Contents
- Telegram investment scam Kerala – fake SEBI / analyst group, small-profit trap
- Fake trading dashboard / app fraud – F&O / forex / crypto screen shows profit
- Prepaid-task / like-and-earn scam Kerala – recharge → commission → big deposit freeze
- Online job / work-from-home scam – registration fee + data-entry deposit
- Instant loan-app harassment Kerala – morphed contacts, Sachet/RBI check
- P2P crypto fraud Kerala – UPI paid, USDT never released / account frozen as mule
- Wallet-drain / seed-phrase scam – fake airdrop / support took seed or signed malicious approval
- Ransomware / data-encryption extortion – clinic / shop / startup system locked
- Business email compromise (BEC) Kerala – fake vendor / boss mail, invoice account changed
- Fake IPO / pre-IPO allotment scam – WhatsApp + UPI + "allotment fee
- Pig-butchering / romance-cum-investment scam Kerala – long grooming, then trading portal
- Accused-side defence in investment-case – mule / introducer / "profit sharer" arrayed
- Lien-mark on investment trail – victim request + bank response drafting
- Quash / discharge in failed-venture vs fraud allegation – genuine loss distinguished
- PMLA note in cyber-investment cases – when ED angle arises (general information)
- Fake advisory / "SEBI-registered" tip-seller verification path
- Crypto-exchange grievance + off-ramp freeze drafting (victim)
- Loan-app data-deletion / morphed-photo removal request
- Ransomware backup + business-continuity record for claim/insurance
- BEC vendor-verification control note (preventive information)
- Task-scam minor / student victim path – consent, custody of device, counselling record
- Cross-state investment FIR linkage – Kerala victim, outside-India handler
- Settlement / restitution in investment fraud – court-recorded payment
- Tax / bank-statement handling after fraud – explaining credits to bank/IT dept
Telegram investment scam Kerala – fake SEBI / analyst group, small-profit trap
Added to Telegram group, small withdrawals worked, large top-up blocked.
What it involvesFake admins, cloned profit cards, mule UPI/bank chain.
Relevant lawBNS 318(4), 319(2); IT 66D.
ForumCyber PS / CID Cyber; NCRP; bank nodal.
Procedure & stagePreserve group link, admin IDs/usernames, invite link, UTR chain; 1930/NCRP same day; BNSS 173 FIR.
RemedyMulti-hop lien; investigation; compensation.
High Court connectionHC writ for status where multi-bank lien stalls; bail/quash for wrongly arrayed mules.
Documents normally requiredChat export (dates), URLs, UTRs, statements, NCRP/1930 ack.
LimitationBank/CDR logs overwrite – act in days.
Related: Fake-dashboard; prepaid-task; pig-butchering.
Paid GST/tax to release?
That is the second trap – stop and report.
Fake trading dashboard / app fraud – F&O / forex / crypto screen shows profit
App/website shows growing balance but withdrawal needs "fee".
What it involvesNon-market backend; deposit to mule; no demat/ledger.
Relevant lawBNS 318, 61 conspiracy where invoked; IT 66D, 43.
ForumCyber PS; NCRP; intermediary takedown.
Procedure & stageAPK/URL preservation; domain/IP request via IO; bank chain freeze; BSA 63 for screen records.
RemedyTakedown + freeze + prosecution; compensation.
High Court connectionSec 69A blocking via statutory route; writ only for inaction after Rule 3(2) complaints.
Documents normally requiredAPK, URL, wallet/VPA/UTR list, dashboard video, NCRP set.
LimitationReport immediately – domain/APK logs and first-hop funds perish; no separate statutory period.
Related: P2P; wallet-drain.
App on Play Store – genuine?
Clones exist – verify SEBI registration separately.
Prepaid-task / like-and-earn scam Kerala – recharge → commission → big deposit freeze
Small tasks paid, then prepaid "merchant tasks" demanded; balance frozen.
What it involvesClassic task-fraud ladder; Telegram + fake portal.
Relevant lawBNS 318(4); IT 66D.
ForumCyber PS; NCRP.
Procedure & stageStop further top-up; preserve task portal login + wallet screens; FIR with full ladder table.
RemedyFreeze on recipient chain; investigation.
High Court connectionHC status-report direction where amounts spread across states.
Documents normally requiredTask screenshots, recharge UTRs, portal URL, chat export.
Limitation1930 golden hour – report immediately; RBI zero liability (third-party breach) needs notice to the bank within 3 working days of its alert (RBI Commercial Banks – Responsible Business Conduct Directions 2025, paras 67–70).
Related: Job scam; loan-app.
First profit credited – still fraud?
Yes – early Payout builds trust.
Online job / work-from-home scam – registration fee + data-entry deposit
Offer letter + fee for kit/training; salary never comes.
What it involvesFake HR, forged offer, fee extraction.
Relevant lawBNS 318, 319; IT 66D.
ForumCyber PS; NCRP; job-portal grievance.
Procedure & stagePreserve offer PDF headers, sender domain, fee UTRs; portal abuse report; BNSS 173.
RemedyFreeze + takedown + prosecution.
High Court connectionWrit for takedown inaction after platform notice.
Documents normally requiredOffer letter, domain headers, fee receipts, chats.
LimitationNo fixed statutory period – report immediately; portal/domain preservation is time-sensitive.
Related: Prepaid-task; BEC.
Agreement signed – bound?
Fraud vitiates consent – preserve and complain.
Instant loan-app harassment Kerala – morphed contacts, Sachet/RBI check
Small loan disbursed, then abusive recovery + contact-list threats.
What it involvesUnregistered lending app; excessive permissions; extortionary recovery.
Relevant lawBNS 308(2) extortion, 351 intimidation, 356 defamation where made; IT 66E, 67/67A where images misused; RBI digital-lending norms.
ForumCyber PS; RBI Sachet complaint; app-store grievance.
Procedure & stageRevoke permissions; preserve APK/lender details/recovery chats; NCRP; Sachet filing; BNSS 173.
RemedyLending-app inquiry; harassment prosecution; takedown.
High Court connectionHC writ where recovery threats continue after complaints; AB/bail on accused side.
Documents normally requiredAPK, lender name/account, chats, call logs, Sachet ref, statement.
LimitationApp-store/platform grievance – ack 24 hrs, resolve 7 days (IT Rules 2021 r.3(2)(a)(i), as amended w.e.f. 20.02.2026); morphed/intimate-image complaints – 2 hrs (r.3(2)(b)).
Related: Sextortion; defamation.
Repay to stop abuse?
Record first – repayment does not guarantee deletion.
P2P crypto fraud Kerala – UPI paid, USDT never released / account frozen as mule
P2P order paid by UPI; seller never released coin; or buyer's own bank frozen.
What it involvesOn-exchange P2P + off-exchange UPI leg; tainted-coin pass-through.
Relevant lawBNS 318/316 per role; IT 66D/43; PMLA angle where laundering alleged (separate note below).
ForumExchange grievance + Cyber PS + NCRP; bank for lien.
Procedure & stagePreserve P2P order ID, escrow screens, UTR, wallet addresses; exchange ticket + NCRP parallel.
RemedyEscrow hold / chain freeze; investigation; compensation.
High Court connectionDe-freeze writ where only tainted portion should remain under BNSS 106.
Documents normally requiredOrder ID, wallet addresses, UTRs, exchange tickets, NCRP.
LimitationExchange ticket + NCRP immediately; no fixed statutory period; ticket timelines per platform terms.
Related: Wallet-drain; lien; PMLA note.
Exchange says completed?
Escrow + UPI timing decides – preserve both.
Wallet-drain / seed-phrase scam – fake airdrop / support took seed or signed malicious approval
Shared seed / clicked "claim" and approved token allowance; wallet emptied.
What it involvesPrivate-key compromise; token-approval drain; on-chain tracing.
Relevant lawBNS 318; IT 66, 43, 66D; IT 66C where identity misused.
ForumCyber PS (chain-analysis capable wing); exchange where off-ramp.
Procedure & stageRevoke approvals; move residual; preserve TX hashes, phishing URL, approver contract; IO chain request.
RemedyOff-ramp freeze where identified; prosecution; compensation.
High Court connectionDirection for time-bound forensic/chain report where case stalls.
Documents normally requiredTX hashes, wallet addresses, phishing URL, approval screens.
LimitationOn-chain trace is time-sensitive – preserve TX hashes and move at once; no fixed statutory period.
Related: Phishing-header; ransomware.
Seed shared – recoverable?
On-chain reversal is not available – off-ramp freeze is the practical path.
Ransomware / data-encryption extortion – clinic / shop / startup system locked
Systems encrypted; demand in crypto for key; business halted.
What it involvesMalware ingress; backup + log preservation; no-payment assessment.
Relevant lawBNS 308 extortion, 324 mischief per loss; IT 66, 43, 66F where cyber-terrorism ingredients (rare, facts only). CERT-In Directions 28.04.2022 (IT 70B(6)) – covered entities must report listed incidents incl. ransomware within 6 hours of noticing.
ForumCyber PS; CERT-In incident report (Rule 3(1)(l) intermediary reporting duty; CERT-In Directions 2022).
Procedure & stageIsolate (not wipe); preserve logs/ransom note/wallet; CERT-In + FIR; FSL imaging under BNSS 106/105.
RemedyForensic + investigation; compensation; backup restoration.
High Court connectionHC writ for forensic direction; accused-side bail/quash where insider allegation.
Documents normally requiredRansom note, wallet, logs, backup status, asset list.
LimitationLogs rotate fast – image immediately.
Related: BEC; seizure-memo.
Pay ransom?
Generally avoid without IO/CERT guidance – payment rarely guarantees key and may repeat.
Business email compromise (BEC) Kerala – fake vendor / boss mail, invoice account changed
Accounts paid to new bank on mailed "revised" instructions; real vendor denies.
What it involvesSpoofed/look-alike domain; header forgery; mule account.
Relevant lawBNS 318, 319; IT 66D, 66C; IT 43.
ForumCyber PS; beneficiary bank (immediate lien); NCRP.
Procedure & stagePreserve.eml + headers; beneficiary-bank hold within hours; BNSS 173 FIR; domain takedown.
RemedyBeneficiary freeze; recovery per trail; prosecution.
High Court connectionHC commercial/writ overlap where PSU-bank freeze stalls – plead alternate remedy first.
Documents normally requiredOriginal.eml, headers, invoice versions, UTR, beneficiary details, NCRP.
LimitationBeneficiary-bank hold fastest within hours (1930 golden hour); no fixed statutory period.
Related: Phishing-header; domain-69A.
Employee fault – bank liable?
Depends on verification failure vs deception – record decides.
Fake IPO / pre-IPO allotment scam – WhatsApp + UPI + "allotment fee
Pre-IPO shares promised via WhatsApp; fee after fee; no allotment.
What it involvesUnregistered offering + UPI chain; fake allotment letters.
Relevant lawBNS 318; IT 66D; SEBI norms on unregistered solicitation (facts only).
ForumCyber PS; NCRP; SEBI SCORES where securities angle.
Procedure & stagePreserve letters, registrar claim verification, UTRs; parallel SEBI + police tracks.
RemedyFreeze + prosecution; compensation.
High Court connectionMulti-FIR consolidation/bail before HC where accused arrayed in several states.
Documents normally requiredAllotment PDFs, registrar reply, UTRs, chats.
Limitation1930 golden hour – report immediately; RBI zero liability (third-party breach) needs notice to the bank within 3 working days of its alert (RBI Commercial Banks – Responsible Business Conduct Directions 2025, paras 67–70).
Related: Investment-task; pig-butchering.
Allotment letter looks real?
Verify with registrar/RTA directly.
Pig-butchering / romance-cum-investment scam Kerala – long grooming, then trading portal
Friendly contact → trading tips → portal profits → large lock + tax demand.
What it involvesLong-con grooming + fake exchange; cross-border handlers.
Relevant lawBNS 318(4), 61 where conspiracy; IT 66D; BNS 308 extortion where threats extract money; BNS 78 (stalking)/79 (insult to modesty) only where their ingredients fit.
ForumCyber PS; NCRP; platform grievance for profile/number.
Procedure & stageFull chat export; portal/Wallet/UTR mapping; early multi-hop lien.
RemedyFreeze; investigation; victim-support record.
High Court connectionHC victim-writ for coordinated status across banks; accused extradition/MLAT is executive domain.
Documents normally requiredComplete chat, numbers/IDs, portal URL, TX/UTR list.
LimitationNo fixed statutory period – preserve full chat and report immediately; multi-hop lien fastest early.
Related: Sextortion; P2P.
Relationship genuine?
Grooming pattern matters – preserve full history, do not delete.
Accused-side defence in investment-case – mule / introducer / "profit sharer" arrayed
Person who only lent account or introduced friends is now accused.
What it involvesKnowledge vs use distinction; cooperation vs self-incrimination balance.
Relevant lawBNS 61/318/319 ingredients; BNSS 106, 183, 185 (statements/search); Art 20(3) Constitution.
ForumIO; Sessions/HC for bail; Magistrate/HC for quash.
Procedure & stageNo destruction; counsel-led statement; bail with cooperation; discharge/quash per record.
RemedyBail; discharge; Sec 528 BNSS quash where no prima-facie case.
High Court connectionCore HC-primary – AB/bail/quash drafting.
Documents normally requiredSource/purpose proof, chats, KYC, transaction purpose, lien notice.
LimitationNo fixed statutory period – file promptly; where custody continues, default bail if charge-sheet not filed within 60 days (90 days where offence punishable with death, life or 10+ years) – BNSS 187(3).
Related: Innocent-recipient; quash; PMLA.
Return money to close FIR?
Restitution does not auto-close crime – take advice before paying anyone except through court/IO.
Lien-mark on investment trail – victim request + bank response drafting
Bank says "police notice needed" while money moves on.
What it involvesVictim lien request + IO notice under BNSS; multi-hop follow-up.
Relevant lawBNSS 106 (seizure/report to Magistrate); RBI grievance channel.
ForumBank nodal; IO; Magistrate.
Procedure & stageWritten hold request with UTR/hop table; daily follow-up; insist on Sec 106 report filing.
RemedyDebit-freeze on trail; Magistrate oversight.
High Court connectionHC direction where lien amount lies without Magistrate report.
Documents normally requiredHop table, UTRs, bank/IO letters.
LimitationNo fixed statutory period – hold request + IO notice immediately; follow up daily.
Related: 14-day lien; de-freeze.
Phone request enough?
No – written trail with ack.
Quash / discharge in failed-venture vs fraud allegation – genuine loss distinguished
Business loss / delayed payout labelled cheating.
What it involvesBreach of promise vs dishonest intent at inception test.
Relevant lawBNS 318 ingredients; Sec 528 BNSS inherent powers; discharge under BNSS S. 262 (warrant-case discharge before the Magistrate).
ForumMagistrate (discharge); HC (quash).
Procedure & stagePaper-book – agreement, ledger, repayment attempts, contemporaneous record.
RemedyDischarge/quash where no dishonest inducement shown.
High Court connectionHC-primary quash – precise, not omnibus.
Documents normally requiredContracts, ledgers, bank entries, communications before dispute.
LimitationDischarge application – within 60 days of supply of copies (BNSS 262(1)); quash – no fixed period, move promptly.
Related: Settlement; PMLA.
Civil or criminal?
Both can coexist but criminal needs dishonest intent – fact record decides.
PMLA note in cyber-investment cases – when ED angle arises (general information)
Client fears/confused by ED summons after cyber FIR.
What it involvesPredicate-offence + proceeds-of-crime allegation; summons/compliance.
Relevant lawPrevention of Money-laundering Act 2002; BNS predicate; BNSS procedure.
ForumAdjudicating Authority (PMLA) / Special Court; HC writ/bail per maintainability.
Procedure & stageDo not ignore summons; counsel-led documents; separate cyber and PMLA files.
RemedyCompliance + bail/attachment challenge per statute.
High Court connectionHC for bail/quash-scope as permitted by PMLA jurisprudence on filing date.
Documents normally requiredFIR, bank trail, source proof, summons, prior replies.
LimitationSummons dates are strict – diary them.
Related: Lien; accused defence.
Cyber refund solves ED?
Separate tracks – coordinate but do not mix.
Fake advisory / "SEBI-registered" tip-seller verification path
Fee for tips/calls; losses; registration claim doubtful.
What it involvesSEBI IA/RA verification; unregistered advice.
Relevant lawSEBI registration norms for investment advisers/research analysts; BNS 318 where deception; IT 66D where online.
ForumSEBI SCORES; Cyber PS/NCRP where fraud.
Procedure & stageRegistration-number check; fee/UTR preservation; parallel complaints.
RemedyFee reversal claim + prosecution per facts.
High Court connectionWrit where regulator/bank silent after representation (alternate remedy first).
Documents normally requiredRegistration claim screenshot, fee UTRs, tip records, SCORES ref.
LimitationNo fixed statutory period – SEBI SCORES + police in parallel, immediately.
Related: Fake-IPO; investment-task.
Small fee – complain?
Yes – pattern builds multi-victim case.
Crypto-exchange grievance + off-ramp freeze drafting (victim)
Fraud coin moved to exchange; support slow.
What it involvesTX-hash + KYC-off-ramp request via IO + victim ticket.
Relevant lawIT 79 due-diligence + Rule 3 grievance; BNS/IT as applicable; BNSS 106.
ForumExchange grievance; IO; NCRP.
Procedure & stageTicket with TX hashes + FIR/NCRP; IO law-enforcement request to exchange.
RemedyOff-ramp hold; disclosure for trial.
High Court connectionHC direction for expeditious IO request where exchange awaits police channel.
Documents normally requiredTX hashes, exchange ticket, FIR/NCRP, BSA 63 for records.
LimitationExchange response windows are short – ticket immediately; no fixed statutory period.
Related: Wallet-drain; MLAT/cloud (where foreign exchange).
Exchange outside India?
IO/MLAT channel needed – timeline longer.
Loan-app data-deletion / morphed-photo removal request
Photos/contacts with lender after uninstall.
What it involvesRule 3 grievance + app-store + Cyber PS track.
Relevant lawIT Rules 2021 Rule 3 clocks (as amended by G.S.R. 120(E) dated 10.02.2026, w.e.f. 20.02.2026): ack 24 hrs; disposal 7 days (r.3(2)(a)(i)); 36-hr removal (proviso r.3(2)(a)(i)); 3-hr removal on court/government order (r.3(1)(d)); 2-hr intimate-image/impersonation (r.3(2)(b)); 72-hr assistance on written order (r.3(1)(j)); IT 66E/67/67A per misuse; DPDP direction evolving.
ForumLender grievance; Google/Apple grievance; Cyber PS.
Procedure & stageDeletion request + tickets; NCRP with APK proof; preserve abuse.
RemedyDeletion + takedown + prosecution.
High Court connectionInjunction/writ where intimate images persist.
Documents normally requiredAPK, account ID, deletion tickets, abuse screenshots, NCRP.
LimitationReport immediately – Rule 3 clocks above (as amended by G.S.R. 120(E) dated 10.02.2026, w.e.f. 20.02.2026); deletion/takedown target where listed content involved.
Related: Sextortion; injunction.
Paid – data deleted?
Not assured – pursue deletion in writing.
Ransomware backup + business-continuity record for claim/insurance
Insurer/bank asks proof of loss and steps.
What it involvesLoss ledger + forensic report + FIR + CERT reference.
Relevant lawPolicy terms + IT 43/66; BNS mischief/extortion. CERT-In Directions 28.04.2022 – covered entities must report listed incidents incl. ransomware within 6 hours of noticing.
ForumInsurer; IO; civil court if repudiation.
Procedure & stageLoss quantification; no-wipe imaging; claim with chain.
RemedyInsurance/contractual recovery; criminal track parallel.
High Court connectionHC writ only against public insurer arbitrariness; private insurer – civil/consumer.
Documents normally requiredLogs, forensic note, FIR, loss bills, policy.
LimitationCERT-In 6-hour reporting for covered entities (Directions 28.04.2022); insurance/civil claim periods per policy terms and the Limitation Act.
Related: Evidence; FSL.
Wiped and restored?
Note it – wiping weakens forensics/claim.
BEC vendor-verification control note (preventive information)
Business wants to avoid second BEC.
What it involvesCallback + maker-checker + domain-allowlist note for internal use.
Relevant lawContract + IT 43/66D context (preventive).
ForumInternal compliance; bank positive-pay where available.
Procedure & stageWritten SOP; no verbal account change.
RemedyPrevention; cleaner record if incident recurs.
High Court connectionNone directly – reduces litigation.
Documents normally requiredSOP, vendor master, change-log.
LimitationNo fixed statutory period – preventive note; review controls after any incident.
Related: Domain-69A; evidence.
One control?
Callback to known number + second approver.
Task-scam minor / student victim path – consent, custody of device, counselling record
Student hid loss; parents discover late.
What it involvesMinor-sensitive recording; device custody; school/support.
Relevant lawBNS/IT as applicable; BNSS child-sensitive procedure; POCSO only where sexual element (facts only).
ForumCyber PS; NCRP.
Procedure & stageCalm chronology; counsellor note; device preserved; FIR via guardian.
RemedyFreeze + investigation + support.
High Court connectionIn-camera / privacy prayers where applicable.
Documents normally requiredChats, UTRs, device, guardian ID.
LimitationNo fixed statutory period – report promptly with guardian.
Related: Student-mule; bullying.
Hide from record?
No – clean record helps school/bank leniency requests.
Cross-state investment FIR linkage – Kerala victim, outside-India handler
Money hopped to other states; local PS says "go there".
What it involvesZero-FIR + NCRP linkage + nodal coordination.
Relevant lawBNSS 173; IT 75 (extra-territorial); MLAT where foreign.
ForumHome Cyber PS + NCRP; coordination via higher cells.
Procedure & stageInsist on FIR + transfer memo, not refusal; share hop table.
RemedyUnified trail; status reports.
High Court connectionHC direction for coordination report where trail stalls.
Documents normally requiredHop table, NCRP numbers, transfer memos.
LimitationNo fixed statutory period – file FIR promptly where informed; linkage memos time-sensitive.
Related: Cloud-MLAT; writ.
File everywhere?
One FIR + linked NCRPs is cleaner than many FIRs.
Settlement / restitution in investment fraud – court-recorded payment
Accused offers refund for leniency; victim fears losing criminal leverage.
What it involvesCourt/IO-recorded restitution; compounding scope per offence.
Relevant lawBNSS 359 compounding tables – BNS 318(2)/319(2) by person cheated; 318(4) only with court permission; others per table.
ForumIO/Magistrate/trial court.
Procedure & stageWritten terms; court receipt; no private "settlement deed" alone for non-compoundable heads.
RemedyRecorded restitution; bail/conduct weight.
High Court connectionHC records compromise in quash where law permits.
Documents normally requiredTerms, IDs, payment proof, crime number.
LimitationNo fixed statutory period – terms per court/IO; compoundability per BNSS 359 tables.
Related: Quash; accused defence.
Cash settlement?
Avoid – bank channel + court record only.
Tax / bank-statement handling after fraud – explaining credits to bank/IT dept
Fraud credits + refunds confuse statements; notice arrives.
What it involvesSeparate fraud-ledger; CA note; reply with FIR/NCRP.
Relevant lawIncome-tax / bank KYC context (facts only); BNS/IT fraud record.
ForumBank/Dept reply; AO as applicable.
Procedure & stageFraud-ledger + FIR annexed; no mixing with business income.
RemedyClean explanation; avoids adverse inference.
High Court connectionWrit only on jurisdictional illegality after replies.
Documents normally requiredFraud-ledger, FIR/NCRP, bank letters, return notes.
LimitationReply within the period stated in the notice; keep the fraud-ledger current.
Related: CIBIL-next; lien.
Refund taxable?
Show as restitution with record – CA to certify.
