Like ponzi schemes, victims refer more victims to fraudsters

The Telegram profile of the so-called receptionist of ‘JSAN Technologies’ (right) A Google Arts & Culture link that the reporter was asked to like in return for Rs 180

The ‘like-and-earn' scam, believed to have been orchestrated by Chinese criminals, is on the rise with hundreds of cases being reported in the city. Cyber teams are currently working to track down the culprits. mid-day reached out to the fraudsters to uncover how the scam operates and how victims duped after being offered work-from-home opportunities refer other names to fraudsters. Here is everything you need to know about this racket.

Mid-Day reporters have been attempting to investigate this scam for the past three months, but fraudsters were unresponsive when approached directly. The scamsters have their own database of phone numbers procured from the dark web, or they rely on referrals from victims.

After a victim of the fraud, who had lost R27 lakh, recommended a mid-day reporter, the fraudsters reached out to the latter via a number, +62 838-6305-9272, believed to be from Indonesia. The reporter was then instructed to like three Google Arts & Culture links, which mainly displayed various ads for clothing, gold and jewellery.

A scamster, using an international number, got in touch with the reporter via WhatsApp

Once the reporter had completed these tasks, the fraudsters congratulated them via WhatsApp, saying, "Well done, you have successfully completed your first mission." The scammers then requested the reporter to add one of their ‘receptionists' whose ID was @Sukhwinder6613 on Telegram and to message them a job code, Z5126, that was provided via WhatsApp. He promised that the receptionist would guide the reporter on how to receive benefits worth R180 and asked the reporter to send them a screenshot once the message was received.

Also read: Mumbai saw 70 per cent rise in cyber crime cases in 2022: Devendra Fadnavis

The fraudster also provided a link to a Telegram channel and he received a message from the receptionist to share KYC details, which included invitation code, name, age, gender and mobile number. After providing the required details, they confirmed the details with the WhatsApp number through which this reporter was being approached for work from home.

After the reporter's verification was completed, the fraudster instructed him to like two Google Arts & Culture links and send screenshots to a Telegram ID in order to receive payment. The receptionist told the reporter that a payment would be made every time he completed two tasks. The links provided were of works by American painter Robert Loftin Newman, and after completing the tasks, the reporter shared his account details and received Rs 180.

The website coinnewe.app, which the reporter was told to visit by Telegram user Teacher_Akarshan

The money was credited to the reporter's account within 15 minutes of sharing his account details, and he shared the screenshot with the Telegram user. The fraudster did not show any urgency in a bid to gain the victim's confidence and only contacted the reporter a few hours after the money was deposited. "Congratulations, you have received your salary. I will invite you to the working group so you can earn more income with happiness," said the fraudster.

The next morning, the reporter was added to a Telegram group called JSAN Technologies, which had 726 members, most of whom were actively participating in the group by sharing screenshots of the images they had liked and the amounts of R180 and R120 that had been credited to their accounts.

The Telegram group then assigned six different tasks to the reporter. For the first three tasks, the reporter was asked to like Google images, and for the fourth task, he was asked to answer some multiple-choice questions, which included whether he had heard about virtual currency and whether he had ever been involved in stock trading.

Messages shared by members of the JSAN Technologies group; (right) this reporter transferred Rs 1,077 to the fraudsters as part of a task

After completing the fifth task, the crooks introduced the reporter to the next stage, where they ask victims to pay money to some UPI IDs and receive heavy commissions. The message shared by the Telegram group was this:

"Advance payment Job: JSAN Consulting Technologies LTD. cooperates with Coin-new to build a multinational e-commerce platform to increase the popularity of these e-commerce companies, and the sales volume and commission will be 20% of the amount paid in advance.

Option A: Advance R1,077 and get 20% Commission i.e. R1,292 back (New Comer Welfare Task)
Option B: Advance R3,077 and get 20% Commission i.e. R3,692 back (Team Welfare Task )
Option C: Advance R7,077 and get 20% Commission i.e. R8,492 back (Team Welfare Task )
Option D: Advance R13,077 and get 20% Commission i.e. R15,692 back (Team Welfare Task )
Option E: Advance R25,077 and get 25% Commission i.e. R31,346 back (Team Welfare Task )
Option F: Advance R50,077 and get 35% Commission i.e R67,604 back (Team Welfare Task )

The job is free to choose. Choose the job you want to do. Contact your receptionist, and she will explain how to complete Job 6. If you complete the first two sessions consecutively in a row, your salary balance will also be increased for all upcoming jobs (sic)."

After receiving this message, group members began transferring different amounts as per the options. Some appeared to be part of the scam syndicate as they shared screenshots of making payments on the UPI number provided in the group. Other members, however, were genuine victims.

This reporter transferred R1,077 to the fraudsters, receiving only R1,292. Most of the victims who have spoken to mid-day stated that they only received money after choosing either option A or B. Those who opted for a higher amount were tricked and asked to make additional payments to recover their previous payment. "This is how the scam operates: first, the fraudsters gain the victim's trust by transferring a small amount. Then they lure them into making additional payments to retrieve their initial payment, with hefty commissions added," explained a cyber cell officer.

After receiving Rs 1,292, this reporter was introduced to another Telegram user, Teacher_Akarshan. This user took the details of the payment made by this reporter and asked him to log in to a website, coinnewe.app, where the reporter was guided by a Telegram user to buy Bitcoin without making any payments. After completing this task this reporter was added in their instruction Premium Benefit Group 367 which has 281 members.

In this group, the administrators ironically kept sending alerts asking all the members to not speak to anyone else to prevent any kind of fraud. "Please identify your receptionist and your teacher in order to protect everyone from being cheated by the pretend management," a message read.

Officials have said the scamsters use such messages to gain victims' confidence. In the ‘premium benefit group' members were asked to like pictures and share screenshots, but for task 20, the following investment and commission details were shared:

"Option A: Advance R50,000 and get 35% Commission i.e. R62,500 back
Option B: Advance R75,000 and get 35% Commission i.e. R97,500 back
Option C: Advance R100,000 and get 35% Commission i.e. R130,000 back
Option D: Advance R150,000 and get 35% Commission i.e. R210,000 back
Option E: Advance R200,000 and get 35% Commission i.e. R280,000 back
Option F: Advance R250,000 and get 40% Commission i.e. R375,000 back
Option G: Advance R300,000 and get 50% Commission i.e. R450,000 back"

On receiving the message, the members began selecting various options and making payments ranging from R50,000 to R1,00,000. Some even shared screenshots of receiving their money back, along with hefty commissions. One member claimed to have received R1,30,430 after investing R1 lakh. However, the screenshot they shared appeared to be fake, and it seemed likely that they were part of the scam syndicate sharing false information to further gain the victim's trust.

This reporter refrained from making any payments after learning that several victims had made multiple payments without receiving their initial investment back. "I initially invested Rs 1,077 and received Rs 1,292. Then I invested Rs 3,077 and received Rs 3,692. Next, I invested R50,000 but didn't receive anything due to a purported error. They then asked me to make another payment of Rs 50,000, and later claimed they hadn't received any payment due to a system error. I was traumatised at the thought of losing Rs 1 lakh, so I kept making payments until the amount I lost touched Rs 27 lakh. It was only then that I realised I had been deceived. I even took a loan of Rs 20 lakh after losing my savings," said a victim.

Rs 180
Initial amount credited to reporter