The Golden Trojan: Exposing Industrial-Scale Telegram Scams

Context:

Note: This article tries to extensively cover a type of scam which actively makes use of Telegram in India

India is the first nation in the entire freakin world where you need not carry a cash wallet when you go out (except for emergency backup).

From a small street side snack vendor to big shopping malls, all of them have extensively integrated digital payment systems. (Thanks to cheap internet access and UPI a homegrown transaction system which charges nothing for transactions)

This changes happened in a matter of 2~3 years like a tsunami !!. As a result many where forced socially to onboard these systems without having sufficient awareness of these platforms and that’s a heaven for scammers

The Scam (Literally an art to be honest)

In the recent times I have been getting a couple of messages from international phone numbers through whatsapp, claiming to be a hiring official from xyz company and asking if I would like to earn money by doing simple tasks

A starting message to connect to victims through whatsapp

I decided to play along with them, to see where it goes (Remember I am a Sofware developer, it would be much easier for me to understand when to stop and what not to do, I dont recomend anyone else to do the same)

These simple tasks often involve asking the victims to like a bunch of youtube videos / instagram posts / visiting a website. And in return we get 150 Rupees for every 3 tasks completed. When asked for justification they just claim that they are a part of organization which actively works on improving the web traffic of certain influencer accounts and that they receive a commission for the tasks we do from the account holders

Justification Message from the Scammers

Looking at it from a layman’s perspective, the tasks and their reasoning appeared to be aligned. However, upon delving into the calculations, it became apparent that the cost of generating artificial web traffic through this method amounted to at least 50 Rupees (equivalent to half a US dollar) per view or like. To achieve 1000 views or likes, an influencer would need to spend 50,000 INR or 610.34 USD.

It became evident that this was an excessively expensive approach for just 1000 likes, thus solidifying the suspicion that the individual in question was a scammer. This realization further intensified my involvement in this situation.

Consequently, I agreed to undertake the tasks assigned to me and received a few of them from the individual.

Task1 from scammer

Task 2 from scammer

Task 3 from scammer

After task 3 completion the scammer sent me a so called “work code” and asked me to send it to a telegram user. This concept sending a work code made it all the more authentic

And this was the telegram user associated with it

And I started to message them

They asked me for my bank details such as

I conducted thorough research and found that the information provided is widely accessible to the public, and possessing this information alone does not grant anyone access to your bank account. Taking this into consideration, I decided to take a calculated risk and provided them with the requested information. It is important to note that the bank account I used for this purpose had an extremely low balance, minimizing the potential risks even further.

It is widely recognized worldwide that this entire situation raises suspicions, prompting scammers to go to great lengths to prove their legitimacy as a business. In some cases, they may even resort to actions that genuine companies would not undertake.

To my astonishment, they went above and beyond to prove their authenticity. I received 150 Rupees in my bank account as promised. To verify this, I checked my bank account app, and indeed, the amount had been credited.

In India, there are numerous legitimate startups that attract customers by initially offering cashback incentives. Consequently, when a scammer provides money, it becomes more challenging to draw immediate conclusions about their true intentions.

Initially, they managed to deceive me into believing they were a legitimate business. However, I soon began to question whether this could be a ploy to obtain a much larger sum of money.

As a spoiler, it turns out that they were indeed scammers. After receiving the initial payment, the contact on Telegram inquired if I was interested in earning even more money. Naturally, the prospect of earning easy extra income appeals to most individuals. Such questions tap into people’s deepest desires and make them more susceptible to manipulation.

I decided to join the group, ( the group link is now expired )

And this is how the group looked like

There were more than 151 members in the Telegram group. In the worst-case scenario, around 100 of them would be victims, while the remaining 50 would be actors involved in the scam.

Within this group, tasks were assigned every 15 minutes. Failing to complete a task resulted in a penalty, with the amount of money received being reduced as a consequence.

The first two tasks primarily involved visiting specific links and submitting a screenshot as proof of completion.

Subsequently, they introduced a new element known as the “prepaid task,” where participants were required to invest a certain amount of money. The scammers claimed that this investment would be used for trading and promised a return of the invested amount with a 30% interest within a mere 15 minutes. It is worth noting that even the most lucrative banks and mutual funds struggle to offer interest rates exceeding 11% annually, making the 30% return within 15 minutes seem highly suspicious.

Given the dubious nature of these activities, I decided against participating in the tasks and chose instead to observe the group closely. Some users within the group expressed concerns, leading them to propose starting with a small sum of 1000 Rupees. Within a few minutes, these users reported a return of 1300 Rupees. Meanwhile, other users were investing larger amounts, such as 3000 Rupees, and claimed to receive returns of 3900 Rupees.

To gather more information, I reached out to some of the individuals who were investing in the scheme. Out of the six people I messaged, five of them seemed to have fabricated names, mirroring my own situation. However, all five of them reported significant returns and enthusiastically encouraged me to invest in the scheme as well.

The sixth individual I contacted mentioned that he was a newcomer to the group. He received a joining bonus of 150 Rupees and made a return of 1300 Rupees from an initial investment of 1000 Rupees.

At this stage, the group started receiving a barrage of thank-you messages expressing gratitude for investment returns in varying amounts, such as 1000 Rupees, 3000 Rupees, 6000 Rupees, and more. It is worth noting that most of these messages seemed to come from the same five individuals I mentioned earlier. Feeling cautious, I decided to disable notifications and focus on my regular job, which provides me with legitimate income.

To my surprise, the next morning, the Telegram group had vanished from my chat list. Furthermore, out of the six people I had contacted, five of the chats had been deleted — specifically, the ones associated with the fabricated names.

The sixth individual reached out to me and revealed that he had been scammed out of 13000 Rupees. He earnestly requested that I refrain from investing any more money. Intrigued, I continued the conversation with him to gain a better understanding of what had transpired. Hearing his story left me with mixed emotions — I felt empathy for his unfortunate situation, admiration for the deceptive skills displayed by the scammers, and a touch of anger towards them.

The sixth person had witnessed numerous thank-you messages and decided to invest some money himself. He began with 1000 Rupees and received a return of 1300 Rupees. Encouraged by this initial success, he proceeded to invest 3000 Rupees, resulting in a return of 3900 Rupees. At this point, his net profit stood at 1200 Rupees, and it is important to note that he received all the money within a maximum span of 15 minutes.

Following this process, the dubious HR contact on Telegram instructed him to leave the group and register on a website that bore some resemblance to a trading platform.

Before proceeding with the registration on the website, the scammers requested the sixth individual to sign a few agreements. These agreements were feeble yet working attempts to portray themselves as genuine and legitimate.

Upon registering on the website, the original HR contact on Telegram was replaced by a new individual named Mr. Komar Sharma, who identified himself as an investment tutor. To our surprise, his profile featured a verified blue tick, which added an element of credibility or legitimacy, albeit falsely.

But I later realized that anyone can have a verified tick through the following route!!

From that point forward, Mr. Komar Sharma (@Komar_Tutor08) became the victim’s primary point of contact on the website. They instructed him to place an order for 3000 Rupees. Expecting to receive the promised returns as before, he patiently awaited the money to be returned. However, contrary to his expectations, he did not receive the funds back.

It was revealed that, according to one of the agreements he had previously signed, he was required to make a second transaction. Supposedly, the profits for both transactions would be provided once this additional transaction was completed.

Upon attempting to send 3000 Rupees again, the scammers informed him that it was not possible and that the minimum amount required for the transaction was actually 10000 Rupees. Trusting their instructions, he proceeded to make a transaction of 10000 Rupees as well. However, to his dismay, he did not receive the expected returns and principal amount as well.

Concerned about the issue, he approached his investment tutor, Mr. Komar Sharma (@Komar_Tutor08), seeking clarification and resolution for the problem.

As you can see, in order to recover his 13,000 Rupees, they asked him to make additional transactions called repair transactions, totaling 30,000 and 50,000 Rupees! Our friend woke up and realized it was a scam. He had lost a total of 13,000–1,350 = 11,650 Rupees.

If you carefully observe, the scammers made an investment of 1,350 Rupees and received back 11,650 Rupees. Remember that this amount came from just one person. There were over 151 members in the earlier group, and at least 120 members would have been genuine people and not actors. This means they would have collectively invested 120 * 180 = 21,600 Rupees (assuming an average expenditure of 180 Rupees per person).

It is likely that at least half of the members would have succumbed to the bait and suffered losses of at least 12000 Rupees each. This would result in the scammers earning approximately 720000 INR (7,20,000) from each batch of victims.

Furthermore, our victim’s sudden removal from the groups and the lack of response from his previous contacts indicate a well-orchestrated scam operation. The scammers have optimized their platforms to deceive new victims, extract money from them, and then swiftly cut off their access to the platforms. This process is repeated over and over again, starting from scratch with each new batch of victims.

This is an organized and industrial-level scam that demonstrates the scammers’ efforts to appear legitimate, surpassing the efforts made by genuine companies. It is crucial to raise awareness about such scams to protect potential victims from falling into their traps.

How can we catch them

All the international numbers used by the scammers can procured anonymously using apps like Hush, making it a useless point of traceback, they might have created the telegram accounts with the same numbers, so no point it tracking it either

However we are not clueless

We have 2 upi ids (basically transaction user names involved in the the UPI transaction protocol used in India)

Although these usernames are not easily traceable by the general public, companies such as Paytm and Google Pay might have the capability to assist in this regard. If anyone possesses the means to trace these usernames, we kindly request that they come forward. Having traceable information would greatly facilitate the process of filing a complaint with the cyber cell.

While there are brute force-based techniques available, it is important to note that they can be prohibitively expensive

Have a good day and stay awake!!