How the Chinese use Indians to run investment scams

Soon, a WhatsApp group was created, and she was added to it. Initially, her investments were small, and returns came on time. Sultana invested ₹1,000 and got ₹1,200 in a week. She then invested ₹3,000 and was told she had to keep investing daily to be able to get her investments back. Sultana said she had to transfer the money to various UPI (unified payments interface) IDs available on the Loxam mobile app. Eventually, the returns stopped coming. The person, who had so far posed as an employee of the company and who would communicate through an Indian mobile number, stopped taking calls and dissolved the group. By that time, Sultana had invested and lost ₹2.3 lakh. “I filed a first information report (FIR) with the cyber-crime cell of the Hyderabad Police on 9 June," Sultana said over the phone.

About four months later, the police managed to track down people involved in the Loxam app case, based on another complaint from a Hyderabad resident. Sultana hasn’t got her money back yet. According to the Hyderabad police, she had been made victim of an online investment scam run by a set of Chinese citizens allegedly in consort with Indians.

You might also like 

Adani eyes stake in Bengaluru airport 

The Android of smart home ecosystems is here

Why Mahindra & Mahindra is hitching a tractor ride

Never mind Sept quarter blip, Trent looks good

Sultana is one among scores of individuals falling for scams seemingly run by individuals from China with the help of Indian citizens. Be it loan apps with Chinese directors on board or multi-layered investment scams with Chinese individuals as the final beneficiary, they seem to have found soft targets in India. While Google and the Indian government have banned scores of these digital apps, many more have taken their place. It has become increasingly difficult to track and trace such fraudulent apps and fake investment avenues in India, given how easily they are able to trick people.

The Loxam case

The investigation into the Loxam scam, which is estimated at around ₹900 crore, was based on the complaint of an unnamed Hyderabad resident who lost ₹1.6 lakh on the Loxam app. While there is little online trace of Loxam anywhere or any evidence that it was owned by a registered company, the Hyderabad police said they found that the money of the complainant was deposited in an IndusInd Bank account in the name of Xindai Technologies Pvt Ltd.

A statement of Xindai’s current account with IndusInd Bank names one Sangita Devi in the address, as per a document seen by Mint. It is not clear if Xindai has any Chinese connection. But police said that the account was opened by someone called Virender Singh, who was arrested in October. He revealed he had opened the account on the orders of a Chinese citizen named Jack, and passed on the banking username and password to him. According to the police, the victims’ money was routed into bank accounts opened by Indians, which were for all practical purposes controlled by Chinese nationals.

“To muddle the trail and avoid traceability, the money in these accounts is then transferred to various other banks. The end goal is to transfer the money overseas through so-called ‘hawala’ transactions," said a Hyderabad cyber police officer, adding that Indian nationals received a commission of ₹ 1.6 lakh for creating these bank accounts.

For instance, the police found that a large sum of money from 38 bank accounts belonging to Xindai Technologies Pvt Ltd was transferred to two companies.

In October, the Hyderabad police announced the arrest of 10 accused in a hawala scam from Delhi and Mumbai. Among them were Singh, who opened the Xindai account, Navneet Kaushik, Chinese national Li Zhongjun, and a Taiwanese citizen called Chu Chun-yu.

How were these arrests linked to Xindai? “During investigation, it came to light that the bank account of a tech firm, Betench Networks Pvt Ltd, and Xindai Technologies Pvt Ltd share the same phone number. One Sanjay Kumar of Delhi opened the account of Betench on the instructions of Li Zhongjun and gave it to Pei and Huan Zhuan in China," the police said in a statement on 12 October.

Xindai Technologies was incorporated on 10 December 2021 in Ghaziabad, Uttar Pradesh, with a paid-up capital of ₹1 lakh and Betench Network was set up in April 2021 in Jaipur, Rajasthan, with an equal amount of capital.

Kaushik, said the police, sent money from Xindai’s accounts to foreign exchanges run in the garb of international tours and travels, and which were found to be flouting Reserve Bank of India norms. The money was then converted to US dollars and transferred abroad through the hawala route.

People posing as Loxam officials claimed it is a genuine company that deals in heavy equipment. Screenshots of chats between Sultana and the people posing as company officials showed they enticed victims by telling them to send more money to get back their earlier investments.

“Making money at LOXAM is not gambling. If you believe, your withdrawal will arrive!! Attempts are not the only ones that fail. At Loxam, Attemps only succeed. I, surbhi, LOXAM India Regional Manager: As long as you have a [valid member] [bank authorisation letter] at the same time, then your withdrawal will be 100%. If you don’t believe it, ignore everything!!!!! (sic)," said a message.

Calls to ‘Surbhi’ remained unanswered. A French company named Loxam said in a statement on 8 June that it has learnt that a website pretending to be part of the Loxam group has been offering investment opportunities to Indians since April 2022. It said that while it has an equipment rental business in over 30 countries, it does not have a subsidiary, branch or business in India and was not raising any money for any business in India.

Even before the police had made arrests in the Loxam case, a 30-year-old YouTuber and information security researcher had warned people against such messages on his channel Infomattic Technology. A little before the pandemic struck, the researcher got a flurry of such messages on his phone. Over the last few years, he has spoken to victims of many such digital frauds, especially those who have lost money to investment and loan frauds now being linked to Chinese citizens. “I received a lot of flak from people who claim I was spreading rumours and not awareness. However, after the Hyderabad police recently announced arrests for the Loxam app case, many have later told me they were mistaken," he said on condition of anonymity, fearing retribution from perpetrators of the fraud or their employers.

Conned again

Investigations into fraudulent investment and loan applications are no longer restricted to state police departments. On 20 January, the Directorate of Enforcement (ED) arrested an individual named Anas Ahmed under the Prevention of Money Laundering Act (PMLA) on allegations of being connected to the Power Bank app. Last year, the Delhi police had also arrested a few people linked to this app for defrauding people.

The ED said on 20 January that Power Bank and other such fraudulent apps (it did not name others) would assure people of interest on a daily or weekly basis on their investments. However, these entities collected money and then closed their businesses, going incommunicado. They neither paid interest nor returned the principal amount to the public, it said.

Ahmed, ED said in January, is a partner with two firms—M/s H & S Ventures Inc and M/s Clifford Ventures —that are allegedly responsible for collection of approximately ₹84 crore from the public. “Anas Ahmed has Chinese links and is suspected of being the mastermind of the whole racket," the ED said.

Chinese link

The fact that some of these scamsters are always on the prowl has alerted Indian investigative agencies. A week before Diwali, the Indian Computer Emergency Response Team (CERT) issued a warning. An arm of the government’s ministry of information technology and in charge of cyber security, it warned against adware reported to be targeting prominent brands and tricking customers in phishing scams. The phishing websites, it said, were mostly Chinese domains—registered as .cn. These attacks can result in financial frauds, CERT warned.

The involvement of Chinese individuals has raised concerns all around. “When we first started looking at the Chinese loan app scam, we thought it would involve some Chinese nationals and a few Indians who are helping them. But two years into the investigations, we have already traced ₹ 2,800 crore worth of these hawala transactions," said a senior ED official declining to be named.

There are cases registered in Chandigarh, Pune, Delhi, Mumbai, Odisha, Hyderabad, Pune, besides others.

While the Central Bureau of Investigation (CBI) has not yet registered a case in the loan app scam, the agency too is pursuing the issue by cracking down on call centres, coordinating with Interpol to arrest so-called ‘Chinese fugitives’ on the request of local police.

“The Chinese nationals are operating several illegal loan apps through China-based servers. These apps hire Indian nationals on lucrative salaries for call centre jobs. They are trained to blackmail and extort people who download the apps. The call centres have been traced back to Delhi, Ahmedabad, Pune, and places in Karnataka, to name a few," said a senior CBI official, also seeking anonymity.

The financial frauds are only getting more sophisticated. According to an investigation by the ED into a set of 18 complaints by the Bengaluru Cyber Crime police station into Chinese loan apps, forged documents of Indians were used to make them dummy directors. These entities, the ED alleged, were using various accounts held with payment gateways and banks.

“It is going to be a challenge for law enforcement agencies to track these frauds. At this point, the source of the money needs to be tracked to find the perpetrator as multiple accounts are used to transfer money in order to obfuscate the source and recipient," said Rahul Sasi, co-founder and chief executive of CloudSEK, a company that uses artificial intelligence to predict cyber threats.

While more cases are coming to the fore because of complaints and subsequent investigation by police, Sasi said more resources need to be allocated. “India is an extremely large market and that gets fraudsters interested. While there is evidence of Chinese citizens being involved in these frauds, we do not have any proof so far linking them to Chinese intelligence agencies," said Sasi.

The KYC loophole

The Indian payments industry has been transformed by cheap internet and the availability of smartphones in almost every household. Over the past couple of years, several predatory loan apps have used this to their advantage to offer quick loans.

“It is very difficult for the common consumer to get any details on these companies as their records are not easily available and any correspondence is almost always done through fake call centres, who route their calls through complex IPs. Reporting to cyber redressal cells within a reasonable timeframe post the transaction may help," said Akshay Garkel, partner, and cyber leader at Grant Thornton Bharat.

Given that these apps use UPI for transfers and a maze of bank accounts to launder money, questions are being raised on the kind of know-your-customer, or KYC, checks being carried out by banks. Garkel believes that it is important for payment gateways, banks providing UPI services and third-party application providers to ensure entities onboarded onto their platforms are thoroughly verified through KYC.

“There is indeed a systemic risk to the financial system if public defrauding, Ponzi schemes and money laundering activities are routed through these apps," Garkel said.

The ready availability of the apps on Google’s PlayStore is also a concern. A senior Google official said at an event in New Delhi in August that the company had pulled down over 2,000 lending apps from the PlayStore. Experts said that while Google continues with this culling exercise, there are loopholes that the apps are exploiting.

What you can do

While the government must look to stop these scams from affecting people, experts are of the view that creating awareness is of urgent need. Garkel of Grant Thornton Bharat said that as a first step, awareness campaigns in all languages on safe usage of internet and mobile applications should help. “All applications blacklisted by RBI, other regulators should immediately be removed from app stores," said Garkel.

Others said customers need to be more careful. According to Mrin Agarwal, founder, finance education organization Finsafe India Pvt Ltd, there are a number of items one must check. “First, one has to make sure the lender is registered with RBI. The app should mention which bank or NBFC it is affiliated to. Second, it should have a grievance redressal system in place. Third, check that customer helpline numbers and physical address are available and accessible," said Agarwal.

That apart, the app should be upfront about fees and the interest rate it charges. If you don’t find those, that’s a red flag.

Jayshree P Upadhyay in Mumbai and Neil Borate in Pune contributed to the story.

Elsewhere in Mint

In Opinion, Manu Joseph tells what the success of T20 teaches us about the old school. Vivan Sharan writes on the lessons for India from the FTX saga. Barry Eichengreen explains the trilemma of CBDCs.