u/RubOwn7366

If someone you know sends you something like "hey, is this your photo?" on WhatsApp with a link, don't open it. CERT-In flagged this one last December and banks are still warning about it. It's worth understanding because it doesn't steal your password or OTP. It gets you to approve the scammer's device yourself.

How it works:

1. The message comes from a real contact whose WhatsApp has already been taken over. That's why it feels safe.
2. The link opens a page made to look like Facebook or a photo viewer. It asks you to "verify" before you can see the picture, and wants your phone number.
3. Meanwhile, the scammer opens WhatsApp Web on their own browser, picks "link with phone number" and enters your number. WhatsApp gives them an 8-digit code, which they show on the fake page.
4. The page tells you to enter that code in WhatsApp to finish verifying. You do.
5. Their browser is now one of your linked devices. They can read your chats and message your contacts as you, usually with the same photo bait or a request to borrow money.

There's also a QR version, where the page shows a WhatsApp Web QR code and asks you to scan it "to verify". Same result.

What makes it bad is that your phone keeps working normally. Nothing logs you out, so a lot of people only find out when a friend asks why they sent a weird link late at night.

To check right now, open WhatsApp > Settings (or the three-dot menu on Android) > Linked devices. If there's a browser or device you don't recognise, tap it and log out.

The rule to remember: only enter a WhatsApp pairing code or scan a WhatsApp QR when you're linking your own laptop or tablet. If a website, a "support agent" or anyone else hands you a code to put into WhatsApp, someone is trying to log in as you.

If it already happened to you:

- Log out the unknown device from Linked devices.
- Turn on two-step verification (Settings > Account > Two-step verification). It won't undo a linked device, but it makes it harder for someone to register your number on another phone.
- Tell your contacts to ignore money requests from you for a while.
- If anyone already sent money, they should call 1930 or file at cybercrime.gov.in quickly. Faster reports give a better chance of freezing the funds.

You can also report the original message on Chakshu through Sanchar Saathi.

If you've seen this with a different opening line, share it here (with names and numbers removed). The bait text changes but the code step stays the same.

If someone you know sends you something like "hey, is this your photo?" on WhatsApp with a link, don't open it. CERT-In flagged this one last December and banks are still warning about it. It's worth understanding because it doesn't steal your password or OTP. It gets you to approve the scammer's device yourself.

How it works:

1. The message comes from a real contact whose WhatsApp has already been taken over. That's why it feels safe.
2. The link opens a page made to look like Facebook or a photo viewer. It asks you to "verify" before you can see the picture, and wants your phone number.
3. Meanwhile, the scammer opens WhatsApp Web on their own browser, picks "link with phone number" and enters your number. WhatsApp gives them an 8-digit code, which they show on the fake page.
4. The page tells you to enter that code in WhatsApp to finish verifying. You do.
5. Their browser is now one of your linked devices. They can read your chats and message your contacts as you, usually with the same photo bait or a request to borrow money.

There's also a QR version, where the page shows a WhatsApp Web QR code and asks you to scan it "to verify". Same result.

What makes it bad is that your phone keeps working normally. Nothing logs you out, so a lot of people only find out when a friend asks why they sent a weird link late at night.

To check right now, open WhatsApp > Settings (or the three-dot menu on Android) > Linked devices. If there's a browser or device you don't recognise, tap it and log out.

The rule to remember: only enter a WhatsApp pairing code or scan a WhatsApp QR when you're linking your own laptop or tablet. If a website, a "support agent" or anyone else hands you a code to put into WhatsApp, someone is trying to log in as you.

If it already happened to you:

- Log out the unknown device from Linked devices.
- Turn on two-step verification (Settings > Account > Two-step verification). It won't undo a linked device, but it makes it harder for someone to register your number on another phone.
- Tell your contacts to ignore money requests from you for a while.
- If anyone already sent money, they should call 1930 or file at cybercrime.gov.in quickly. Faster reports give a better chance of freezing the funds.

You can also report the original message on Chakshu through Sanchar Saathi.

If you've seen this with a different opening line, share it here (with names and numbers removed). The bait text changes but the code step stays the same.

Once you've been scammed, your details go on a list. The list gets sold. Then the second wave starts, and it converts better than the first, because now you're desperate and you've already learned this stuff is real.

**How they find you**

Your number, the amount you lost, often your case number. Sometimes from the original fraud group. Sometimes scraped from complaint forums and comment sections where victims post details publicly.
Which is why: never post your phone number, case number or account details in a public thread. Not here, not anywhere.

**What the approach looks like**

1. "Cyber cell empanelled recovery consultant"
2. "Ethical hacker, I can trace the wallet"
3. A lawyer with a real-looking bar council number
4. Someone in a Telegram group posting screenshots of recovered amounts
5. Occasionally: someone impersonating a mod of a sub like this one

**The structure is always identical.** A small upfront fee for court filing, portal charges or blockchain tracing. Then progress. Then a bigger fee right at the moment of success: tax, clearance, unfreezing charge. The amounts escalate for exactly as long as you keep paying.

**Hard rules that will save you:**

1. Nobody legitimate cold-contacts a fraud victim. Ever.
2. Nobody can trace or reverse a UPI transfer for a fee. That service does not exist.
3. Real recovery happens through 1930, [cybercrime.gov.in](http://cybercrime.gov.in/) and your bank, and it is free.
4. Anyone asking for payment before recovering anything is scamming you.
5. Anyone needing remote access to "check your account" is scamming you.

If you get one of these, post the screenshot here.

The more of these get documented publicly, the fewer people fall for them.

Once you've been scammed, your details go on a list. The list gets sold. Then the second wave starts, and it converts better than the first, because now you're desperate and you've already learned this stuff is real.

How they find you

Your number, the amount you lost, often your case number. Sometimes from the original fraud group. Sometimes scraped from complaint forums and comment sections where victims post details publicly.
Which is why: never post your phone number, case number or account details in a public thread. Not here, not anywhere.

What the approach looks like

1. "Cyber cell empanelled recovery consultant"
2. "Ethical hacker, I can trace the wallet"
3. A lawyer with a real-looking bar council number
4. Someone in a Telegram group posting screenshots of recovered amounts
5. Occasionally: someone impersonating a mod of a sub like this one

The structure is always identical. A small upfront fee for court filing, portal charges or blockchain tracing. Then progress. Then a bigger fee right at the moment of success: tax, clearance, unfreezing charge. The amounts escalate for exactly as long as you keep paying.

Hard rules that will save you:

1. Nobody legitimate cold-contacts a fraud victim. Ever.
2. Nobody can trace or reverse a UPI transfer for a fee. That service does not exist.
3. Real recovery happens through 1930, [cybercrime.gov.in](http://cybercrime.gov.in/) and your bank, and it is free.
4. Anyone asking for payment before recovering anything is scamming you.
5. Anyone needing remote access to "check your account" is scamming you.

If you get one of these, post the screenshot here.

The more of these get documented publicly, the fewer people fall for them.

Once you've been scammed, your details go on a list. The list gets sold. Then the second wave starts, and it converts better than the first, because now you're desperate and you've already learned this stuff is real.

How they find you

Your number, the amount you lost, often your case number. Sometimes from the original fraud group. Sometimes scraped from complaint forums and comment sections where victims post details publicly.
Which is why: never post your phone number, case number or account details in a public thread. Not here, not anywhere.

What the approach looks like

1. "Cyber cell empanelled recovery consultant"
2. "Ethical hacker, I can trace the wallet"
3. A lawyer with a real-looking bar council number
4. Someone in a Telegram group posting screenshots of recovered amounts
5. Occasionally: someone impersonating a mod of a sub like this one

The structure is always identical. A small upfront fee for court filing, portal charges or blockchain tracing. Then progress. Then a bigger fee right at the moment of success: tax, clearance, unfreezing charge. The amounts escalate for exactly as long as you keep paying.

Hard rules that will save you:

1. Nobody legitimate cold-contacts a fraud victim. Ever.
2. Nobody can trace or reverse a UPI transfer for a fee. That service does not exist.
3. Real recovery happens through 1930, cybercrime.gov.in and your bank, and it is free.
4. Anyone asking for payment before recovering anything is scamming you.
5. Anyone needing remote access to "check your account" is scamming you.

If you get one of these, post the screenshot here.

The more of these get documented publicly, the fewer people fall for them.

Save this before you need it. If you’re in it right now, start at the top and don’t read ahead.

FIRST 10 MINUTES

Call 1930, the National Cyber Crime Helpline. This starts the process that can freeze the money downstream. Do it before anything else, even before your bank.

Call your bank’s fraud number. Say: unauthorised transaction, please freeze my account and block my cards. Note the reference number and the time.

Do not call any number the scammer gave you.

FIRST HOUR

File at cybercrime.gov.in, financial fraud category. Save the acknowledgement number, every other agency will ask for it.

Change your net banking password and UPI PIN, from a different device if possible.

If you installed an APK or gave remote access via AnyDesk, TeamViewer or QuickSupport: airplane mode, then uninstall. Assume every OTP that reached that phone was read.

FIRST 24 HOURS

Screenshot everything before it vanishes. Chats, numbers, UPI IDs, transaction IDs, the app, the website. Deleted WhatsApp groups are gone forever.

Report the number at sancharsaathi.gov.in so the SIM gets flagged.

Written complaint to your bank branch. Get it stamped. Email is fine but keep a paper trail.

If UPI was involved, raise a dispute with the app as well as the bank.

Go to your local cyber crime cell with the acknowledgement number and printouts. If they push back, that acknowledgement number is what makes it hard to refuse you.

NEXT FEW DAYS

Check your credit report for loans opened in your name.

If an APK was installed, factory reset the phone.

Tell one person you trust. Not for the money. For you.

THEN, THE PART THAT ISN’T ABOUT MONEY

People will now approach you offering recovery. They’ll know details about your case, because victim lists get sold. Every one of them is a second scam. No genuine agency, lawyer or ethical hacker cold-calls victims. If money comes back, it comes back through the bank and the 1930 process, slowly, and nobody charges you upfront for it.

And this was not your fault. These are full-time professionals running scripts tested on thousands of people. Getting hit by one says nothing about your intelligence.

Save this before you need it. If you’re in it right now, start at the top and don’t read ahead.

FIRST 10 MINUTES

Call 1930, the National Cyber Crime Helpline. This starts the process that can freeze the money downstream. Do it before anything else, even before your bank.

Call your bank’s fraud number. Say: unauthorised transaction, please freeze my account and block my cards. Note the reference number and the time.

Do not call any number the scammer gave you.

FIRST HOUR

File at cybercrime.gov.in, financial fraud category. Save the acknowledgement number, every other agency will ask for it.

Change your net banking password and UPI PIN, from a different device if possible.

If you installed an APK or gave remote access via AnyDesk, TeamViewer or QuickSupport: airplane mode, then uninstall. Assume every OTP that reached that phone was read.

FIRST 24 HOURS

Screenshot everything before it vanishes. Chats, numbers, UPI IDs, transaction IDs, the app, the website. Deleted WhatsApp groups are gone forever.

Report the number at sancharsaathi.gov.in so the SIM gets flagged.

Written complaint to your bank branch. Get it stamped. Email is fine but keep a paper trail.

If UPI was involved, raise a dispute with the app as well as the bank.

Go to your local cyber crime cell with the acknowledgement number and printouts. If they push back, that acknowledgement number is what makes it hard to refuse you.

NEXT FEW DAYS

Check your credit report for loans opened in your name.

If an APK was installed, factory reset the phone.

Tell one person you trust. Not for the money. For you.

THEN, THE PART THAT ISN’T ABOUT MONEY

People will now approach you offering recovery. They’ll know details about your case, because victim lists get sold. Every one of them is a second scam. No genuine agency, lawyer or ethical hacker cold-calls victims. If money comes back, it comes back through the bank and the 1930 process, slowly, and nobody charges you upfront for it.

And this was not your fault. These are full-time professionals running scripts tested on thousands of people. Getting hit by one says nothing about your intelligence.

Everyone’s heard the phrase. Almost nobody knows the script, which is the part that matters, because the script is what makes a careful person hand over their retirement savings.

**Stage 1: the courier call.**
Automated voice. A parcel in your name has been seized. Press 1 for an executive. The executive sounds bored and bureaucratic. That’s deliberate. Boredom reads as real. Enthusiasm reads as sales.

The parcel contains drugs, passports and SIM cards. Always that inventory. Usually bound for Taiwan or China.

**Stage 2: the handoff.**
You’re “transferred” to the cyber crime branch of a real city’s police. You were never disconnected. You now have a case number and your Aadhaar has apparently been used in a money laundering case.

**Stage 3: the uniform.**
Skype or WhatsApp video. A backdrop that looks like a police station, sometimes a printed one. Uniform, name plate, wall logo. They send a “warrant” or “RBI notice” as a PDF with your real name and Aadhaar number on it. That’s the moment most people stop doubting.

With AI voice cloning now cheap, expect the officer to sound like whoever they need to sound like.

**Stage 4: isolation. This is the actual attack.**
The investigation is confidential. Discussing it with family makes them accessories. Stay on camera. Don’t leave the room. Don’t hang up. People have stayed on these calls for days, eating and sleeping in frame.

Everything before this was set dressing. This stage is the whole scam. It doesn’t work if you speak to one other human being, so the entire design exists to make sure you don’t.

**Stage 5: “verification of funds.”**
Never framed as a bribe. Your money must move to an “RBI verification account” and returns after clearing. Sometimes they’ll ask you to break FDs for the audit. Often they send a small amount back early to prove good faith, which unlocks the large transfer.

**Why it works on smart people:** it doesn’t need you to be greedy. It makes you frightened, then alone, then obedient. Fear plus isolation plus authority beats intelligence every time.

**The permanent tells:**

\*\*•\*\* No Indian police, CBI, ED or RBI officer investigates over video call
\*\*•\*\* Digital arrest, online custody and house arrest by video do not exist in Indian law
\*\*•\*\* No agency asks you to transfer money for verification
\*\*•\*\* Real notices arrive on paper, at your address, through channels you can verify independently
\*\*•\*\* Anyone telling you not to speak to your family is the crime

**If it’s happening right now:** hang up. You’re allowed to. Then call 1930 and tell one family member.

Everyone’s heard the phrase. Almost nobody knows the script, which is the part that matters, because the script is what makes a careful person hand over their retirement savings.

Stage 1: the courier call.
Automated voice. A parcel in your name has been seized. Press 1 for an executive. The executive sounds bored and bureaucratic. That’s deliberate. Boredom reads as real. Enthusiasm reads as sales.

The parcel contains drugs, passports and SIM cards. Always that inventory. Usually bound for Taiwan or China.

Stage 2: the handoff.
You’re “transferred” to the cyber crime branch of a real city’s police. You were never disconnected. You now have a case number and your Aadhaar has apparently been used in a money laundering case.

Stage 3: the uniform.
Skype or WhatsApp video. A backdrop that looks like a police station, sometimes a printed one. Uniform, name plate, wall logo. They send a “warrant” or “RBI notice” as a PDF with your real name and Aadhaar number on it. That’s the moment most people stop doubting.

With AI voice cloning now cheap, expect the officer to sound like whoever they need to sound like.

Stage 4: isolation. This is the actual attack.
The investigation is confidential. Discussing it with family makes them accessories. Stay on camera. Don’t leave the room. Don’t hang up. People have stayed on these calls for days, eating and sleeping in frame.

Everything before this was set dressing. This stage is the whole scam. It doesn’t work if you speak to one other human being, so the entire design exists to make sure you don’t.

Stage 5: “verification of funds.”
Never framed as a bribe. Your money must move to an “RBI verification account” and returns after clearing. Sometimes they’ll ask you to break FDs for the audit. Often they send a small amount back early to prove good faith, which unlocks the large transfer.

Why it works on smart people: it doesn’t need you to be greedy. It makes you frightened, then alone, then obedient. Fear plus isolation plus authority beats intelligence every time.

The permanent tells:

**•** No Indian police, CBI, ED or RBI officer investigates over video call
**•** Digital arrest, online custody and house arrest by video do not exist in Indian law
**•** No agency asks you to transfer money for verification
**•** Real notices arrive on paper, at your address, through channels you can verify independently
**•** Anyone telling you not to speak to your family is the crime

If it’s happening right now: hang up. You’re allowed to. Then call 1930 and tell one family member.

Somewhere in India right now there is a woman being told that a shipment of pencils cannot leave the warehouse until she pays for the GPS tracker.

Not a GPS tracker for a vehicle. For pencils.

She paid it. Twice, actually, ₹4,150 on two occasions, and then another ₹6,000 for “GST filing.” That’s a real complaint, filed by a real person, and it is not even the most expensive version of this.

The offer

You’ve seen the ad. Facebook, Instagram, WhatsApp forward, sometimes a website that looks almost right. Pack Nataraj pencils at home. ₹30,000 a month. ₹15,000 paid in advance. Material worth ₹2 lakh delivered to your door, pack it whenever you like over two weeks, free pickup and drop, jobs available all over India.

It’s a beautiful pitch. No experience, no commute, no boss. Aimed with real precision at homemakers, students, and anyone who needs income that fits around a house.

Small problem

Hindustan Pencils, the company that actually makes Nataraj, has said repeatedly that it offers no such job, because the packaging is fully automated. Machines. No human hands in the process at all.

They have put out videos in multiple languages saying so. They’ve taken legal action. They’ve pointed out that scammers are using their real registered office address and photographs of their actual employees to sell this. Their staff spend their working days fielding calls from people asking if the pencil job is real.

The scammers kept running it anyway, because it works.

The ladder

Nobody asks you for ₹15,000 upfront. That would be stupid. Instead:

₹750 for the ID card. The ID card gets “generated,” which feels like progress. Then ₹3,500. Then a courier charge of ₹5,120. Then a delivery charge of ₹7,500. One person had lost ₹9,120 before the demands even stopped arriving.

Then, depending on the operator: GST filing charges. Insurance on the material. A refundable security deposit. A GPS tracker.

Every single fee is small compared to the ₹2 lakh of stock supposedly sitting in a van outside your city. That’s the whole design. You’re never asked to risk a lot. You’re asked to risk a little, repeatedly, to protect something that doesn’t exist.

And here is the part that keeps people paying long past the point of doubt: you have already spent money. Walking away means admitting the ₹750 is gone. Paying ₹3,500 means it isn’t. That’s not stupidity, that’s how sunk cost works on everybody.

The deepfake

The upgrade nobody saw coming. A video went viral of a woman in police uniform explaining the pencil packing job, complete with the ₹30,000 salary, the ₹15,000 advance, and a number to call. The woman was IPS officer Ankita Sharma, then ADCP South in Kanpur. She never said any of it. Her voice was generated with AI and dubbed over real footage of her.

So the scam now recruits using a police officer telling you it’s legitimate. Which, admittedly, is a hell of a closing argument.

How to check any work-from-home offer in thirty seconds

**• A real employer never charges you to work.** No registration, ID card, deposit, courier, GPS, GST, insurance, training or “validation” fee. Not ₹50, not ₹5,000. This single rule kills 95% of job scams.
**•** Real companies post on their own website or LinkedIn page, not through a WhatsApp number.
**•** No manufacturer ships ₹2 lakh of inventory to a stranger who has provided no collateral and no contract.
**•** If the “HR” contact is a personal WhatsApp number with a DP of an office building, it’s a scam.
**•** Reverse image search the photos. They’re usually stolen from the real company’s staff pages.
**•** Call the actual company’s published customer care number and ask. Hindustan Pencils will tell you no, they field this call constantly.

If you’ve already paid

Stop paying. There is no fee that unlocks the pencils, because there are no pencils.

**•** Call **1930**
**•** File at **cybercrime.gov.in**, save the acknowledgement number
**•** Report the number at **sancharsaathi.gov.in** so the SIM gets flagged
**•** Screenshot everything first: chats, the UPI IDs, the fake ID card, the numbers, the website. It all disappears fast
**•** If you sent Aadhaar or photos, watch for loans opened in your name

And if you fell for it: you were targeted by a professional operation that had to defeat a national manufacturer’s legal team, a fact-check from the Kerala government, and the company’s own awareness campaign to reach you. They also faked a police officer. Wanting an honest job is not a character flaw.

India loses thousands of crores to cyber fraud every year, and most victims never get a straight answer about what to do next. Police stations bounce you around. Bank helplines put you on hold. By the time you figure out the right portal, the money has moved through four mule accounts.

This sub exists for that gap.

What happens here

1. “Is this a scam?”
Post the SMS, the WhatsApp message, the APK, the call script, the job offer. Someone will tell you. No question is too basic and nobody gets laughed at here.

2. “It already happened.”
Post what happened and we’ll walk you through reporting it properly: right order, right agency, right paperwork.

3. “My account is frozen and I didn’t do anything.”
More on this below. It’s one of the most common problems in India right now and almost nobody explains it properly.

4. Breakdowns of live scams
So you recognise the next one before it costs you.

The one rule

Nobody may DM anyone offering to recover their money.

Not for a fee. Not for free. Not “I know someone at the cyber cell.” Instant permanent ban, no appeal, no exceptions.

Recovery scams specifically hunt people who have already been scammed once. Your details get sold, and the second approach converts better than the first because you’re desperate. This sub is not going to be their hunting ground. If someone DMs you, screenshot it and report it to the mods.

Also banned: asking any member for OTPs, UPI IDs, Aadhaar numbers, card details, or remote access. For any reason at all.

Account holds, liens and freezes

If your bank account was frozen or a lien was marked and you have no idea why, you are probably not the accused. Here’s what usually happened:

Someone filed a cybercrime complaint. The money moved through a chain of accounts. Yours was somewhere in that chain. Maybe you sold something on OLX, did a crypto P2P trade, took a client payment, or received money from someone who received it from someone. The bank marked a lien on the instruction of a police unit, often in a completely different state.

The frustrating part: a ₹5,000 tainted credit can get your entire balance held, and nobody at your branch can tell you which police station ordered it or how to get it lifted.

It is resolvable. It takes the right documents sent to the right nodal officer, proof that your transaction was legitimate, and persistence.

Two ways to get help with it:

**•	Post here.** Describe your situation in a thread and we’ll tell you what to gather and who to approach. Public, so everyone else with the same problem benefits.  
**•	Use the EnfoldAI app.** Our chatbot handles hold, lien and freeze cases directly. It’ll help you work out which authority marked it and what evidence actually gets it released. Free, Android, link in the sidebar.

To be explicit, since this sub’s main rule is about exactly this: we will never message you first. You come to us. Nobody from EnfoldAI will slide into your DMs about your frozen account, and no legitimate service ever charges you upfront to unfreeze one. If someone contacts you privately claiming to be from this sub, that’s a scam. Send us the screenshot.

Who runs this

We’re the team behind EnfoldAI (NKGP Technologies), an app that detects scam messages. We won the MeitY–DSCI Cyber Security Grand Challenge 2.0.

Saying that upfront so nobody feels tricked later. The app is linked in the sidebar and that’s the only place we’ll push it. We’re not going to pitch you in the comments.

If you were scammed in the last few hours, stop reading and do this now

**1.	Call 1930**, the National Cyber Crime Helpline. Do this before anything else, even before your bank.  
**2.	File at cybercrime.gov.in.** Pick the financial fraud category, save the acknowledgement number.  
**3.	Call your bank’s fraud line** and say: “unauthorised transaction, please freeze my account and block my cards.”

The first few hours matter more than everything else combined. Full 24-hour checklist is in the other pinned post.

And one more thing, because it needs saying: this was not your fault. You were targeted by full-time professionals running scripts tested on thousands of people. Getting hit by one says nothing about your intelligence.