Ahmedabad, Aug 18 (PTI) A Rs 1.5-crore WhatsApp fraud has blown the lid off a cybercrime network spanning China, Pakistan, India and Hong Kong, with Ahmedabad Cyber Crime Branch securing more than 10,000 devices from potential “boss scam” and arresting two key SIM-and-OTP suppliers in West Bengal.

The arrested accused, identified as Imran Ali Piyada and Injammul Molla, were traced to West Bengal through technical analysis, according to a release issued by the Cyber Crime Branch on Tuesday.

The "boss" scam, also known as CEO impersonation fraud, is a sophisticated cyber fraud in which criminals impersonate senior company executives or officials of regulatory bodies such as the RBI or SEBI to deceive employees into transferring large sums of money or sharing sensitive company information.

The investigation began after an Ahmedabad-based businessman was allegedly duped of Rs 1.5 crore through a WhatsApp-based impersonation scam. The fraudsters initially posed as officials of the Reserve Bank of India and later impersonated officials of the complainant's company.

On June 23, an unidentified person sent a ZIP file to the complainant's mobile number via WhatsApp, claiming there were "unusual transaction activities" in the company's bank account and warning of possible restrictions or suspension by the RBI's Risk Control Department.

The fraudsters, posing as the company owner, then allegedly instructed the company's accountant to transfer Rs 1.5 crore to a bank account, according to the Cyber Crime Branch.

The complainant reported the fraud through the cybercrime helpline 1930, following which Rs 1.13 crore of the defrauded amount was recovered, officials said.

Based on technical analysis of mobile phone numbers, police traced and apprehended the two accused in West Bengal.

According to police, Piyada, an arts graduate and a Point of Sale (POS) agent for telecom service providers, allegedly misused customers' biometric fingerprints to obtain SIM cards and subsequently activated numbers on dummy SIM cards without their knowledge.

He allegedly supplied these numbers and WhatsApp accounts to cyber criminals and provided the OTPs required to activate the accounts.

Police said Piyada sold around 21,000 OTPs for e-commerce and online gaming applications over five years, earning more than Rs 21 lakh. He also allegedly sold around 900 OTPs used to activate WhatsApp accounts, earning more than Rs 2.25 lakh.

The second accused, Injammul Molla, allegedly coordinated with people involved in cyber fraud and assisted in providing mobile numbers, dummy SIM cards and WhatsApp-based communication systems used in the crimes, the police said.

The Cyber Crime Branch said 252 complaints had been registered with the National Cybercrime Reporting Portal across 26 states in connection with nearly 4,500 mobile SIM cards allegedly supplied to cyber criminals by the duo.

These included 194 online financial fraud complaints and three BOSS scam complaints, along with cases related to social media, hacking and other cyber offences.

Police said the operation also highlighted the emergence of "Cybercrime as a Service", where groups and links on online platforms, including WhatsApp, are allegedly used to openly buy and sell OTPs and other digital resources required for cyber crimes.

Technical and network analysis by the Indian Cyber Crime Coordination Centre (I4C) and the Ahmedabad Cyber Crime Branch indicated that the malware (for the boss scam) was suspected to have been developed by cyber criminals associated with China and used to target Indians through a call centre in Islamabad, the release said.

Bank accounts linked to the fraud were allegedly accessed through a China-based VPN service, while the investigation has preliminarily indicated the use of cyber infrastructure associated with China, India, Pakistan and Hong Kong to conceal the identities and locations of those involved.

Police said the coordinated action helped secure more than 10,000 infected devices from potential "BOSS scam" attacks and prevent possible losses running into crores. Malware identified through the Sahyog Portal is also being regularly blocked, they said.

The modus operandi involved sending a malicious ZIP file containing .exe and .dll files to company officials while impersonating RBI or government officials.

Once opened through WhatsApp Web, the files allegedly enabled criminals to gain control of the WhatsApp session and impersonate the company's CEO or director to instruct finance staff to transfer money.

Police seized seven mobile phones and a router, with a total estimated value of the seized property at Rs 19,500. Further technical examination of the devices is underway to identify other suspects and digital evidence, the release added.

Police advised citizens and companies not to open ZIP, .exe, .dll or .apk files received from unknown sources and to independently verify any request for financial transfers. PTI PJT PD NSK