Scam Watch: From Money Loss To Identity Theft & Legal Troubles, Many Layers Of The Rapidly Spreading FedEx scam

Madhu Singh (name changed) was getting irritated. A 29-year-old lawyer, Madhu was in the middle of a work day when she got an automated call from FedEx saying that a package allegedly sent by her was not delivered. As someone who often has documents couriered to her by clients, she pressed #1 as  directed. An amiable customer care agent took over and informed her that a package sent using her ID details to Taiwan was intercepted by customs for carrying illegal items. On being told that she had not sent any such package, the customer care agent was understanding, and suggested that someone may have misused her ID details. He was eager, too eager, to help her file a police complaint, and within seconds, he even had a cop on the line ready to help her. 

But the more the amiable customer care agent insisted that she speak with the cops, the more annoyed she became. She was not being given any details about the supposed parcel that was sent using her name. “They just kept telling me that I must register a complaint. I was not given any details — whom is it from, what was the address, who the sender was — nothing. I was angry. I raised my voice and asked them how I was supposed to register a complaint when I had no details about the package. The person on the other end hung up abruptly. I tried to call back, which was when I realised that it was a 9 digit number that I got the call from,” Singh says. 

It was almost felt like I was hypnotised. In such a situation, your mind stops working

Simran, 25, who lost almost a lakh to the FedEx scam

It was only when she shared her experience online that she discovered how close she had come to falling victim to a swiftly spreading scam that is robbing many Indians of their hard-earned money.

“When I posted about my experience on social media a few of my friends told me that they had received similar calls. One of them told me that the scamster asked them for Rs 1.5 lakh,” Singh says. 

From simple text scam to layers of sophistication 

Dubbed the “FedEx scam”, this scam has its origins in US in the early 2020s as a simple text scam carrying a spam link. The text message contained a “tracking code” and a link to set “delivery preferences”, and informed the victim that their package was awaiting delivery. The link reportedly redirected users to a fake Amazon satisfaction survey. After answering some questions, the user was then asked for their credit card number to claim a free product, resulting in them getting scammed. 

However, the most recent iteration of the scam is significantly more intricate and involves several parties.

The scam begins with an unsuspecting victim receiving an automated telephone call from FedEx  (or any other logistics platform for that matter), informing them that their package could not be delivered because it contained prohibited items. The victim is then directed to press a number to learn more about the issue. On pressing the directed number, the victim is greeted by a person posing as a customer care executive, who informs them that a package carrying illegal items (such as narcotics, passports, SIM cards, and credit cards) has been intercepted by the customs department and that the victim’s ID card was used for sending the package. The scamster further informs the victim that the case has been escalated to the police, inducing a sense of fear. In response, the oblivious victim attempts to defend themselves by asserting they had no involvement in sending the mentioned package. The customer care executive then adopts a sympathetic stance, implying that their identity might have been misused. 

They disclose that a complaint has been lodged with Mumbai police and offer to facilitate the victim’s connection with them on the same call, to file a complaint. Driven by fear, the victim succumbs, only to be directed to another fraudster posing as an officer of Mumbai Police.

They convince the victim that it is imperative to travel to Mumbai to register a complaint or register an online complaint over a video call on Skype or WhatsApp. Falling for the ruse, the unsuspecting victim complies. In the elaborate charade that follows, the scam artist poses as an official collecting the victim’s statement, cleverly extracting personal information in the process. At the end of the call, the victim is asked to transfer a certain sum  of money to a particular bank account “to verify if there was any suspicious transactions on their account”. The victim is shown a forged document from the Reserve Bank of India to make it appear legitimate. Following the transfer of money, the call is dropped abruptly, or the victim is informed that they will hear back soon after the investigation. 

FedEx clarifies that this is a scam

Taking the scam into account, FedEx put out a statement warning users not to fall for it. 

“FedEx is not associated, affiliated with or authorized to act on behalf of any national/local law enforcement authorities. If any individual, on the pretext of being a FedEx customer care team member, is directing/connecting you with any of the national/local law enforcement authorities in respect of any shipment containing illegal items in your name, do not share any personal information. If your interaction with such requests resulted in financial loss, you should contact your bank immediately. Consider contacting the local law enforcement authorities within the vicinity,” the warning on the FedEx website reads.

Capitalising on fear

While Madhu ended up unscathed, her friend and colleague Simran, also a lawyer, fell victim to the scam and lost nearly a lakh to the fraudsters.

“At first, I could not believe that something like this was happening to me. We usually tell our parents to stay safe while scrolling and not to click any random links, but for it to happen to me was unbelievable. I questioned myself as to how I could fall for something like this,” says the 25-year-old. 

In contrast to Madhu, Simran’s callers were well-prepared and effectively addressed all her queries. 

Describing her experience, which lasted for approximately 90 minutes, she recalls, “I asked him many questions and he had an answer to each question — he told me that there were medicines and credit cards in the parcel, he then told me that it was meant for Taiwan, and also gave me the address where the parcel was meant to go. I was taken over by fear. I couldn’t think prudently. When I told him that I was not the one who sent it, he told me that it looks like someone misused my Aadhaar details and that there have been similar cases in the recent past. He further said that I had to come to Mumbai and register a complaint immmediately.”  

Subsequently, the typical modus operandi unfolded.

The details were convincing. Simran was even sent ID cards and government notices to convince her that she was talking to a cop. “The conversation flowed like a regular questioning. The Skype ID was that of the Mumbai police. I had my video on, whereas the man I was speaking to only had his audio on. He sent me his ID card in the chat box. He also sent me some pictures of some ‘accused’ and asked me if I recognised any of them. When I said I did not, he then said that my account activity had to be verified. He further sent me an RBI document saying that I had to transfer a sum  of Rs 98,888  to verify the transactions in my account. He said that if I did not concede, my account would be frozen for two to three years until the probe is over. He also assured me that the money would be transferred back in a few hours time.

What we don’t realise is that these people (scamsters) are skilled and that they put you in a situation where you are helpless. You do not think straight

Simran, 25, who lost almost a lakh to the FedEx scam

“I transferred the amount while I was on call with him. I tried to bank transfer, but it failed twice. The third time, I made a UPI payment. After I transferred the money, he asked me more questions. He then told me that they detected illegal activity on my account, and that I should transfer all the money in my account to the said account. He asked me to go to the local bank and write a cheque to the said account number immediately,” narrates Simran. 

It was at this point that Simran began resisting. She said that she had to consult with her family before she did something like that. And all of a sudden the Skype call ended. 

“All the details that were sent to me, including the Aadhaar card and the RBI notice, were deleted from the chat. It was only after I hung up that I realised that I have been scammed,” she says. 

“When we come across things like this in the papers or the news, we wonder ‘How can people be so stupid?’ But what we don’t realise is that these people (scamsters) are skilled and that they put you in a situation where you are helpless. You do not think straight in such situations. It was almost like I was hypnotised. In such a situation, your mind stops working,” she adds. 

The legal hurdle 

Simran is now in the process of registering a complaint, but despite being a lawyer, it has not been easy for her. She is running from pillar to post to get an FIR registered in the case.  Soon after the incident, she reported the matter to the cybercrime helpline. She also approached the local police station near her office and expected the case to be transferred to the South City Cyber Crime division in Saket, New Delhi. 

“But it did not happen. I was informed that since I had transferred the money out on my own volition and since no hacking or such had taken place, it could not be considered a cyber crime and that the case would be investigated by the local police. But it has been seven days now, and even an FIR has not been registered,” she fumes. 

It is unfair to put the onus of proof on the victim

Prashant Gautam, DCP, IFSO Delhi

The banks have been of no help either. “I went to the bank and requested them to freeze the account of the recipient, but it has not been done. The bank later provided me with the details of the recipient’s bank account and I found that it was with a bank registered in West Delhi’s Janakpuri. The banks have an internal communication mechanism to dig into this, but I was in fact asked to provide the communication details of the recipients’ bank.  Later, I was informed by the bank that they are looking into my case and have set a tentative deadline of December to resolve my issue. It is a literal cakewalk for the police. We have the recipient’s bank and branch, all they have to do is go and seek details. As a civilian, I cannot do it, but the police can. Yet nothing is being done,” Simran laments.

Now, the only option in front of Simran is to approach the magistrate and get them to direct the police to investigate. But it is not as simple as it seems. And the registration of FIR does not guarantee a substantial probe either. “I have no hopes of getting back the money. There are people who have lost more money than I have. But I won’t sit back and wait. My effort in uncovering this will be constant,” Simran says.

But Prashant Gautam, DCP, IFSO (Intelligence Fusion & Strategic Operations/Cyber Crime Unit), Delhi Police, says that it is unfair to put the onus of proof on the victim. “In Delhi, the police are supposed to register the cases under cybercrime. In such cases, there is no burden of proof on the victim. If one records videos or takes screenshots, that is good, but even if one doesn’t, because they are in a frightened stage, it is OK. It is the duty of the police to find the culprits,” he says. 

Agreeing with Simran that the police and the banks are the two main institutions that have to ensure the safety of the people, Gautam says, “When victims of such frauds seek redressal in such cases, they are usually blamed. They are the public. We are tasked with providing them with a safe environment. The state and the banks are equally responsible for ensuring this safe environment.” 

Elaborating on the difficulties that dot the line of investigation, he adds, “The real problem with such cases is the data. People leave cyber footprints all over the internet. This is what the scamsters pick up. And when we try to retrieve the data on the  cyber fraud, it is challenging, because many times, the data is with a third party. In the “Fedex” scam, for instance, if we were to get the data from Skype, we would have to contact Microsoft, and so on. We need to device a mechanism where the data is available in real time.” 

Where are the scamsters functioning out of?

Speaking to Newschecker, Maharashtra DCP for Cyber Crime, Balsing Rajput, said it was difficult to trace the nexus to a particular location since they used different technologies to stay under the radar. 

“The scamsters operate by using VPNs and VOIP calls. Hence, it is difficult to trace where they are operating out of,” he says. 

VOIP calls or Voice over Internet Protocol is a type of phone system that uses an internet connection to make and receive calls, rather than traditional/mobile phones. Meanwhile, VPNs or Virtual Private Network is a mechanism for creating a secure connection between a computing device and a computer network, or between two networks, using an insecure communication medium such as the public Internet. “The 9-digit calls that people have reportedly received are typically made using VOIP. That’s why you cannot place calls to the same number when you press redial,” Rajput adds.

Rajput himself is a victim of the scam in a different way — the scamsters have forged his ID card, claiming to be an official of the Central Bureau of Investigation. “Scamsters call victims in Delhi claiming to be from Mumbai police and vice-versa. There is no fixed location where they are based. We have noticed that they are also using my ID proof and have made calls claiming that I am a CBI officer. We have registered at least 2-3 cases where officials ID have been misused. Over 200 accounts have been frozen,” Rajput informs, adding that a few accused have been arrested from Andhra Pradesh in a similar case.  

Fishing for data 

So how does the scamster know whom and how to target? 

“In most cases, these scamsters do not have any data. They make blind calls and bait people with fear. In many cases, when we have questioned the accused, they have informed us that they get the data from banking officials or people who worked in the bank earlier. How do the scamsters know whom to target? They get to know who has how much money from data leaks, and most of the time these are private banks,” says Prashant Gautam. 

This brings in a new problem: Of data theft and misuse of the data. 

This is not just a scam to extort money. This is something else. They are taking people’s videos, with their faces and their identification documents.

Sumedha Rathee, IT professional

Ravi Chaddha (name changed), a 65-year-old doctor, who received such a scam call informing him that a package sent with his ID details to Canada had been intercepted, fears that his data might have been compromised. 

“In the guise of registering the complaint, he (the scamster) made me divulge my Aadhaar card number, PAN card number, and the name of my family members and their phone numbers, the address of my clinic, my residence in Delhi, the names of the banks I use, and the names of payment apps that I use like PayTM, GPay etc.,” recounts Chaddha.

Sumedha Rathee (name changed), an IT professional based in Bengaluru, also had a similar experience. “They asked me to verify my identity documents, as they wanted to ensure that I was the same person on the documents ‘as there were scamsters around forging people’s identities’. They made me hold up my documents on video,” she says.

Rathee fears that the scamsters may have taken samples of her voice for something more sinister. “This is not just a scam to extort money. This is something else. They are taking people’s videos, with their faces and their identification documents. They were very sophisticated.”

So what are the scamsters after? Money or identity? “This is a big organised crime syndicate. The goal is primarily to scam victims out of money. But sometimes they also fish for data for impersonation. The ID details of the victims are used to forge their documents and use it to impersonate them,” says Rajput.

AI tools protect scamsters

The modus operandi was similar in Sumedha’s case — she was told that a package containing prohibited items meant for Canada, sent using her ID details, was intercepted in Nagpur. 

Pushed by the usual line of “register the complaint online or come in person”, Sumedha decided to file a video statement. “First they asked me if I was safe. When I asked what they meant, they told me that they wanted to ensure that I was not being forced to say anything against my wishes. They asked me to activate my back camera and show them around so that they can be sure. I was also told that the statement has to be recorded in an isolated room since it would not be valid if there was any background noise. After the statement was recorded, they told me that after two days, I would get a call from another police station about my complaint,” Sumedha narrates.

Moments after hanging up, when Sumedha called the Sitabuldi police station in Nagpur (the scamsters claimed they were calling from this location) to get clarity on something, she was informed that she was one of many who called them about the same matter.

“They told me that many were scammed of Rs 1 lakh or Rs 12 lakh, and so on. I was upset and could not believe that I had fallen for such a scam. I called the same number from which I got the call and played along. I recorded the conversation. I pretended to be worried and told them that I was scared. The ‘cop’ told me that he would ‘hasten’ the process of verification. I told him that it was OK, and that I got what I wanted. He got really angry. He understood that I had caught on to him. He started yelling at me, and hung up abruptly,” she said.

Also Read: Scam Watch: Beyond The Hullaballoo Around The Deepfake Scam

Sumedha was quick to approach the Bengaluru police and register a complaint. It was only when she showed the video recording of the interaction that she was in for more shock. “The cops pointed out that the video was AI generated, and when I looked closer, it was true! Furthermore, in my WhatsApp call logs, I can see the number from which the call was made, but below, it says ‘called from another device’.”

How to stay safe 

So how does one stay safe from such scams? FedEx scam falls under the broader purview of the delivery scam, where scamsters pose as logistics partners and try to part you with your money or personal information. One safeguard is to approach all such communication with skepticism, especially if you are not expecting such a package. It is inadvisable to click any links that come via SMS or email asking you to track your package and instead, rely on the tracking page on the official website. It is not advisable to share personal details such as Aadhaar card, account details, address, etc. on phone calls. These scams operate from a space of fear and panic, coupled with a sense of urgency created by the scamsters. 

And even if you do end up transferring money, not all is lost. Time is crucial, and the quicker you act, the more chances of recovering your money. 

“If you received such a call and you lost money to the scamster, then you immediately call the helpline 1930 and report the crime. This number is exclusively for online financial frauds and if you call within an hour of receiving the scam call, there are provisions to even block the flow of money on the banking channel. Even if you have not been scammed, it is advised to register a complaint on the National Cyber Crime Reporting portal,” says Gautam.

---

Like what you read? Let us know! Drop a mail to checkthis@newschecker.in if you would like us to do a deep dive on any scam that you think needs attention. If you would like us to fact-check a claim, give feedback or lodge a complaint, WhatsApp us at 9999499044 or email us at checkthis@newschecker.in. You can also visit the Contact Us page and fill out the form.