In Delhi’s backyard, a den of cyber thugs

A series of single-storey houses dot the landscape. There are kirana shops; some bungalows have iron gates. The lanes of the village are muddy and slippery—it rained the previous night. And things are quiet, except for the occasional roar of motorbikes racing past on the main road.

This village wouldn’t have been this quiet even a month back. According to the police, this is a breeding ground for cyber thugs. Over 30 young men from the village were apprehended by the cops a month ago in a massive raid. Seven are still behind bars.

As this writer approaches the residents for the inside story, their expressions bear a mix of curiosity and playfulness. Everyone knows someone who is into cybercrime.

“90% are involved in some kind of cyber fraud."

“What about you?"

“Have not done it until today."

“Really?"

Naseem, a villager, produces his board examination mark sheet to prove his innocence. He has failed his Hindi course, but claims that he did not appear for it.

Most of those arrested are in the age group of 18-35 years and are barely educated.

Naseem earlier worked in a mobile repair shop. His former boss, 26-year-old Mohammad Abbas, is in jail. He has been accused of cyber fraud. “There are several masterminds here. Every kid is a manager of sorts," Naseem says.

Mohammad Shad, another resident, is the owner of a mobile shop. He is all smiles when asked about cybercrimes. Shad does not agree with the 90%-10% break-up. “It’s not just our village, it happens everywhere in Mewat," he says.

Mewat is the erstwhile name of Nuh district of Haryana. Historically, Nuh and parts of Alwar and Bharatpur districts of Rajasthan and Mathura district of Uttar Pradesh formed the Mewat region.

During the raid, many criminals got away, villagers claim. They fled across the border, as they received intelligence before the raid. Those still in jail have been implicated, their families stress.

Mohammad Waheed, Abbas’s old father, accuses the police of falsely implicating his son by attaching dubious SIM cards and mobile phones to his name. The families of Rizwan (17-year-old), Abbas (48-year-old) and Azharuddin (25-year-old)—three men arrested from Jaimat, another village Mint visited in Nuh—had similar stories to tell.

But then, the district, only two hours away from the national capital, does have a history of petty crime. With a population of roughly 1.1 million according to Census 2011, Nuh features among the poorest and most backward districts in India. In the last decade, people from the district have often been named in cases of phone or laptop theft, ATM robbery, fake gold fraud, vehicle theft and so on. During the covid-19 years, when people stayed indoors, criminals from the district pivoted into cybercrime.

Fake ads & sextortion

How do the cybercriminals of Nuh operate?

The police investigation revealed that the criminals usually operate in a group of three or four, in a disaggregated way, not as a syndicate. The work is usually divided: one person posts online ads for a product or a service; another lures the victims over the phone; yet another person procures the phones and SIM cards. Someone else could be in charge of bank accounts and cash withdrawal.

Fake ads are often posted on popular social media and e-tailing websites for used goods. Swindlers, impersonating army men, post ads of expensive cars, motorbikes or phones, using attractive images downloaded off the internet. They claim that they have been transferred and are in a hurry to sell their items at throwaway prices. A customer pays for the non-existent product online—she or he never receives it.

The police are investigating the supply chain of SIM cards issued on fake documents, and the role of local distributors.

The other piece of the puzzle is the bank account used for such transactions. Criminals don’t operate bank accounts on their names, of course—they dupe others, here too.

There are ‘bank account aggregators’ mostly based out of Bharatpur. Gullible people are promised jobs and are urged to open bank accounts. They are next duped into providing all know-your-customer (KYC) details and the address used to open the account is different from where the person stays. The debit cards and net banking credentials are delivered to the fraudster’s address, not the victim’s.

Such bank accounts are shared as a package with various criminal groups. These aggregators are paid a commission on the money deposited.

The cyber police have become swift in blocking accounts against which a case is reported. Cybercriminals, therefore, need a bouquet of bank accounts to operate their racket from.

Yet another fraud unleashed from the Nuh-Bharatpur region is that of ‘sextortion’. A person receives a WhatsApp video call from an unknown number. The caller is a nude woman. The video of this call is recorded and scammers next begin a cycle of blackmail, threatening to share the video with relatives and friends on social media. Exorbitant amounts are demanded for deleting the video. There are also cases of people being lured into video sex chat, which are similarly recorded.

A raid at 3.30 am

Many cybercriminals active in Nuh district are released within a few days of being caught. The police, at times, find it difficult to establish the fraud link, as fake documents are used to open bank accounts or issue SIM cards.

“They also have money to hire good lawyers, and easily get away in the absence of proper evidence," says Varun Singla, Nuh’s superintendent of police.

This time, the Haryana government changed its strategy.

On 26 April, the government mobilized over 5,000 police officials from all over Haryana; they landed up at the Indian Reserve Battalion (IRB)’s complex in Bhondsi, Gurugram.

The IRB has been established by the union government for various states and union territories, to assist the local police in maintaining law and order or during sensitive times such as elections, disasters, riots, and so on.

Initially, the assembled cops had no clue why they were called—the access to information was restricted on a need-to-know basis.

The group, in teams of 102, began their expedition around 11:30 pm on 27 April. At around 3:30 am, the next day, they simultaneously raided 300 locations across 14 villages (including Nai and Jaimat) of Nuh. To minimize leaks, the local police were informed and asked to join only after the raiding parties from the IRB complex reached their respective locations, informs the public relations officer at the police headquarters of Nuh.

“Even officials in the next room had no whiff of this raid," says Singla, who led the operation. It’s the first-of-its-kind action against cybercriminals in India, he claims.

A phishing racket being run from a call centre in Gurugram or Kolkata can be raided by 10 personnel, he argues, but the situation in Nuh is different. Villages are scattered along the border adjoining three states—Haryana, Rajasthan and Uttar Pradesh. There is a risk of counterattack if the police force is outnumbered. There was no precedent to plan a raid of this scale, with the required logistics and planning.

The preparations for the raid took a month and a half. More than 200 files of cybercrimes from across Haryana were scrutinized, and only cases that recorded calls from Nuh were shortlisted. With the help of technical surveillance and local intelligence, hotspot villages and coordinates of suspects were identified. A workshop with cyber experts was also organized, from 4 to 8 April at IRB in Bhondsi, for senior officials leading various tasks to assist them with planning.

Over 125 suspects were detained during the raid. 65 of them were arrested after verification. The police seized 66 smartphones, 65 SIM cards, 166 Aadhaar cards, three laptops, 128 debit cards, five Permanent Account Number (PAN) cards, among other items.

Even before the links to cybercrimes were established, the police, this time, implicated suspects in possession of fake documents. It was enough to keep them in remand for a longer time—time they used for further investigation.

₹100 crore scam

After the raid, 40 cyber experts from across Haryana were deployed to interrogate the suspects.

“Telecom companies provide the details of all SIM cards used on a phone," Singla informs. The sustained interrogation revealed that 347 SIM cards were used by the arrested individuals. Some of the cards were activated in Haryana, the rest in West Bengal, Assam, Rajasthan, Uttar Pradesh, Bihar and Odisha.

The information of 140 United Payments Interface (UPI) and 219 bank accounts opened across 29 banks were unearthed. When these details were shared with the Indian Cybercrime Coordination Centre, it was established that the SIM cards, the UPI and bank accounts were linked to around 28,000 fraud cases registered across 35 states and union territories. Overall, the fraud amount totalled ₹100 crore.

The individuals in custody have named 250 more swindlers, who are now co-accused and absconding. Of these, 211 are from Haryana and the rest are from Rajasthan and Uttar Pradesh.

The details of the cases have been shared with the directorate of enforcement, to follow the money trail, as well as the income tax department.

Creta, and a dream

Both villagers and the police contend that the menace of cybercrime spread to Nuh during covid-19. A popular theory is that locals learnt the tricks of online duping in Bharatpur. Members of the Meo community, the predominant population of Nuh, are related, through conjugal ties, to their counterparts in Bharatpur and Alwar.

In fact, many hold that it’s Bharatpur which is really the epicenter of cybercrime since most of the bank accounts used by Nuh’s cybercriminals were operated from Bharatpur. Nuh gets more attention because of past notoriety.

But what explains Nuh’s historical entanglement with crime? The Meos have traditionally been seen as rebels, who gave trouble to Mughals and the British. Their folklore, too, celebrates fearlessness and anti-state behaviour.

But more than anything, it is economic reasons that are at the heart of the problem. Nuh was ranked the lowest among NITI Aayog’s 112 aspirational districts in 2018, based on various indicators of health, education, agriculture, skill development, financial inclusion and infrastructure. Agriculture productivity has ebbed over the years, and new sources of income have not been generated. “Unemployment is the biggest reason that young men readily take to cybercrime here," says Mohammad Gulfam, a resident of Nai.

But you do come across strange sights in this ‘poor’ region—this writer noticed multiple Hyundai Cretas parked on the muddy roads of Nai and Jaimat. Who owns them?

“They either belong to the sarpanch, received as a dowry, or are owned by people who made money through online frauds," responds Gulfam.

Those who made money, sold the dream of quick success to the young. “Someone who could not properly feed his family suddenly built a palatial house, bought an expensive car (such as Creta), acquired land, and lured others into the business," says Kasim Khan, a local journalist.

Nonetheless, Singla believes that not all fraudsters can strike gold. “Those who were doing it for a year or two may be rich. At most, they would have earned between ₹50 lakh and a crore. They are no billionaires," Singla says.

He is probably right. The families of the accused this writer visited in Nai and Jaimat did not appear particularly rich. They did not own big vehicles, houses or large swathes of land.

The dream, it appears, was oversold by a few thugs.