Security Guidance

Online Sextortion: What You Need to Know and How to Protect Yourself

Online sextortion is a cybercrime where scammers blackmail victims using private or intimate content. It is punishable under IPC and IT Act provisions. Online sextortion happens when a scammer threatens to post your private and sensitive information online if you don’t provide them with money, sexually suggestive photographs, or sexual favours. In addition, if you don’t agree with their demands, the criminal may use information they have stolen from technological devices to threaten to damage your friends or family. Online Sextortion is a form of online abuse where a Online sextortion for cybercriminal uses social media, online dating apps, instant messaging apps, SMS, and porn websites, among other platforms, to trick users into participating in private audio or video conversations and coerce them into providing revealing images or posing nude. The con artists then utilize these resources to threaten, embarrass, harass, blackmail, and exploit the victims. Dangers Abuse and Exploitation Harassment Blackmail Threats of public humiliation Mental distress Modus Operandi The scammers utilize a variety of tactics to try to trick people into disclosing private information. posting messages for video/audio chat using fake accounts/profiles creating pages/ad campaigns The users get victimized when they pay for such services and pose nude or in a compromising position in video calls accepts or sends friend requests to the fake account/profile and is involved in intimate interaction posing nude in video chats, sending revealing pictures, etc., The scammer films video snaps screenshots, takes images, uses exposing images, or alters the given photos. The victim is blackmailed by the scammer, which leads to online sextortion. The users of porn sites may also fall prey to online sextortion when their chats/video calls on porn sites are used for blackmail by fraudsters. Channels used for trapping the victims into online sextortion The scammers use the above-mentioned method of operation to resort to online sextortion through a variety of avenues, such as Messaging apps Dating apps Social media platforms Porn sites etc., Warning signs indicate attempts of online sextortion by cybercriminals Repeated untoward messages/video calls from unknown number/s Repeated friend requests from an unknown person Repeated requests for private intimate pictures, video chats, photos Manipulating or redirecting the conversation toward intimate topics Rush through the things and try to develop intimacy Warning signs that may indicate victimization Signs of fear, nervousness, anxiety, depression Isolating self and being very reactive & emotional Feeling desperate and frustrated Having suicidal thoughts and self-harming behaviour. Safety tips to protect yourself against online sextortion Never share any compromising images, posts, or videos of yourself with anyone, no matter who they are Remember that the internet never forgets or forgives. Whatever you share once will always be there on the Internet in one form or another. Never accept or request friendship from unknown people on social media platforms. Turn on security and privacy options for your instant messaging apps and social media accounts. Use the “Report User” option on social media platforms to report any such Do not share your personal/private pictures publicly. When not in use, turn off your webcams and electrical devices. Use two-factor authentication with strong passwords and different passwords for different social media accounts. During an online interaction or chat, if the person on the other side is trying to rush through things and develop intimacy, then it is cause for alarm. Never let anyone use a device to record any intimate behaviour or private portion, no matter how close they are. Such data can be misused at a later stage. Never open attachments or answer video calls from strangers. Save the evidence and the screenshots for referring to the incident later. You are not alone, so don’t suffer in silence. Instead, ask for support from dependable friends and family. File a complaint against sextortion online or at your nearest cybercrime cell. Remember that you can also anonymously file an online complaint against such an offence on the national cybercrime reporting portal cybercrime.gov.in. Avoid taking private, nude, or semi-nude pictures or films using your phone as they could embarrass you if they are leaked. Several rouge mobile apps could access your gallery/storage and can be used to blackmail you. Don’t hesitate to file a complaint or contact the police due to shame, embarrassment, and self-blame. Know what the Law Says about this offence? It is a punishable offence by law and attracts sections 354 (D), 506 / 507, 509 IPC, and 384 IPC, and Sec.67 of the IT Act is also applicable. Criminals who commit such crimes typically profit from the victim’s silence and the ambiguity of the law. Everyone must therefore be aware of the portions and codes that will be useful to them in these situations. Criminal Procedure Code Section 108(1)(i)(a) enables the victim to contact the local magistrate and report the individual she feels may be spreading any pornographic material. The magistrate can arrest such a person or people and require them to sign a bond to prevent them from sharing the content. This might deter the accused. This is a quick remedial section because the victim can complain to the magistrate without any direct evidence against the accused. The Indian Penal Code’s (IPC) Section 292 incriminates anyone who uses apps or other social media to disseminate or threaten to distribute any compromising or intimate photos of another person. If a picture of the woman is clicked obscenely without her knowledge and is distributed, a voyeurism case under Section 354C of the IPC can also be filed along with the assistance of other pertinent Information Technology Act parts.

Beware of Romance Scams: Protect Yourself from Online Fraud and Heartbreak

Online romance scams involve fraudsters using fake profiles to deceive victims into sending money, leading to financial and emotional harm. Stay cautious, verify profiles, and report suspicious activities to avoid falling victim. In the current digital times, where even intimate relationships can be formed online, people must accept that all that meets the eye cannot be real in an online world. Instances of a prospective life partner you meet online turning out to be a fraudster and a seemingly reliable online friend becoming an offender abound. It is therefore essential that digital users exercise care and caution as well as become aware and alert while interacting online, to save themselves from a broken heart and hole in the purse. When a fraudster uses a phoney profile to trick a victim into parting with their hard-earned money under false pretences, it’s known as an online romance scam. Dangers Trapped in fake online relations Loss of Money Blackmail Heartbreak Depression Probable causes (of online romance scams) Relying on online dating ( platforms like Tinder, bumble etc., for partners. Fake profiles on matrimonial sites A rise in the use of extramarital dating apps like Gleeden and online social meeting apps like Facebook dating Loneliness or anxiety due to isolation, especially in COVID times Potential Victims Although anyone could become a victim of this fraud (Romance Scams), the following people are frequently seen as victims: Women * Middle-aged people * Widowers People with romantic idealization (Romance Scams). People with impulsiveness and relational addiction Modus Operandi A fraudster operating with a fake profile makes contact with a potential victim (and establishes a fake relation/bond.) Before registration, make sure the dating app (Romance Scams) or matrimonial website is legitimate, and create a new email address. The fraudster convinces or makes the victims obliged to send them money online using means like gift cards, UPI payment, bank transfer, reloadable debit cards etc., on some pretext. They may seek money due to emergencies like accidents, hospitalization etc., They may ask them to invest money in bogus schemes They may convince you about good investment schemes like cryptocurrencies etc., Over time after extracting the money, they may avoid the victim completely and dump them. (Intimate pictures shared during interaction may also be used by fraudsters to extort money from victims) Warning Signs Friend requests from unknown people Expressing feelings of affection and love too soon in an online relation Being very empathetic and obliging Avoiding meeting in person Mismatch in the details shared when verified closely Seeking financial help and making requests for money/gifts on some pretext. Hypothetical Case Study In her 30s, Lata worked as a professional software developer in Hyderabad. She had registered on a popular marriage website to find a decent and attractive mate. After Rohan contacted her, Latha checked his online profile and discovered that he was a senior official at a government organization with a wealthy and well-respected family. Impressed with the profile she pursued the match with the approval of her family. After some time Rohan requested Latha to help him with some money as he was in dire need of it. Trusting him, Latha helped him out with a lot of money. It was later on when suddenly Rohan went untraceable and had switched off his mobile totally, that she identified something was wrong. After approaching the police department, she came to know that ‘Raghuveer’ alias ‘Rohan’ was a fraudster who trapped women for money and committed crimes. Safety Tips Before registration, make sure the dating app (Romance Scams) or matrimonial website is legitimate, and create a new email address. It is preferable that you do not share your details like mobile no., residential address on matrimonial sites (Romance Scams) or dating sites openly/publicly. Never share any private picture bank account or other financial details with people you have met recently. Have a thorough end-to-end background check taking ample time before you decide to proceed in relation. You can also consider taking the help of an investigation agency. Be very cautious while considering a prospective groom with an NRI profile on a matrimonial site (Romance Scams). Always personally meet the person you have known online at a public place and ask them enough questions. Never accept money requests from strangers you meet online. Do not invest in schemes etc., as per the advice received by someone you only met online; be cautious of claims/requests of exclusive investment opportunities with urgency to act fast. Always keep a neutral person informed who can gauge and assess the interaction and advise logically. Never give your bank account details, passport or identification copies, or any other private information to an unknown online person or website. Enable required privacy and security features on social media platforms and keep your information private mostly. Ensure that you do not accept friend requests by strangers at face value without proper verification. Terminate the relationship and report it if you believe it to be a scam. File a complaint about the scam at your nearest cyber crime cell and online on www.cybercrime.gov.in portal. Report or Notify the scammer on the social media site, app, or service where the scam (Romance Scams) occurred, this may help others from being victims. In case you have shared any banking-related details, follow the rules and approach the bank for necessary action. Go easy on yourself, learn the lesson and move on

Protect Yourself Online Matrimonial frauds – Information Security Awareness

Online matrimonial frauds is on the rise these days, posing a huge threat to individuals looking for a partner through online platforms. Fraudsters take benefit of the vulnerabilities of unknowing people, causing them financial loss, emotional distress, and potential harm. Over two decades, online matrimonial sites have gained popularity in India where most marriages are still arranged by parents. The whole traditional matchmaking process changed and was set aside when the wave of online matrimonies came into existence. For Indian bachelors looking to explore and find a lifelong partner, online matrimonial sites offer the right fusion of modern technology and traditional Indian traditions. This increased demand for online services that run searchable databases of marriage-related content, such as Shaadi.com, Jeevansathi.com, and Matrimony.com Ltd. But, matrimonial sites are not completely safe. There is a possibility that you will regret not taking certain precautions. The number of people falling for marriage website scams has gone up. Dangers Financial Loss Emotional Manipulation: Identity Theft: Blackmail and Extortion: Vulnerable Groups: People Looking for Companionship: People who are searching for a relationship or who are emotionally fragile may be more prone to falling for fraudulent schemes and scams. Elderly People: Due to their possible substantial financial holdings and low understanding of contemporary technology, the elderly are frequently targeted since they may be more trusting and less accustomed to internet platforms. The present scenario Online matrimonial frauds Matrimonial sites come under ‘intermediaries’ within the IT Act 2000. They are responsible for the frauds that are perpetrated through their sites. Matrimonial sites. However these websites do not have any stringent KYC (Know Your Customer) procedures in place and hence readily accept documents/facts provided by fake profiles, which results in fraud being committed. With the increase in frauds through matrimonial sites, Cyber Law Due Diligence becomes a very important way to put an end to the use of matrimonial and dating sites as means of deception and fraud. The Information Technology Act, of 2000 is the Cyber Law of India that mandates observance of Cyber Law Due Diligence and Internet Intermediary Obligations in India. Cyber Law Due Diligence means taking proper and Reasonable Care and Caution while dealing with Online/Technological Transactions and Activities. Modus operandi With the minimal KYC/verification procedures in place to register on online matrimonial websites, the fraudster usually follows the following modus operandi: The fraudster initially creates a fake profile with attractive descriptions. In most cases, the person seems to be settled or working abroad, thus making actual meetings difficult. Later they look for gullible profiles to fall into their trick. In most cases, the targets are widows or divorced while some are elderly women looking for life partners. Also, they look for targets who are economically sound. Later, phone numbers, and email addresses are shared to increase personal communication and gain trust. Once the communication is established the fraudsters delete the profiles on the online matrimonial website and only communicate through phones, emails, or phone messengers. After gaining trust, money is demanded on various pretexts like customs clearance of costly gifts or as conversion charges for foreign currency, government clearance for diamonds, gold, or inherited wealth. All this money is asked as an online transfer and the person never meets the victim. Once they receive the money they never respond to the victim which makes it difficult to trace. Warning Signs Be alert to the red flags that can help you identify online matrimonial fraudsters: Are not willing to show their face and avoid face-to-face meetings, they are also reluctant to come on video chat, profile photo may not be theirs. Ask for a money transfer, citing some emergency, initially a small sum and later a large amount May not have a social profile or have few friends on social media Hesitate to share family/ workplace details Express “love” too quickly even before fully understanding each other The profile looks too good to be true for that person to express interest to you They call from multiple numbers. They usually don’t give a number to call back. Even if they give you a number, they don’t pick up when you call. Later, they call you back from a new number It sounds inconsistent or confusing when you ask for personal details, and their information is marked with inconsistencies. Are you in a mad rush for early marriage, without a valid reason Request for deletion of your profile immediately after getting in touch with you Ask for email username/ password or credit card/ bank account details Come up with false stories to gain sympathy How to save yourself Explore the various available online matrimonial websites Do a good Google search about the available Online matrimonial frauds platforms. Check for reviews from registered users and find a suitable one. Also, most matrimonial websites add a verified batch of profiles that are checked by their team. If you see a verified batch, you can go forward with the person without thinking much. Check out how genuine the website is before you register. Make sure the site has good reviews from registered members. Do a profile check. While you rely on online ways to find your life partner you must take this responsibility and do a thorough profile check. Check every detail carefully. Do a proper check on current and permanent address, education workplace etc. At any point you think there is a mismatch, feel free to question the other person. Once you decide to go ahead, find out whether details given about the individual’s qualification, job, family background and such details are indeed true to avoid regrets at a later stage. Verify the details mentioned in the profile you are interested in, and do a profile check on social media platforms for further information about the person. If you do not find details on any social media, it is a red flag Slow and steady wins the race Marriage is a lifetime decision and you cannot take a chance here. Life is not a race, ensure

“The WhatsApp Wedding Invitation Scam: How to Protect Yourself from Digital Fraud”

Sending wedding invitations is easier than ever. Digital invitations can easily replace traditional paper cards. However, this shift has opened doors for a dangerous trend: the WhatsApp wedding scam. Fraudsters are now using fake wedding invitations to target unsuspecting individuals, and you could be their next victim. In this article, you can get more information about fake wedding invitation scams. How the Fake Wedding Invitation Scam Works Imagine receiving a WhatsApp message from an unknown number. The sender claims to be inviting you to a wedding. The message feels genuine, with friendly language and attachments labeled as wedding cards. Without much thought, you tap on the file to see the invite. However, these attachments are not actual invitations but malicious APK files. Typically, APK or Android Package Kit files are used to install apps on Android devices. If these APK files are corrupted and you download and open them, you may unknowingly grant the scammers access to your device. The digital wedding scam feels personal and believable. Weddings are joyous occasions, and most people wouldn’t suspect foul play. Scammers exploit this trust to trick you into downloading malware. How a Fake Wedding Invitation Scam Can Lead to Financial Losses If you fall victim to this digital wedding scam, you could face financial losses in the following ways: Compromised Sensitive Banking Data: Through malware, cybercriminals can extract banking information you may have saved on your phone. This could include account numbers, card details, passwords to various financial accounts, payment details saved on browsers, and auto-fill credentials. OTP Theft: Scammers can use malware to intercept messages containing OTPs. This way, they can authorize unauthorized payments or money transfers. They can also gain access to your banking and payment apps. Exploiting Payment Apps: Malware can allow scammers to access banking and payment apps. They can use the information stored in the app to steal money from your accounts. Saved card details could be used to make fraudulent transactions. Unauthorized Subscription to Paid Services: Cybercriminals may use your compromised data to subscribe to premium services, apps, or websites. These services might charge recurring fees directly to your Credit or Debit Card. Hence, you ought to check your transaction history regularly to prevent scammers from draining your funds. Account Takeover: By hijacking your financial accounts, scammers can lock you out of your accounts and steal your money. They may also use your account to conduct fraudulent activities. Therefore, you must report this immediately and protect yourself from liabilities. Identity Theft: This digital wedding scam can also put your personal identification details at risk. Scammers can access these details saved on your phone and use them to open new accounts, apply for Credit Cards or loans, or impersonate you to commit fraud. Phishing: Malware can enable scammers to monitor your activities and create opportunities for phishing. This may include sending targeted phishing emails or messages to trick you into sharing more private information. Extortion: Fraudsters can use your data to blackmail you. They can demand ransom in exchange for not leaking sensitive photos and videos. This can lead to not only monetary losses but also emotional distress. How to Spot and Avoid the WhatsApp Wedding Scam By staying cautious, you can avoid falling victim to this fake wedding invitation scam. Here are some simple steps: Be Wary of Unknown Numbers: Be suspicious if you receive a message from a number you don’t recognize. Scammers often target random users, hoping someone will take the bait. Verify the Sender: Before downloading any file, confirm its authenticity. If it’s a wedding invitation, ask the sender directly—preferably through a call or message on another platform. Avoid Downloading APK Files: Typically, you’d receive wedding invitations in the form of images, video files, or URLs as they are convenient. Legitimate wedding invitations don’t require you to download separate apps. Use Antivirus Software: You can keep your phone secure with antivirus apps. These can detect and block malware before it causes harm. Enable Security Features: Review your phone’s permissions from time to time. Make sure your apps can’t access sensitive data without your explicit consent. How Do You Know Your Phone Has Malware? Your phone may be infected with malware if you notice the following: You notice an increased number of pop-ups and inappropriate ads. You see apps you haven’t downloaded or don’t recognize. You may not be able to uninstall unrecognized apps. You notice your phone slows down or crashes often. Your contacts may receive messages that you did not send. You may see unauthorized transactions in your account due to scammers using bank details saved on your phone to subscribe to paid services. What to Do If You’re a Victim Taking prompt action can minimize the damage against this fraud on WhatsApp: Disconnect Your Phone: You must immediately switch off Wi-Fi and mobile data to limit the hacker’s access. Change Your Passwords: Update all important accounts, especially banking, email, and social media, to prevent further misuse. Alert Your Contacts: If scammers are using your WhatsApp account to send fraudulent messages, inform your contacts not to engage. Report the Incident: Don’t let cybercriminals get away. Report the scam to authorities by dialing 1930, the National Cyber Crime portal helpline in India. You can also visit https://cybercrime.gov.in to complain. Protecting Yourself in a Digital World and Stay Vigilant As the use of digital platforms grows, scams like the WhatsApp wedding scam will only become more sophisticated. Staying informed is your best definition. *Disclaimer: Terms and conditions apply. The information provided in this article is generic and for informational purposes only. It is not a substitute for specific advice in your circumstances.

“Gmail’s Holiday Scam Defense: How AI is Keeping Your Inbox Safe”

As the holiday season kicks into full gear, so does a rising wave of email scams. Scammers seize this time of year, using deceptive tactics to trick people into giving away sensitive information or money. Whether it’s fake invoices, celebrity endorsements, or malicious threats, these fraudulent emails are everywhere. If you’re a Gmail user, you’re in luck. Google has ramped up its defenses, fighting back with new, innovative AI technology designed to protect billions of inboxes—especially during this high-risk season. Here’s a look at how Gmail is stepping up its game to combat these scams and what you can do to stay safe in your inbox. Scammers Go into Overdrive This Holiday Season Every year, as the holiday season approaches, email scammers go into overdrive. With billions of emails exchanged daily, especially during sales events like Black Friday and Cyber Monday, the sheer volume of email traffic presents a perfect storm for scammers to launch their attacks. Since mid-November, we’ve seen a massive uptick in suspicious email activity, making it even harder to spot malicious messages. It’s no surprise that scammers are targeting holiday shoppers—whether it’s an urgent invoice, an enticing offer from a “celebrity,” or a threatening message to extort money. The holidays make people feel hurried and vulnerable, making them easy prey for these deceitful tactics. Gmail’s Security Features: Keeping You Safe from Scams As the world’s largest email provider with over 2.5 billion users, Gmail recognizes the responsibility it has in keeping users safe. Over the years, Gmail has invested heavily in security measures to combat spam, phishing, and malware, blocking over 99.9% of these threats before they even reach your inbox. These efforts are especially crucial during the holidays, as the volume of attacks increases. Gmail has seen a 35% decrease in the number of scams reaching users’ inboxes this holiday season compared to last year. This improvement is largely thanks to new AI-powered features rolled out over the past year, which have made Gmail’s defenses stronger than ever. How AI is Transforming Gmail’s Defense Against Scams AI is at the heart of Gmail’s defense against scams, leveraging advanced models to protect users from a wide variety of threats. One such model is a large language model (LLM) that’s been trained to recognize the subtle patterns of phishing, malware, and spam. This AI has made a huge difference, blocking 20% more spam than ever before and reviewing 1,000 times more user-reported spam each day. This means fewer unwanted and potentially dangerous emails slip through the cracks. Additionally, a newly introduced AI model acts like a “supervisor” to help filter out risky messages. By instantly evaluating hundreds of threat signals when a suspicious message is flagged, it deploys protections in the blink of an eye, ensuring quicker and more effective detection of potential scams. Top Scams to Watch Out for This Holiday Season While Gmail’s defenses are stronger than ever, users need to stay vigilant. Scammers are always adapting and trying new tactics. Here are the top three email scams that are making waves this holiday season: Invoice Scams Scammers send fake invoices claiming that you owe money for a product or service. These emails often ask for urgent action, and scammers may even go as far as to convince victims to call and dispute the charges, using that connection to further trick them into making payments. Celebrity Scams Many scams this year feature celebrity names—whether pretending the email is from the celebrity themselves or claiming they endorse a product or service. The goal is to exploit the trust people have in famous personalities to convince them to act on fraudulent offers. Extortion Scams These vicious scams involve threats, such as emails with personal information (like your home address or even a picture of your house). Some of these emails include threats of harm or blackmail, demanding money in exchange for keeping supposedly acquired personal material secret. 4 Simple Tips to Stay Safe This Holiday Season While Gmail’s defenses are incredibly effective, scammers are always evolving. It’s just as important for you to be cautious when handling emails. Here are four simple tips to stay safe: Slow it Down Scams often create a sense of urgency with phrases like “immediate action required” or “deactivate now.” Take a deep breath and think through the message before you act. Spot Check Double-check the details. Does the email make sense? Validate the sender’s email address to ensure it’s legitimate. Scammers often use addresses that seem close to real ones but have small discrepancies. Stop! Don’t Send Legitimate companies or people will never demand immediate payment or personal information through email. If you’re unsure, don’t respond—just delete the message. Report Suspicious Emails If you spot a suspicious email, report it as spam or phishing in Gmail. Doing so not only helps protect you, but it also helps Gmail improve its security defenses for all users. Conclusion: Stay Safe and Secure with Gmail The holiday season may bring festive cheer, but it also brings an uptick in malicious email activity. Gmail’s new AI technology is designed to fight back against these threats, blocking millions of harmful emails before they reach your inbox. However, staying vigilant and following basic email security tips can further ensure that you don’t fall victim to scams. By working together—whether it’s Gmail’s powerful defenses or your awareness—you can keep your inbox secure this holiday season and beyond. Stay safe, stay informed, and report any suspicious emails to help keep the digital world safer for everyone.

How to Protect Yourself Social Engineering Cyber Fraud

The biggest weakness in a cybersecurity strategy is humans, and social engineering takes advantage of a targeted user’s inability to detect an attack. In a social engineering threat, an attacker uses human emotion (usually fear and urgency) to trick the target into acting, such as sending the attacker money, divulging sensitive customer information, or disclosing authentication credentials. What is Social Engineering? Social engineering is the technique where unscrupulous actors manipulate, deceive, or influence an individual into divulging confidential information like personal or financial information. These include bank account information, passwords, transaction history, social security numbers, etc. These techniques can also manipulate individuals into performing specific actions that “help” the fraudster. For example, if someone tells you to download a particular app or software or share an OTP you received. Social engineering, by itself, isn’t an attack. It is the art of using psychological tactics to build trust and then using that information to commit crimes like theft, money laundering, account takeovers, remote takeovers, etc. The Global Impact of Social Engineering Social engineering has become a key element in the landscape of cyber fraud. It has become the primary technique behind many attacks targeting individuals, businesses, and government organizations. A report by the Association of Certified Fraud Examiners (ACFE) revealed that businesses lose up to 5% of their revenue every year due to fraud, and a significant portion of these frauds can be attributed to social engineering tactics. In India alone, the Reserve Bank of India (RBI) reported an alarming increase in fraud, with digital frauds rising by over 700% in recent years. Social engineering is not limited to the financial sector, although that is where the majority of its consequences are felt. Cyber-attacks based on social engineering techniques have far-reaching consequences: In India, bank frauds increased by nearly 300% over the last two years, with a major surge in digital frauds. A LexisNexis survey found that digital channels were responsible for 52% of overall fraud losses across the EMEA region. Social engineering attacks affect both businesses and individuals. Not only do victims suffer financial losses, but they also face emotional distress, feelings of guilt, and a lack of trust. Victims often hold themselves accountable, particularly in lower-income households, where such attacks can have a devastating impact on family dynamics. For businesses, the consequences go beyond financial losses; the erosion of consumer trust and the potential for high customer churn are significant challenges. For instance, the LexisNexis survey highlighted that 96% of companies in the Middle East reported a drop in customer conversion rates after incidents of fraud. Social Engineering Examples Social engineering attacks can take many forms, targeting both individuals and organizations: On an Individual Level: A retired Indian Administrative Service (IAS) officer fell victim to a scam where he was tricked into investing in a fake forex trading scheme. He ended up losing nearly Rs. 1.89 crore to the fraudsters. On a Corporate Level: The CEO of OCBC Bank, Helen Wong, described how her company battled against sophisticated phishing attacks, resulting in fraudulent transfers amounting to millions of dollars. National Security Level: Russian hacking groups have reportedly targeted Ukraine with multiple spear-phishing campaigns aimed at disrupting national security. The ripple effect of social engineering is significant. Victims may unwittingly become money mules, transferring illicit funds to further criminal activities. The emotional toll, combined with the financial impact, can be long-lasting. Common Social Engineering Tactics Fraudsters employ a variety of social engineering tactics to manipulate their victims. Some of the most common methods include: 1. Phishing Phishing is one of the most prevalent social engineering techniques. Fraudsters send fraudulent emails that appear to be from legitimate sources. These emails often contain malicious links designed to: Direct victims to fake websites to steal login credentials. Download malware onto the victim’s device, leading to account takeovers. Phishing is not limited to emails; it also manifests in other forms, such as smishing (SMS phishing) and vishing (voice phishing). In India, where literacy and email usage are lower, vishing is particularly dangerous. 2. Whaling Whaling is a form of phishing that specifically targets high-profile individuals, such as CEOs or other executives. The emails are often meticulously crafted to appear as if they come from trusted sources within the company. The goal is to steal sensitive information or request financial transfers. 3. CEO Scam This scam involves fraudsters impersonating high-level executives of a company, often through email or text messages. Employees of the targeted company may be tricked into following directives from the supposed CEO, such as transferring funds or sharing sensitive data, under the belief that the request is legitimate. 4. Baiting Baiting involves offering something enticing, like free software, services, or rewards, to lure the victim into a trap. The “bait” might include malicious files, which when opened, compromise the victim’s device. Physical baiting involves leaving infected USB drives in public places, hoping someone will pick them up and plug them into a device, unwittingly exposing themselves to cyber threats. 5. Quid Pro Quo This tactic involves offering a service or benefit in exchange for personal or confidential information. For example, attackers may pose as IT support personnel, offering to help resolve technical issues in exchange for login credentials or other sensitive data. 6. Pretexting Pretexting involves creating a fabricated scenario to persuade the victim to share confidential information. This can involve impersonating trusted figures like police officers, bank officials, or colleagues. Over time, attackers build trust with the victim before executing their fraudulent schemes. Who are the Most Likely Targets of Social Engineering? While anyone can fall victim to social engineering attacks, certain groups are more vulnerable: The Elderly: Older adults are often less familiar with digital technologies and cybersecurity practices, making them more susceptible to fraud. Common scams targeting seniors include fake government agent impersonations and investment scams. Young Adults and Teenagers: While they may be more tech-savvy, younger individuals often lack experience and may fail to recognize sophisticated scams, such as fake job offers or lottery wins. Low-Income Individuals:

How to Protect Yourself Against the Growing Threat of AI Voice Cloning Fraud

Synopsis Voice cloning replicates your voice and can mimic the tone, pitch, and style of talking. Fraudsters use voice cloning to scam you into sharing sensitive information like your account details. Creating awareness and being alert can help you steer clear of vice cloning frauds. In recent years, advancements in artificial intelligence (AI) and machine learning have made it possible to replicate voices with stunning accuracy. Voice cloning technology can now replicate the tone, pitch, and style of your voice, even making it indistinguishable from the real thing. While these advancements are beneficial for various industries, they also open the door for potential fraud and scams. Fraudsters use this technology to impersonate others and trick victims into sharing sensitive information like passwords or bank account details. What Is a Voice Cloning Scam? Voice cloning scams involve fraudsters using AI to create a synthetic version of someone’s voice. The technology can accurately mimic not just the words but the unique qualities of a person’s voice, including tone, pitch, and speaking style. Scammers use this technology to impersonate trusted individuals, such as bank officials, family members, or colleagues, to deceive victims into taking harmful actions—like transferring money, sharing personal information, or authorizing transactions. While voice cloning can have legitimate uses in entertainment, education, and customer service, its misuse has led to serious concerns about privacy and security. It’s important to be aware of the risks and take steps to protect yourself. Key Risks of Voice Cloning Fraud Here are some of the primary risks associated with AI voice cloning fraud: Financial Fraud: Scammers can use cloned voices to impersonate bank officials, convincing victims to transfer money or reveal sensitive financial details. Since voice recognition is commonly used for identity verification, a cloned voice can bypass traditional security checks. Identity Theft: Cloned voices can be used to extract personal information, which may then be leveraged to steal someone’s identity. Fraudsters may impersonate you to access personal accounts or make unauthorized purchases. Corporate Espionage: Voice cloning technology can also be misused in corporate environments. Scammers may impersonate executives or employees to steal sensitive corporate information, potentially leading to significant financial or intellectual property losses. Social Engineering Attacks: By mimicking the voice of a trusted individual, scammers can manipulate you into actions you would otherwise avoid, such as disclosing passwords, making payments, or even sharing confidential business information. Protecting Yourself Against AI Voice Cloning Fraud While voice cloning scams are a serious threat, there are steps you can take to protect yourself. It requires a combination of technological solutions, awareness, and personal vigilance. Technological Solutions Voice Biometric Systems: Robust voice biometric systems are designed to detect synthetic voices and distinguish between real and cloned voices. These systems analyze various characteristics, such as speech patterns, rhythm, and tone, to authenticate a speaker’s identity. AI Fraud Detection: AI-driven solutions can identify anomalies in voice patterns and flag potential fraud. These tools use advanced algorithms to recognize subtle differences between a natural voice and a cloned one, helping prevent scams before they occur. Encrypted Communication Channels: Make sure your voice data is protected by encryption. This prevents voice samples from being intercepted and used to create voice clones. Secure communication channels ensure that any voice samples captured are safe from unauthorized access. Multi-Factor Authentication (MFA): Combining voice recognition with additional security measures, like passwords, biometrics, or One-Time Passwords (OTPs), can significantly strengthen security. Relying on voice alone is no longer enough—MFA provides a second layer of protection. Public Awareness and Education Raise Awareness: Public service announcements, workshops, and online resources can help individuals understand the risks of voice cloning. Awareness campaigns can empower people to take action before becoming victims of a scam. Train Employees: Companies, especially those in sensitive sectors, should train employees to recognize and respond to voice cloning attempts. This includes verifying callers and being cautious when handling financial transactions or sensitive data. Verify Caller Identity: Encourage people to always verify the identity of anyone calling, especially when they are asked to share sensitive information. Call the person back using a known phone number or request secondary verification methods before proceeding. Steps You Can Take to Protect Yourself Here are some simple yet effective steps you can follow to safeguard yourself from AI voice cloning fraud: Verify the Caller’s Identity: Always double-check the identity of a caller before sharing any sensitive information. If the caller claims to be someone you know, such as a family member or colleague, call them back on a trusted phone number. Be cautious when receiving unsolicited requests for sensitive information, especially over the phone. Be Mindful of Public Voice Sharing: Avoid posting voice recordings online or sharing them on social media, as these can be used to create clones. Be cautious with voice assistants like Siri or Alexa, which may store your voice data. Enable Multi-Factor Authentication (MFA): Whenever possible, enable MFA on your online accounts. Use a combination of factors—such as passwords, text message codes, and biometric verification—along with voice authentication for better protection. Update and Strengthen Your Passwords: Regularly update your passwords and use strong, unique passwords for each account. Avoid using easily guessable information like your name, birthdate, or common phrases. Monitor Your Bank Statements: Stay vigilant by regularly reviewing your bank statements and transaction histories. Report any suspicious activity immediately to your bank or relevant financial institutions. Stay Informed About New Technologies: Keep yourself updated on the latest developments in voice cloning and AI technology. Understanding how these technologies work can help you recognize potential threats and respond accordingly. Conclusion AI voice cloning offers great potential but also significant risks, especially in fraud and identity theft. Scammers use it to impersonate trusted individuals and trick victims into revealing sensitive information or authorizing transactions. To reduce the risk of falling victim to voice-cloning scams, stay informed and follow protective steps. Be proactive—use technological safeguards, raise awareness, and stay vigilant when sharing sensitive information. Always verify identities and be cautious of unusual requests. If you suspect fraud,

Beware of online sextortion: boys and girls

Online Sextortion occurs when a fraudster threatens to circulate your private and sensitive material online if you do not provide images of a sexual nature, sexual favors, or money. The perpetrator may also threaten to harm your friends or relatives by using information they have obtained from electronic devices unless you comply with their demands. Sextortion is a form of online abuse, wherein the cybercriminal makes use of various channels like instant messaging apps, SMS, online dating apps, social media platforms, porn sites, etc., to lure the users into intimate video/audio chats and makes them pose nude or obtains revealing pictures from them. The fraudsters later make use of this material to harass, embarrass, threaten, exploit, and blackmail the victims. Dangers Abuse and Exploitation Harassment Blackmail Threats of public humiliation Mental distress Modus Operandi The fraudsters try to lure the users into sharing intimate content in different ways posting messages for video/audio chat using fake accounts/profiles creating pages/ad campaigns The users get victimized when they pay for such services and pose nude or in a compromising position in video calls accepts or sends friend requests to the fake account/profile and is involved in intimate interaction posing nude in video chats, sending revealing pictures, etc., The fraudster records video/ takes screenshots/ takes pictures/makes use of revealing pictures/morphs the pictures sent The fraudster starts blackmailing the victim leading to sextortion. The users of porn sites may also fall prey to sextortion when their chats/video calls on porn sites are used for blackmail by fraudsters. Channels used for trapping the victims into sextortion The fraudsters resort to sextortion following the modus operandi given above using various channels like – Messaging apps Dating apps Social media platforms Porn sites etc., Warning signs indicate attempts of sextortion by cybercriminals Repeated untoward messages/video calls from unknown number/s Repeated friend requests from an unknown person Repeated requests for private intimate pictures, video chats, photos Manipulating or redirecting the conversation toward intimate topics Rush through the things and try to develop intimacy Warning signs that may indicate victimization Signs of fear, nervousness, anxiety, depression Isolating self and being very reactive & emotional Feeling desperate and frustrated Having suicidal thoughts and self-harming behavior. Safety tips to protect yourself against online sextortion Never share any compromising images, posts, or videos of yourself with anyone, no matter who they are Remember that the internet never forgets or forgives. If you have shared something once, it will remain present on the Net forever, in one form or the other. Never accept or request friendship from unknown people on social media platforms. Enable privacy and security features on your social media accounts and instant messaging apps. Use the “Report User” option on social media platforms to report any such Do not share your personal/private pictures publicly. Turn off your electronic devices and web cameras when you are not using them. Use two-factor authentication with strong passwords and different passwords for different social media accounts. During an online interaction or chat, if the person on the other side is trying to rush through things and develop intimacy, then it is cause for alarm. Never allow anyone, however close to capture any private part or intimate activity with any device. Such data can be misused at a later stage. Do not accept video calls or open attachments from people you do not know. Save the evidence and the screenshots for referring to the incident later. Do not suffer in silence, know that you are not alone, and reach out and seek help from trusted family and friends. File a complaint against sextortion online or at your nearest cybercrime cell. Remember that you can also anonymously file an online complaint against such an offense on the national cybercrime reporting portal cybercrime.gov.in. Avoid clicking intimate/nude/semi-nude photos/videos on your phone, which if leaked could cause embarrassment. Several rouge mobile apps could access your gallery/storage and can be used to blackmail you. Don’t hesitate to file a complaint or contact the police due to shame, embarrassment, and self-blame. Know what the Law Says about this offense? It is a punishable offense by law and attracts sections 354 (D), 506 / 507, 509 IPC, and 384 IPC, and Sec.67 of the IT Act is also applicable. Offenders in such crimes usually thrive on the victim’s silence and lack of clarity in the law. Hence, everyone needs to be aware of the codes and sections that will help them in such cases. Section 108(1)(i)(a) of the Criminal Procedure Code empowers the victim to call the magistrate of her locality and inform him/her about the person whom she believes could circulate any obscene matter. The magistrate has the power to detain such person(s) and can order him to sign a bond to stop him from circulating the material. This might deter the accused. This is a quick remedial section because the victim can complain to the magistrate without any direct evidence against the accused. Section 292 of the Indian Penal Code (IPC) incriminates any person who distributes or threatens to disperse any intimate and compromising images of someone through any electronic means, including apps and other social media. If a picture of the woman is clicked obscenely without her knowledge and is distributed, a voyeurism case under Section 354C of the IPC can also be filed along with the aid of other relevant sections from the Information Technology Act.

10 the Top News Stories and Cybersecurity of 2024

“Cyber Crime Theory to Practice – A Comprehensive Guide for Law Enforcement. (10)

The ransomware juggernaut rolled inexorably in 2024, yet again, leaving more devastated victims in its wake. This year, the UK’s NHS found itself at the receiving end of some particularly nasty attacks, but there were other high-profile victims as well. Meanwhile, state-backed cyber intrusions from China and Russia continued apace, driven by global geopolitical uncertainty. Many long-running cyber espionage campaigns were exposed. But if 2024 proved one thing only, it was that shining a light on the cyber underworld is working. The British are coming for the bad guys, as new attributions from the National Cyber Security Centre (NCSC), takedowns led by the National Crime Agency (NCA), and proposed legislation highlighting ransomware threats to critical sectors is proving. If 2024 is remembered for anything in the cyber community, it may just be the year in which the good guys took the gloves off and fought back properly. Here are Computer Weekly’s Top 10 Cyber Crime stories of 2024. British Library ransomware attack could cost up to £7m The effects of the British Library ransomware attack at the end of 2023 continued to be felt into 2024 as the venerable institution continued to struggle to bring its crippled systems back online. In January 2024, it emerged that the scale of the ransomware attack was so immense and its effects so devastating, that it could end up costing the British Library up to £7m, dwarfing the £650,000 ransom demand. Later in the year, in a remarkable display of transparency, the British Library’s leadership published a detailed breakdown of their experience at the hands of the Rhysida ransomware crew, to help others learn and understand. SolarWinds hackers attack Microsoft in apparent recon mission Also in January, Cosy Bear, the Russia-backed hacking outfit behind the SolarWinds Sunburst incident, was back in action, breaking into Microsoft’s systems with a brute force, password spraying attack and from there accessing corporate accounts belonging to leadership and security employees. Microsoft is one of some suppliers that finds itself at the receiving end of such intrusions, thanks in part to its global reach and scale, and its in-depth relationships with Western governments, and has faced tough questions over its security posture in recent years as a result. Lock Bit locked out in NCA-led takedown One of the biggest stories of the year unfolded dramatically on a dull February day when the infamous Lock Bit ransomware gang was taken down and its infrastructure hacked and compromised in Operation Cronos, led by the UK’s National Crime Agency (NCA). In the immediate aftermath of the takedown, Computer Weekly took the temperature of the security community, finding upbeat sentiment, but also tempered by the knowledge that one swallow does not make a summer. Throughout the year, the NCA has been sharing a trove of information it gathered during the exercise, as well as taking time to mock and troll Lock Bit’s leader since named as Dmitry Khoroshev, who at one time boasted of his luxury lifestyle as he toyed with law enforcement. Mandiant formally pins Sandworm cyber-attacks on APT44 group In April, threat intel leaders Mandiant formally “upgraded” the malicious activity cluster known as Sandworm to a full-blown, standalone advanced persistent threat (APT) actor to be tracked as APT44 – other companies have different taxonomies, Mandiant’s is alphanumeric. APT44 is run out of Russia’s Main Intelligence Directorate (GRU) within Unit 74455 of the Main Centre for Special Technologies (GTsST) and is described as one of the most brazen threat actors around. Although it confines its activities to those in service of the Russian state rather than financially motivated criminality, the links between cybercrime and cyber espionage continued to blur during 2024, with some nation-state APTs even acting as initial access brokers (IABs) for ransomware gangs. NHS services at major London hospitals disrupted by cyber attack In early June, a major cyber-attack on Synovia, a pathology lab services provider that works with Guys and St Thomas’ and King’s College hospitals in London, as well as other NHS sites in the nation’s capital, was laid low by a Qulin ransomware attack. This intrusion resulted in a major incident being declared in the NHS, with patient appointments and surgeries cancelled, and blood supplies running dangerously low. The ramifications of this truly callous cyber-attack are still being felt six months on. UK Cyber Bill teases mandatory ransomware reporting All eyes were on Westminster in July for the first King’s Speech held under a Labour government in over a decade, and for the security community, there was plenty to pick over as Keir Starmer’s administration proposed implementing compulsory cyber incident reporting – including ransomware – for operators of critical national infrastructure (CNI), in a new Cyber Security and Resilience Bill. According to the government, the law will expand the remit of existing regulation give regulators a more solid footing when it comes to protecting digital services and supply chains, and improve reporting requirements to help build a better picture of cyber threats. The Bill will likely be introduced to Parliament in 2025. NCSC and allies call out Russia’s Unit 29155 over cyber-warfare In September, the UK and its Five Eyes allies joined forces with the European Union (EU) and Ukrainian cyber authorities to highlight a dastardly campaign of cyber espionage conducted by Unit 29155, another Russian APT. Unit 29155 targets victims to collect information for espionage purposes, sabotages websites and daily operational capabilities and tries to cause reputational damages by selectively leaking important data. It has conducted thousands of exercises across NATO and the EU with a notable focus on CNI, government, financial services, transport, energy, and healthcare. It is also particularly notable for its involvement in the Whisper Gate campaign of destructive malware attacks against Ukraine in advance of the 2022 invasion. Money transfer firm MoneyGram rushes to contain cyber attack US-based financial services and money transfer outfit MoneyGram was another high-profile cyber attack victim to emerge in 2024, with its systems taken down in an apparent ransomware attack in September 2024. MoneyGram’s customers in the

Protect Yourself from Cybercrime in 2025

In 2025, cybercrime has become more complex, with new threats like AI-driven attacks, IoT vulnerabilities, and advanced ransomware emerging. To stay safe, it’s crucial to use strong passwords, multi-factor authentication, and encryption. As technology continues to evolve, balancing security with innovation is key to protecting ourselves. Introduction Welcome to the not-so-distant future: the year 2025. By now, we’ve seen an explosion of digital transformation across every industry and sector. The convenience of online services has grown significantly, but so have the risks. Cybercrime in 2025 has reached unprecedented levels of complexity and scale. Hackers are more cunning, and new forms of cyberattacks are emerging faster than ever. Are you ready for what’s coming your way? In this article, we’re about to unpack the ever-shifting world of cybercrime, focusing on the trends, threats, and solutions that define 2025. We’ll journey through the evolution of hacking, dive into the scariest new tactics criminals are using, and explore what governments and individuals can do to keep themselves safe. Ready to peer into the digital crystal ball? Let’s get started. The Evolution of Cybercrime The world of cybercrime is like a twisted carnival, morphing its attractions and illusions year by year. Oldies ransomware to hang on with the newbie Digital arrest and AI-enabled Deepfakes. Understanding how we got here is critical if we want to predict where we might end up next. Early Hackers In the earliest days of computing, hacking was more like an intellectual sport for tech enthusiasts. They broke into systems to show off their skills and explore the hidden corners of the digital realm. Think of these early hackers as curious adventurers rather than criminal masterminds. Over time, however, the novelty wore off, and malicious intent began to take shape. The “harmless” pranks of the past gradually paved the way for more nefarious schemes that now have global consequences. 2020s: A Decade of Transformation The 2020s were a turning point in cybercrime. Smartphones, social media, and cloud computing have become ubiquitous. Remote work soared in popularity, and digital communication replaced face-to-face encounters. With these changes, criminals found an open invitation to exploit human error and poor security practices. Suddenly, huge data breaches became the norm rather than the exception, and ransoms were demanded in Bitcoin rather than unmarked bills. By the time 2025 rolled around, hackers had upped their game with sophisticated toolkits, AI-driven attacks, and specialized criminal networks that span the globe. Emerging Threats in 2025 So, what do cyber threats look like in 2025? The short answer: sharper, smarter, and far more disruptive. Cybercriminals leverage cutting-edge technology and exploit societal trends, causing havoc for both individuals and organizations. AI-Powered Attacks Remember when we used AI mainly for chatbots and Netflix recommendations? Those days feel distant. In 2025, AI is a double-edged sword. On one hand, legitimate businesses use it to automate tasks and enhance customer experiences. On the other hand, cybercriminals deploy AI to conduct highly targeted attacks. Thanks to machine learning algorithms, phishing emails are more convincing, malware adapts in real-time, and intrusion attempts remain persistent yet stealthy. AI helps hackers automate reconnaissance, profile their victims in astonishing detail, and dynamically modify their strategies. It’s akin to battling an ever-evolving virus that learns from every defensive move you make. IoT Vulnerabilities Our world is packed with interconnected devices, from smart TVs and refrigerators to entire factories wired with sensors. While the Internet of Things (IoT) makes life more convenient, it also expands the potential attack surface exponentially. A single vulnerability in a connected device can provide a backdoor into the broader network, compromising everything from personal data to critical infrastructure. In 2025, criminals exploit IoT devices to orchestrate vast botnets, carry out data exfiltration, or even sabotage critical services. It’s like having a million tiny, unguarded windows in your digital fortress. Ransomware 3.0 Say goodbye to the days when ransomware simply locked your files. In 2025, criminals go beyond encryption. They threaten to publicly leak sensitive data, sabotage critical cloud systems, or even manipulate files in real-time, confusing what’s genuine and what’s corrupted. Some are calling this Ransomware 3.0—a vicious trifecta of encryption, public exposure, and data tampering. Victims face the ultimate dilemma: pay up or risk catastrophic damage to personal finances, reputations, or entire business operations. Cryptocurrency Heists With cryptocurrencies dominating the global financial landscape, it’s no surprise they remain a major magnet for cybercriminals. Far from being just about Bitcoin, a plethora of digital tokens are now in circulation. Criminals use sophisticated exploits to steal private keys, manipulate smart contracts, or hack crypto exchanges. This is the Wild West of the financial world, where the digital gold rush meets digital banditry. By 2025, we’re seeing elaborate networks of hackers targeting high-value wallets and decentralized finance (DeFi) platforms, leaving victims on shaky ground in a market famous for its volatility. Impact on Individuals You might be thinking, “I’m just an average person. Why would cybercriminals target me?” The truth is, in 2025, no one flies under the radar. It’s not just the wealthy or the high-profile individuals who face risks—everyone is a potential target. Identity theft remains rampant, with criminals siphoning off personal details to open lines of credit or commit fraud. Social media profiles become treasure troves for information, allowing hackers to guess security questions or craft hyper-targeted phishing attacks. Moreover, personal devices—phones, tablets, wearables—are more integrated into daily life than ever. A single click on a malicious link can give a cybercriminal access to personal photographs, financial accounts, and private communications. It’s like handing a stranger the keys to your home. The digital age has made everyday life easier, but it also requires us all to stay on guard. Corporate and Institutional Risks It’s not just individuals at risk. Large corporations and institutions are prime targets in 2025’s cybercrime arena because the payoff can be enormous. When a hacker gains access to a corporate network, the loot can include proprietary data, customer information, and massive financial sums. The result? Ransom demands can reach