‘They promised 30% returns… Rs 19 crore gone’: How a WhatsApp IPO scam trapped a 78-year-old in Delhi

His is the second-largest cyber fraud case ever to be reported in Delhi. Earlier this year, a retired bank employee living in South Delhi was cheated of Rs 23 crore, but that was a different kind of scam, a “digital arrest”.

More than a year on, the septuagenarian victim spoke to The Indian Express at his bungalow. He did not agree to have his name, address, or picture published.

“After I realised that I had been cheated, I gathered the courage in November 2024 to call 1930 (the Delhi Police cybercrime helpline number). They directed me to contact the IFSO (the Delhi Police’s Intelligence Fusion and Strategic Operations unit). I approached the unit’s Dwarka office on November 27, 2024,” he said.

The IFSO, established in 2019 to fight cybercrime, was called CyPAD (Cyber Prevention, Awareness & Detection Centre) until it was renamed during the tenure of former Delhi Police Commissioner Rakesh Asthana. Fifteen cyber police stations, one in every district of Delhi, were established.

In 2021, IFSO’s mandate was widened to include matters relating to national and economic security. Besides online financial fraud involving amounts of Rs 50 lakh or more, IFSO also investigates cases relating to deepfakes, toolkits (collection of resources to help individuals or groups commit crime), online harassment, data theft and security breaches.

From December 3, IFSO has been functioning as a unit separate from the Special Cell, which is focused on counterterrorism. Cybercrime is constantly evolving, IFSO Deputy Commissioner of Police Vinit Kumar said. “Scammers”, he said, “exploit three things — greed, fear and urgency.”

It was ‘greed’ — for profit — that did the businessman in.

A WhatsApp link

One morning in July 2024, the victim received a link on WhatsApp from an unknown number, inviting him to join a “shares trading company” group. He was intrigued, he said — “I wasn’t familiar with such scams then, or even with the process of online trading.”

He was directed to an external website named after a well known non-banking financial services company, and the unknown person who had contacted him told him he could expect returns of almost 30% if he invested in the company’s IPO. “At that time, I was looking for such investments,” the businessman said.

Still, he resisted joining the WhatsApp group — until his desire for “good returns” overwhelmed him. On July 24 last year, he accepted the WhatsApp group invite.

“It had over 50 members, including seven administrators. The group was active only during stock market trading hours, 9 am to 4 pm,” he told The Indian Express.

Conversations on the WhatsApp group were on shares, investments, and profit. “Some members claimed to have bought shares worth Rs 100 for Rs 75 and sold them for Rs 125. The exchanges were extremely believable. So I downloaded their app,” he said. On September 10, 2024, the victim messaged the administrator of the group, “Sir, how do I invest in the company’s IPO?”

The reply seemed logical and sensible: “You are advised to subscribe for the… IPO and after successful application patiently wait for the result this Thursday (September 12, 2024), it has a lot to do with your luck as to how many shares of IPO you can be allotted.”

Someone in the group then posted a link, along with instructions. Seemingly helpful, this person also told the businessman that an “employee” from the company would guide him through the process.

The first “investment” on the app was of Rs 25 lakh. “The account dashboard showed my balance, share prices, and also my bank transactions, including the UTR (unique transaction reference that shows money transfer information). The app also indicated that I was making nearly a 30% profit.”

He had reason to be happy. The abundance of information on the dashboard suggested transparency, so he also felt confident. He put in more money — and then some more.

In all, he transferred a total of Rs 18.80 crore to 26 accounts from his own two accounts. What he saw in the profit bar on the app’s dashboard encouraged him to keep investing, he said.

The crushing blow

The first stirrings of unease came when he tried to book some of these “profits”.

“The app kept blocking my request for one reason or another,” he said. He found it odd, and his experience when he tried to reach out to the “company” was odd too.

“Saari baatein hamesha WhatsApp chat pe hi hoti thi (All communication took place over WhatsApp chats). Whenever I tried to call, a message from the service provider would say the number was not reachable,” he said.

As his unease started to turn to panic, the businessman tried to exit with just his “investment”. “I told them I had no more money to invest,” he said.

Attempts were made to make him change his mind. The businessman was told his investment would soon yield a profit of nearly Rs 80 crore. “When I insisted that I had no money left to invest, they offered me a loan,” he said. And then, all of a sudden, he was locked out of the app.

It was at this point that the full force of his situation hit the businessman. He knew, one, that his money was gone for good, and two, he needed help. “Mere paas bas do raaste the,” he told The Indian Express. “Ya toh main beemar ho jaoon, ya phir ladoon (I had two options: either to give up or to fight). I chose the latter option.”

The pain from the financial loss is compounded by the trauma of being cheated, the businessman said. “I could not sleep the first few nights after realising that I had been duped. Eventually, I came clean to my daughter and wife. My son still doesn’t know that I have lost nearly Rs 19 crore. But he suspects something is wrong. I don’t know how long I can keep it from him.”

“Jab pataa chalega, sab hasenge mujhpe (Everyone will laugh when they find out),” he said.

The investigators

The criminals are changing their modus operandi constantly, so the officers who try to hunt them down must keep upgrading their skills, DCP Vinit Kumar told The Indian Express in his office at IFSO’s Dwarka building.

“All personnel receive five days of mandatory training before they are inducted, but our training never really stops,” he said. Investigators are required to attend weekly or bi-weekly courses on cybercrime at Central Detection Training School (CDTS) centres in Ghaziabad, Chandigarh and Jaipur.

The unit tries to use the latest technology in its work, including forensic servers, which are specialised computer systems that collect, analyse, and store vast amounts of digital evidence, portable forensic devices for on-site examinations, facilities to extract data from mobile phones, including highly encrypted data, and state of the art investigative software.

The unit currently has a strength of around 350, including five ACP-rank officers and 20 inspectors who report to the DCP and the Joint Commissioner of Police. As Internet fraud explodes, there are plans to expand the team.

The biggest difficulty is presented by the fact that almost all the leaders of the cyber crime syndicates are based overseas, DCP Kumar said. These principal actors plan the strategy to exploit individuals who are financially vulnerable, or those who are keen to make easy money. “Some of the participants [in the scam] know they are part of a syndicate; others do not,” another IFSO officer said.

Taking up the septuagenarian businessman’s complaint, the investigators quickly realised that the “company” and members of the WhatsApp group were fake, and that the crime was planned and executed from abroad.

“Technical investigation of the WhatsApp group members and website led us to Cambodia. Some persons, mostly the holders of mule accounts, who were arrested in India told us that the syndicate was led by a Chinese gang. These people claimed they had been invited by the masterminds to Nepal,” another officer said.

Efforts to trace the alleged accused through the Nepalese authorities drew a blank.

Once a victim has made their “investment”, the money is parked temporarily in one or more mule accounts, before it is converted to cryptocurrency and moved to foreign banks. In some cases, honey traps of various kinds are used to lure the victim, officers said.

The syndicate usually works in two teams that are in secret silos, with minimal interaction between them — one team does the research to identify the victim and interact with them, the other team recruits the mule account holders. “The teams usually never meet,” the second IFSO officer said.

Working fast is key to the success of the crime. The businessman’s money had been deposited in 26 bank accounts in six-seven transactions, and it was moved to more than 200 accounts within minutes, investigators said. In a couple of days, the amount had been split among 1,500 accounts, converted to crypto, and put in overseas bank accounts where, officers said, it was practically “untouchable”.

“By the time he (the victim) approached us, it was way past the golden hour (the first hour after the crime), and most of the money had been transferred into accounts in Cambodia and other locations overseas,” the officer said.

The 20-odd people that the police did get their hands on, were mainly the holders of mule accounts, and belonged to Rajasthan, Gujarat, Maharashtra, and Punjab. They turned out to be unemployed individuals, or farmers and daily-wage labourers.

The first arrest in the case was made in Surat in December 2024, and the most recent one, that of an unemployed man in Rajasthan, in the last week of November. “The scammers parked Rs 56 lakh in his account for a few hours. He was told the money was from online gaming, and that he would receive a commission for allowing the use of his account,” the officer said.

In the end, the police did manage to recover around Rs 1 crore by freezing some of the mule accounts.

The IFSO’s caseload has been rising steadily in recent months and years. Last year, cyber frauds adding up to almost Rs 1,000 crore were reported across Delhi. This year, until November, complaints adding up to more than Rs 1,200 crore have been reported. As cooperation and coordination with banks have improved and cases have moved faster through the courts, the recovery rate improved.

IFSO officers said they spend a lot of time out in the field, tracking down mule account holders, issuing summonses to suspects, and carrying out searches. “I am going to Karnataka today,” an IFSO sub-inspector told The Indian Express. “After that, there are three more cases linked to people from Tamil Nadu and Madhya Pradesh. I have to cover all these places in 14 days. And because of this assignment, I will end up missing court appearances in four other, separate cases,” he said.