How an impoverished district in Haryana became a breeding ground for cybercriminals

At only 24, Shakil shouldered great responsibility. His family’s sole breadwinner, Shakil worked at a stone crusher plant. All he wanted was to pay his diabetic father’s mounting medical bills and see his sister, Shabana, married. But Shakil lost his job when the pandemic hit in 2020. Times became desperate and they called for desperate measures.

As the entire country went digital, Shakil turned to cybercrime. On April 28 this year, two months after Shabana was married, Shakil was arrested by the Haryana Police. Five mobile phones were found on his person. Stored in these were pornographic videos he showed unsuspecting victims while filming them. The police also found the texts he had sent as blackmail. Shakil’s modus operandi may seem rustic, but in rural Haryana, it was effective.

Shakil’s arrest was part of a larger raid. In their effort to uncover a cybercrime racket that had cheated 28,000 Indians of roughly Rs.100 crore, the Haryana Police arrested 66 people in Nuh, a southern district that shares a border with both Rajasthan and Uttar Pradesh. Those arrested were accused of cheating, forgery, impersonation, criminal conspiracy, extortion, theft and public obscenity. Some of them had also allegedly flouted provisions of the Arms Act. Varun Singla, Nuh’s Superintendent of Police, told Frontline, “There were a total of 28,000 complaints from victims spread across 35 States and Union Territories.”

The complainants were diverse. They included a doctor from Delhi, a student from Karnataka, a housewife from Panipat, a daily wage worker from Rajasthan and a driver from Madhya Pradesh. Some of them were promised work-from-home jobs, some were blackmailed with incriminating photographs, while others were duped by online advertisements for attractively-priced motorbikes and mobile phones. A staggering number of 1,346 cybercrime cases registered in recent months all seemed to trace back to Nuh.

A 75-km drive from Delhi, Nuh is visually defined by the single-storey houses that line its arterial roads. A large section of its Muslim-majority population depends on agriculture and animal husbandry for their livelihood. For those here who were grappling with economic uncertainty, the impact of the pandemic was sizeable. COVID-19 left several families penniless and hungry. As employment opportunities dwindled, many unemployed young men found themselves at a moral crossroads. Crime, as an option, seemed both easy and lucrative.

Many of the men the Haryana Police arrested in Nuh had returned home from other States, towns and cities where they were mostly doing menial jobs. “It was a time when many people became jobless on the one hand, and a lot of transactions began taking place digitally on the other,” says Singla. Aged between 18 and 35, the people arrested by Singla’s team largely do not have a criminal background. Like Shakil, they, too, have little formal education, and having lost work during the pandemic, they all tell a familiar story of desperation and greed.

Hardship of residents

Flanked by hills, Shakil’s village of Luhinga Kalan in Nuh is deceptively picturesque. The tranquillity is at odds with the hardship its residents suffer. Illiterate and unemployed in large numbers, many people here live below the poverty line. Clean drinking water remains elusive and the local salons that promise superstar makeovers seem like an aberration. Luhinga Kalan was one of the 40 villages along the Rajasthan-Haryana border that the police raided in April.

Shakil’s crimes may have been high-tech, but his house looks decidedly rural. Family meals are cooked on a clay stove and a buffalo is tethered in one corner of its tree-lined yard. The two small rooms of the house are freshly painted but sparsely furnished. Shakil’s father, Shahid, worked as a gardener in Saudi Arabia until a few years ago. “I had to return to India because of my diabetes,” he says. “After working for 10 years, I had some savings. I used that to get Shabana married and the house painted. It was not Shakil’s money.” Shakil’s mother, Nafisa, adds, “He wanted to study, but we did not have the money to educate him.” Though the Haryana Police have accused Shakil of cheating and forgery, his family insists he is innocent.

Declared by the police to be a sextortion hub, Luhinga Kalan neighbours other villages like Luhinga Khurd, Godhola, Jiwant, and Tirwara. They each specialise in different kinds of digital scams. Some are related to OLX and Facebook, while others involve misleading advertisements and fake online sales. Nuh has close to 400 villages and investigating agencies used mobile towers to zero in on the 40 villages they later raided. A district grappling with poverty, illiteracy, and a severe lack of resources, Nuh appears to have become a fertile breeding ground for tech-savvy scamsters.

ALSO READ: ED raid on loan apps reveals strong Chinese presence in crypto crimes

To nab the alleged culprits, the Haryana Police recorded phone conversations of the suspects. They followed leads given by sources in Nuh’s villages and looked for displays of newly amassed wealth. In some cases, the accused were implicated when they were reported to have bought new motorbikes or made other conspicuous upgrades to their lifestyle.

Not everyone in Nuh, however, attaches stigma to crime. Children in the district are often encouraged to earn money at a young age because of deprivation, and Nuh is no stranger to fraud and rackets.

Often used to describe swindlers, the word in the local dialect tatlu translates as “deceit”. In Nuh, stories of deception are legend. Tatlu gangs, for instance, would once entice hapless villagers by offering to sell them rice at significantly low rates. Once the victim would reach the agreed location, they would be robbed of all their possessions. Though there is evidence that a similar modus operandi is now being executed digitally, some residents decry police heavy-handedness. One says, “The police use force to scare entire villages. What are we to do?” The Haryana Police, for its part, claims to have now rid Nuh of all cybercriminals and miscreants.

Safe havens

According to Nuh SP, Varun Singla, Nuh’s criminals often use neighbouring cities—Uttar Pradesh’s Mathura and Rajasthan’s Alwar—as safe havens: “They know we will need permission from their State police to give chase. They use the technicalities and legalities of inter-State boundaries to their advantage.” While people in Mathura provide the knowhow for these scams, Rajasthan’s Bharatpur has the experts who procure fake documents and SIM cards. Besides the 140 fraudulent UPI accounts that surfaced during Singla’s investigation, the officer found a further 219 fake accounts that had been registered in Bharatpur’s banks.

In addition to those they apprehended in Nuh, another five to six individuals were arrested in Rajasthan and Uttar Pradesh. One of them, 22-year-old Vishnu, is from the village of Chirawal Mali in the Bharatpur district. Vishnu’s undergraduate degree once held much promise, but he is believed to have taken to crime after having exhausted all avenues. “He was a good kid, always interested in studies,” says Vishnu’s father, Bhawar Singh, sounding both proud and sad. Before the pandemic struck, Vishnu was preparing for a career in the police. “But he couldn’t find a job, not even with his degree,” adds his mother Sapna.

Vishnu was, at best, a small cog. He was hired by criminals to withdraw money from fake bank accounts. But like Vishnu, there are many others who squandered their potential by taking to crime. Zahul, for instance, was a truck driver, and Imitiaz, a carpenter. Ahsan earned a living by driving an auto. Cybercrime sent these men to jail but it also cost them their modest livelihoods.

Singla is at present heading a Special Investigation Team (SIT) comprising 40 cybercrime experts. He continues to conduct raids at places where absconding suspects are suspected to be hiding out. A few weeks after the April 28 raid, Singla arrested Shahzad, a 23-year-old from Kaithwara in Bharatpur. Back in his village, he was known as “OLXbaaz”. He was renowned for how he used OLX, a popular buy-and-sell digital platform, to ensnare his victims.

In an effort to earn trust, Shahzad would pose as an Indian Army soldier on OLX. More con artist than cyber expert, Shahzad persuaded people to pay a sum upfront for the products they wanted. Singla says, “He would upload pictures of cars, bikes and mobile phones on OLX for astonishingly low prices. Then he would call potential buyers and assure them the product would be delivered after they sent him a partial advance payment.” Shahzad would then disappear with the money. When he was arrested, the police found an iPhone 14 pro on him.

Before the pandemic, Shahzad earned a living by milking cows and buffaloes. His parents, Maimoona and Aash Mohammad, say he befriended the “wrong people”. Neighbours point to the several shops he bought in recent months. Their value is estimated at ₹20 lakh. Reportedly addicted to the energy drink Red Bull, Shahzad had begun flaunting his wealth with restaurant bills that ran into the thousands. According to Singla, Shahzad made lakhs by scamming people. And he was trained by others in the area: “One person in a village learns the con, and he then teaches it to others.”

These small-time crooks don’t answer to one kingpin, say police sources. And with most of the crimes localised, the culprits are hard to track down. Singla says the real challenge was to pinpoint the region from where the scams were originating: “Everything they used, from SIM cards to bank accounts, was fake. We went in different, often opposing directions, because no direct link to these suspects could be found in the initial investigation.”

Though they are said to have acted alone, the suspects were all part of a larger ecosystem that made easy the procurement of SIM cards and the opening of fake bank accounts. And their crimes at any rate did not require much capital. The “investment”—Rs.7,000 for a basic smartphone, Rs.1,200 for a SIM card, and Rs.18,000-25,000 for a fake bank account—seems affordable.

Singla believes that telecom service providers such as Airtel, Jio, etc. also need to clean up their act. He says, “SIM cards should be verified over a phone call. The OTP verification system is weak; people’s data can be easily misused. Criminals use the same address for 10 SIM cards, and it never gets verified. If the companies start checking every application thoroughly, they will find lots of loopholes. Errant distributors should be immediately blacklisted by telecom providers. It will discourage them.” The issue of fake SIM cards was brought up at a recent meeting where Department of Telecommunication officials met telecom service providers.

Amit Dubey, a Noida-based cyber expert, is of the opinion that the police themselves are not blameless: “Several cybercrimes have been linked together during this investigation. This suggests that the crimes are organised on some level. There are smart and educated people at the backend. Unless there is active help from the ecosystem, a steady supply of bank accounts and SIM cards on such a massive scale is impossible to hide. We cannot deny that a few local police officers might possibly be helping these criminals, mostly through neglect.”

Cybercrime, it must be noted, is in no way limited to Nuh. Singla’s SIT shared information about the 28,000 complaints they are investigating with other States. They are also coordinating and sharing information with income tax officials, the Enforcement Directorate, and other intelligence agencies. Nationally, the proliferation of cheap smartphones and the easy availability of mobile data has led to a rise in the number of online scams. An NCRB report finds that cybercrime complaints rose by 6 per cent between 2020 and 2021.

Also Read | Srinivas Kodali: ‘Anonymity on the Internet was by design’

In 2018, the Indian government set up an Indian Cyber Crime Coordination Centre with a proposed funding of Rs.415.86 crore. Its aim was to deal with cybercrime in a coordinated and effective manner. The central government has also announced initiatives that will help make police officials digitally literate, but funding and inertia continue to be challenges.

Though sextortion and OLX frauds are popular in Nuh, many more people in various parts of the country are being persuaded to divulge bank and credit card information over phone calls. These details are then used to make illegal withdrawals. When people are duped into thinking that they are being given work-from-home jobs, defrauders insist on seeing their Aadhar and PAN cards. Then there are fake government subsidy camps that trick villagers into sharing their Aadhar details.

As India hurtles towards a cashless economy with checks and balances not yet in place, a stage has been set that cybercriminals can easily claim as their own. Hobbled by penury and unemployment, there are many youngsters willing to give crime a shot. Nuh is only one epicentre. Cybercrime is clearly a headache that all of India will see even more of in coming years.