How they actually get people.
Every one of these is running in India right now. The script barely changes - which is exactly why it is catchable.
Scam types
Device & Malware
- All scams
- Account Takeover & Identity10
- Advance Fee & Prize5
- Banking & Payments16
- Business & Corporate6
- Crypto2
- Device & Malware6
- Extortion2
- Government & Authority Impersonation13
- Investment & Trading12
- Jobs & Earnings6
- Loans & Credit1
- Relationship & Social3
- Shopping & Services8
- Tax, Insurance & Benefits4
- UPI & QR7
6 scams
Device & Malware · Mobile malware
Android Accessibility-Control Malware Fraud
A malicious Android app abuses accessibility permissions to gain persistent or extensive device control The objective is typically to take control of the device, steal data/authentication and facilitate financial fraud.
Also called Android God Mode malware, accessibility scam
Device & Malware · Financial malware
Banking Trojan Credential Theft
Malware is delivered to a device and is designed to steal banking or confidential information The objective is typically to steal credentials and confidential information for financial fraud.
Also called bank Trojan, banking malware
Device & Malware · Technology-brand impersonation
Fake AI App / Website Scam
A fake app or website impersonates a popular AI service or uses AI hype to attract users The objective is typically to steal credentials/payment data or compromise the device.
Also called AI tool phishing, fake ChatGPT app scam
Device & Malware · Apple-account/device fraud
iPhone Hybrid Phishing / Unauthorized Access Scam
A phishing campaign targets iPhone users and combines social engineering with device/account theft or unauthorized access The objective is typically to steal credentials/device access and enable unauthorized account or financial activity.
Also called Apple ID phishing, iPhone theft phishing
Device & Malware · Malicious extension
Malicious Browser Extension Scam
A browser extension that appears useful or legitimate is malicious The objective is typically to steal data/credentials or manipulate activity for cyber/financial fraud.
Also called browser plugin scam, malicious Chrome extension
Device & Malware · Malicious file delivery
Malicious Video-Conference Executable Scam
A malicious executable is distributed in the context of a video conference or collaboration interaction The objective is typically to infect the device and enable data theft, credential compromise or subsequent fraud.
Also called fake meeting update, video call malware
The tactics
Eight scripts that account for most of what lands on Indian phones.
The one that empties accounts fastestKYC / PAN / Aadhaar "expiry"
An SMS or WhatsApp from "your bank" says your KYC has expired and the account will be frozen within 24 hours. A link takes you to a page that looks exactly right, and asks for your card number, then the OTP.
The one that starts with ₹150 creditedPart-time task job
A WhatsApp message from an unknown international number offers ₹2,000-5,000 a day for liking YouTube videos or rating hotels. You’re moved to Telegram. The first three tasks pay real money into your account. Then comes the "prepaid task" - deposit ₹10,000 to unlock a bigger commission. Every deposit needs one more deposit to withdraw.
The one people are too embarrassed to reportDigital arrest
A call claiming to be CBI, Customs, or the Narcotics Bureau: a parcel in your name contained drugs, or your Aadhaar was used for money laundering. They move you to a video call with a fake police backdrop and keep you on it for hours, telling you not to contact anyone. Then they demand a "verification deposit" to a bank account.
The one that reverses the direction of moneyQR code "to receive"
You’re selling something on OLX or Facebook Marketplace. The "buyer" sends a QR code and says scan it to receive the payment. Sometimes they even send a small amount first to build trust.
The one that uses your own screen against youFake customer care + screen share
You Google a helpline number for a refund and land on a paid ad or an SEO’d fake page. The "agent" is helpful, then asks you to install AnyDesk, TeamViewer, or Quick Support so they can "process the refund faster". Once installed, they watch you type your PIN.
The one that looks like a favourWrong transfer / refund reversal
Money arrives in your account. A stranger calls, distressed, saying they transferred it by mistake and please send it back. The incoming money is often from a stolen account or a credit that will be reversed - you end up paying twice.
The one that ends in blackmailInstant loan apps
A loan approved in four minutes with no paperwork - but the app demands access to your contacts and photo gallery. Repayment terms turn out to be brutal, and when you fall behind, they message everyone in your contacts and send morphed photos.
The one dressed up as financial literacyWhatsApp trading group
You’re added to a group with a "SEBI-registered" analyst and hundreds of members posting screenshots of profits. The calls are free and seem accurate. Then comes an invitation to a private app with a special IPO allotment or block deal. The app shows your money growing. It just can’t be withdrawn.