e-SIM scam arrests put cops on alert

The scam results in phone users losing all the money in their bank accounts

The busting of a phishing racket in Jharkhand has put Bengaluru cyber crime police stations on high alert.

Police have arrested five men who accessed 300 bank accounts in multiple states by scamming people into believing they were creating e-SIMs for themselves.

A top investigator in Bengaluru says cyber crime syndicates use an elaborate method to cheat. It all begins with getting a phone user to switch from a physical SIM to an e-SIM. “An e-SIM is built into the phone’s chip and creates an e-profile,” he says.

Who are the victims?

Kapil Gupta, director, Volon Cyber Security, says e-SIM phishing is another vector in a series of SIM-related frauds.

“The principle objective is to obtain SIM access for a short while and redirect the ‘OTP’ in order to facilitate bank transactions (see box) without the account holder getting to know about them,” Gupta told Metrolife.

Syndicates target the elderly and those who can afford the latest phones.

“The e-SIM works only on top end models, like the iPhones and the more expensive Samsungs. The gangs assume those who can afford such phones also have a good bank balance,” he says.

Once a syndicate gains access to the e-SIM, it also gains access to WhatsApp and Facebook, says the cyber investigating officer. “The criminals change the security settings and passwords of all the social media accounts and control them as well,” adds the cyber investigating officer. He informs that the syndicates use the bank details to drain the victim’s account of money.

They quickly transfer the balance to multiple accounts and mobile wallets.

Gupta says that many telemarketing companies possess customer phone number data and information that can be used to cheat phone users, but people should be aware that legal telemarketing is a thing of the past.

Telecom companies do not call customers anymore unless it is for recovering dues or servicing any specific request, cyber security experts say.

“These tele callers are not sophisticated and generally stick to a single script of communication, any deviation prompts them to disconnect the call,” explains Gupta.

Set pattern

Dr T P Vipin, consultant criminologist, studying cyber crime, says that e-SIM phishing is fast catching on in cities and has a pattern.

“The frauds create an e-SIM or convert a physical SIM to an e-SIM, citing reasons such as upgradation or a blocked ATM card. The money vanishes from the account in a minute,” explains Vipin.

That the crime can be committed remotely makes the syndicates believe they can easily get away. They work in groups since there are multiple levels of tasks.

How to be on guard

Ignore calls asking you to share your email ID, user ID and password.

Don’t click on or share dubious links sent to your phone.

Be wary of QR codes from unknown sources.

Don’t download unfamiliar apps.

If you notice unauthorised withdrawals, block your account and call the police.

How is the fraud carried out?

A call is made with numbers taken from a database (acquired illegally but easily).

The caller convinces the customer (on the pretext of KYC, deal or service offer) to switch to an e-SIM.

This is when the fraud begins. The caller asks the victim to forward the email received from the mobile service providers like Airtel, Jio.

This email is used to trigger further steps required for the creation of an e-profile on the victim’s phone.

The syndicate then activates the e-SIM (without the victim’s knowledge) and carries out bank transfers. The mandatory OTP comes to the e-SIM. Once an e-SIM is activated, text messages stop going to the old SIM.

The transfers are mostly carried out at night when victims are fast asleep.