiple banks.

Part III: Is there a script to the scamsters?

Seems like a no. The scamster this time changed and adapted their stories much more fluidly. It wasn't like a call center, and I could hear the Azaan (muslim prayer) once, as well as the sound of many vehicles passing around. So, this seemed like a random store one can find in a city / town. The person spoke very good Hindi, but there was a tinge of Bihari/ Awadhi in his dialect, and the number showed as belonging to Assam on TrueCaller, so seems like this scamming activity has become a part time profession for lots of retail scamsters. And why shouldn't it? After all, they can show these UPI payments as genuine transfers, since any such transfer requires OTP authentication from the customers.

Part IV: But what can we do even if we're aware? 

Doesn't seem like much. 

Firstly, there are jurisdictional issues - this is an inter-state scam, whereas law and order is a state list matter, so most local police won't show much interest in such a case. (I don't know of any inter-state agency within India which directly investigates such crimes). 

Second, the scamsters have cause for deniability - since no money exchanged hands, and the scamster can always claim innocence, it is very hard to show culpability of the scamster. Moreover, all this happened over a phone call, and in the process I did end up calling the scamster, so any good lawyer will definitely find an alternative narrative that reduces odds of establishing guilt beyond reasonable doubt.

Third, While this scammer didn't block my number, an earlier one did. So, establishing any kind of communication becomes a hard subject beyond a point. Moreover, prepaid SIM cards do not require in person address verification, which makes tracking the scammer harder

Fourth, Given the diffused nature of crime, and possibility of lack of an organized nexus of such scamsters, I think the any investigation would end up finding small fishes/scapegoats instead of the larger ones, who will be much more sophisticated in hiding themselves.

Still if one has the time, one can take the effort to register an FIR to see where it ends.

UPI and Wallet Scams

PART I

I received an interesting call today, from number +91 9832708846. The person at the other end claimed to be calling on behalf of PhonePe. Now I'm usually very skeptical of such unsolicited calls, but this one happened just 15 minutes after I had made a PhonePe payment. So it took me a few moments to understand the real motive.

Scamster: Sir mai PhonePe se baat kar raha hu. Aap Anshul bol rahe hain?

Me: Bataiye

Scamster: Sir aapko cashback mila hai

Me: (thinking I will check the app for any coupons) ok, mai dekh lunga 

Scamster: Aapko cashback chahiye ki nahi?

Me: (Confused - what is this guy talking?) Matlab?

Scamster: (loudly) Hain? Aapko cashback chahiye ki nahi 5000 rupaye ka?

Me: (Finally realising this is a scam call) Aap PhonePe se bol rahe ho?

Scamster: Haan

Me: Arey re re re, mujhe to TrueCaller pe kuch aur dikh raha hai

<Call disconnected by scamster>

I don't have TrueCaller installed, but just the mention of it was enough for the scamster to block my number from calling him back.

While I, and many other tech savvy people may safeguard themselves, it made me realise how simple scamming has become in an increasingly connected world. It got me thinking, how is such a scamster operates.

PART II

Modus operandi of the scamster:

1. Get a list of active phone numbers from darknet
1. Can be a curated list of numbers within a circle, or  which have active bank account 
2. Buy set of SIM cards, Android mobile or SIM box
1. SIM card can be bought against any legal document, no Aadhar required, courtesy our honorable supreme  court which struck down said provision of Aadhar act as
1. privacy > other considerations
2. The other legal documents have no biometrics, so you can fake one if resourceful
3. prepaid SIM doesn't need physical verification of address
3. Cold call numbers from the list in step 1
4. Sweet talk into making the target click on a link
1. When link is clicked
1. Create a request to UPI/wallet for charging payment
2. Gaslight target into accepting the information in the guise of it helping the target
5. If victim realises s/he has been defrauded 
1. Gaslight again and repeat step 4
6. Block the number from calling back through Android feature
7. Keep the amounts scammed low so that 
1. neither the victim makes a complaint - money lost is lesser than fear of harassment
2. nor police go through the effort of investigating - When there are scams of crores to be cracked, why go after small ticket scams? 
8. Form a network of scamsters and keep milking the list of step 1
1. Many fake call call centers have mushroomed all over as per news reports

Profile of the victim:

1. Doesn't have a deep understanding of newer payment models
1. Financially uneducated, Digitally illiterate, informationally uninformed 
2. Gullible and can be easily manipulated into believing the stranger
3. Has 1 number and Has a UPI / wallet linked to the primary number

Probable Solutions:

1. Legal Institutional
1. Make Aadhar seeding mandatory for mobile phones
1. Was tried but failed legal challenges
2. Needs to be brought in on security and criminal grounds
2. Take issue seriously
1. This hurts the credibility of digital transactions
2. Can lead to people going for cash over blackboxes they see as unreliable
3. Registry for reporting such incidences and effective investigation
1. Tried to find helpline numbers where to report this call but none seemed handy
1. The DOT website doesn't help - the grievance redressal option is against the officers, not against the internet provider
1. The citizen's charter corresponds to 2017-18 and is directed towards ISPs and telecom operators.
2. The TRAI website didn't help either - it has complaints sections targetted towards the telecom operator, its Value added services
3. Same is true of the NPCI website
2. Hence need cross agency system to tackle issues on confluence of multiple Regulator
2. Retail consumer apps
1. Most wallets etc simply say we do not send unsolicited mails
2. Introduce a challenge to identify a communication was from you or not
1. Similar to an OTP - send an SMS / app notification and make it SOP to have this challenge in all communication to establish 2-way trust
3. Create industry body to lobby for better tracking mechanisms
1. Customers should only need to notify their apps that someone tried to (ab)use their name for a scam

Part III

But the question remains, how do these telecallers and scamsters curate your number in their list?
Few options come to mind:

1. Cold call a list number to check if its active - disconnect before its picked up - this dead weight on the telecom networks allows the check for free, one only needs SIM multiplexers to do this call in automated manner
2. Somehow get hold of excels from another telecom shop / business concerns - many a times the staff can extract files with limited list of subscribers for internal marketing purpose, which can get leaked in hands of scamsters
3. Get hold of data from a contact - while you may install only relevant apps on your device, one of your contacts may've installed a shady app on their device, which (the app) in turn used the contacts permissions to harvest all numbers
4. Send one-off SMSes with unique URLs, which if clicked, means that the number is active.

So, let's look deeper into this option 4. A recent SMS that I received from an unknown number comes to mind. 

Now, I neither have an account ending in those last few digits, nor am I expecting a sum in that range to be transferred. But someone who is in a hurry and didn't realise the reality of the number can definitely be taken for a ride. In this case, the scamster have used only an actual number instead of a 6-character alphanumeric registered senderid, which makes things easier to identify.  

Some poems - 6 - Sometimes

I remember writing this one as a personal challenge, after I read a poem from a college senior who had covered the life of a drop of water. While mine is a lot more depressing in hindsight, nevertheless, here it goes:

Sometimes,

I feel like I am the wind

untamed by anyone around me

unfazed by happenings around me

unnoticed by everyone around me.

Sometimes,

I feel like I am the rain

that washes away everything with my tears

that only a few clouds befriend

whose rage everyone fears.

Sometimes

I feel like I am the river

whose raging waters never cease

whose flood births tyrannies

whose soul rests in the seas.

Sometimes

I feel like I am the sea

with water so salty none can drink

only brine visible, no sign of brink

inside of which all things sink

Sometimes

I feel like I am the Earth

that carries all the weight of the world

that burns inside in its own hearth

and no one understands whose words

But then I was remembered.

Life isn't about the negatives alone

I may have my griefs, but some happy moments I do own.

So Yes.

I am the wind that sets everything in motion

I am the rain that brings joy and fresh notions

I am the river that helps life big and small

I am the sea which is deep

I am the earth that sustains one and all.

 

 

Some poems - 5 - Couplets

I remember these below couplets happened when I was once travelling to college from Delhi. I met a localite who belonged to the town of Loharu travelling in the seat next to mine, and it turned out he was the grandson of a local Urdu poet. On the way, he explained to me some basics of Khyal, Nazm, and Shayari, and encouraged me in my juvenile attempts at writing couplets and poems.

Once again, Crediting https://hindi.changathi.com/ for helping me convert English text into Hindi where required.

Couplet 1

तेरे बिना रहें तो रहें कैसे, तू ही तो हैं साँसों सा ज़रूरी 

तेरे बिना सोचे तो सोचे कैसे, तुझ बिन मेरी सोच अधूरी

तेरे बिना जियें तो जियें कैसे, तू ही तो ज़िन्दगी मेरी

तेरे बिना मरें तो मरें कैसे, तुझे पाना ही हैं आखिरी ख्वाहिश मेरी |

Couplet 2

उन्होंने बात करी कुछ ऐसे अदब से कि हम बेज़ुबान हो गए

उनकी हसीं, उनकी चल, हर अदा पर हम फ़िदा हो कर रह गए

देख के उन्हें मन में हुई हलचल और दिल खामोश ना रह सका

उन्होंने अनकही बात भी आँखों से समझली कुछ ऐसे, कि वो मालिक और हम गुलाम बन गए |

Couplet 3

आग के दरिया में शोलो कि कश्ती में

अंगारो के साथ कोयले कि बसरी में

चलता जा रहा हूँ मैं जाने किस मस्ती में

जला जा रहा हूँ मैं आज अपनी ही हस्ती में |

Couplet 4

कुछ करने से क्यों डरता  है तू - इस मंज़र को बदलने कि कोशिश तो कर

मिट जायेगा नमो निशान इस ख़ामोशी का तू एक मुस्कान फ़ैलाने कि ज़ुर्रत तो कर

जगमगा उठेगा रौशनी का कारवां तू एक दिया जलाने कि हिम्मत तो कर

Some poems - 4 - तूफानों से लड़ने का जिगर रख ऐ बन्दे

I remember writing this one for motivating myself. While I have never managed to remember the complete poem at any point of time, the first 4 lines are something I tend to remember once in a while whenever I'm feeling low.

तूफानों से लड़ने का जिगर रख ऐ बन्दे

मंज़िल तू सारी पार कर जायेगा

गिर कर संभलने का दम रख ऐ बन्दे

फिर एक उड़ान में तू आसमान भी छू कर आएगा |

चाहे मुश्किलें हज़ार रास्ते में तेरे आएं

पत्थर की बौछार हो और काटों के रास्ते बन जाये

तू दिल में रख ताकत इतनी, कि ये रुकावट भी तेरे बढ़ना ना रोक पाएं

तू होसलो में रख बुलंदी इतनी, कि इन मुश्किल राहों में भी तेरे कदम ना लड़खड़ायें |

मुकद्दर में क्या लिखा है ये कोई नहीं जानता

इंसान के काम से ही है हर कोई उसे पहचानता

रख बाज़ुओ में ज़ोर इतना, ना टूटे तेरे कर्मो कि डोर

बस एक मंज़िल बना ले, फिर बढे जा उसकी ओर |

कर ले खुद पर विश्वास इतना, फिर किस्मत के हाथो भी तू ना हार पायेगा 

कर ले खुद को बुलंद इतना, फिर भगवान भी तेरी मंज़िल तुझसे ना छीन पायेगा |

तूफानों से लड़ने का जिगर रख ऐ बन्दे

मंज़िल तू सारी पार कर जायेगा

गिर कर संभलने का दम रख ऐ बन्दे

फिर एक उड़ान में तू आसमान भी छू कर आएगा |

Once again, Crediting https://hindi.changathi.com/ for helping me convert English text into Hindi where required.

Some poems - 3 - Jingle

I found another jingle in my diary, that I wrote for an elective course for Print and Audio Visual Advertising. This was written for a fictional personality development institute, and is a mix of Hindi and English. Here it goes:

Speaker 1 (Jingle):

चलो सुने, Pappu की कहानी, 

Loosers के जैसे जिसकी ज़िंदगानी 

One और minus One का वो total 

बिना ढक्कन की empty bottle

उससे ख़तम होती हर line

फिर भी वो कहता Everything is fine.

Join किया फिर उसने  हमारा  Program

उसकी personality पर  हमने  किया  काम  

Change उसमे  आया  बड़ा  ही  drastic

Interactions में  वो  हो  गया  fantastic

जिसको  सभी  समझते  थे  Zero

अब  वो  है  मोहल्ले  का  Hero

Jobs के  लिए  जो  लगता  था  Jack

अब  उसको  मिलते  हैं  भारी-भरकम  check

   Speaker 2 (Information): 

अगर आप भी अपनी personality को बदलना चाहते हैं, तो आज ही join करे Zenith Personality Development classes

Thankfully, the jingle worked for us (me and project partner for recording) to score good marks in the assignment. Crediting https://hindi.changathi.com/ for helping me convert English text into Hindi where required

Some Poems - 2 - दोस्ती

Continuing with the previous post, sharing another poem from long back. The inspiration was a conversation I had with a friend (which was not poetic). Crediting https://hindi.changathi.com/ for helping me convert English text into Hindi where required

 दोस्ती

एक दिन,

एक दोस्त ने कहाँ मुझसे -

ज़िन्दगी तो है एक सागर,

ओर दोस्ती हैं उसमे उठती हुयी लहरें |

दिल है उस सागर से लगता दोस्ती का किनारा,

समुन्दर में तो बनती हैं हज़ारो लहरें

मगर दोस्त वही जो छु जाये दिल तुम्हारा |

तो कहा मैंने अपने दोस्त से

तुम ज़िन्दगी को सागर कह सकते हो मेरे दोस्त मगर लहरों को दोस्ती नहीं |

तुम किनारे को मेरा दिल कह सकते हो मेरे दोस्त मगर अपने आप को बस एक लहर नहीं |

क्युकी लहरें तो बनती हैं,

किनारे तक जाती हैं,

उससे टकराती हैं,

और फिर बिखर जाती हैं |

तुम्ही बताओ,

हमारी दोस्ती के सामने ये लहरें कहा टिक पाती हैं ?

तो मेरे दोस्त ने कहा मुझसे,

क्या बात है गुरु, जिरह के मन में लगते हो आज

तो क्यों ना तुम्ही बतला दो, क्या है दोस्ती का राज़?

तो फिर मैंने कहा अपने दोस्त से

मेरे दोस्त,

दोस्ती तो एक नदी के सामान होती है,

सागर को भी नहीं पता वो कहा से शुरू होती है |

उस नदी को फर्क नहीं पड़ता रास्ते में क्या बंधन आते हैं,

बल्कि वो नदी तो हर रुकावट को भी साथ बहा ले आती है |

किनारो से मतलब नहीं रखती है वो

कभी सौम्य तो कभी चंचल

कभी मध्धम तो कभी छोटी 

कभी उग्र तो कभी शांत 

कभी गहरी तो कभी मोटी, 

बस, अपनी ही धुन में बहती चली जाती है वो |

तुम लहरों को दोस्ती कह रहे थे

मगर

दोस्ती तो वो चीज़ है जो किसी के रोके नहीं रुक पाती हैं

दोस्ती तो वो ख्वाब है जो किसी के जगाने पर भी नहीं टूट पाती हैं

बस नदी की तरह बहते बहते ज़िन्दगी के सागर में मिल जाती हैं | 

फिर अंत में मेरा दोस्त बोला,

सही कहते हो तुम यार -

दोस्ती हो ही नहीं सकती समंदर की लहरें,

कहा हमारा बरसो का याराना और कहा इन लहरों का एकांत वीराना |

लम्बी हमारी बात हो चुकी है, अब चलो, मेस में जाकर खाते हैं खाना |