Platforms Hosting a Billion Users Must Curb Nefarious Activities, Says Senior Official

When we talk about cybercrime, three to four years ago, it was largely a domestic phenomenon, concentrated in a few key hotspots. These included Jamtara and nearby districts such as Deoghar, Giridih, Nawada, Bihar Sharif, as well as regions like Howrah and Kolkata. Another major hotspot was Mewat, covering parts of Haryana, including Nuh and Palwal, along with Bharatpur and Deeg in Rajasthan, and certain areas of Mathura.

However, over the past couple of years, there has been a significant shift. What we are now witnessing is a sharp rise in transnational cybercrime. While the foundations for this were laid earlier, law enforcement agencies typically become aware of such crimes only after they are reported.

By the end of 2023, transnational cybercrime had risen substantially. These operations are now being run at an industrial scale. There are scam compounds, multi-storey buildings, where each floor houses around 40 to 50 individuals, all engaged in fraudulent activities targeting victims, including those in India.

These facilities have reportedly been set up in countries such as Cambodia, Laos, Myanmar, and in parts of Dubai and Sri Lanka, though they are predominantly concentrated in Southeast Asia, particularly Cambodia, Laos, and Myanmar, with some presence in Thailand. According to estimates from the Ministry of Home Affairs, India lost around ₹24,000 crore to cybercrime in 2024 alone.

Investment fraud accounts for roughly 50–55% of the total cybercrime amount. In fact, by rough estimates, this can even go up to 60%, so it typically lies in the 50–60% range. Investment fraud largely operates through social media platforms, where fake videos are circulated. There are also profiles that impersonate high-net-worth individuals or well-known investment firms such as PricewaterhouseCoopers, Goldman Sachs, and Aditya Birla Group.

Additionally, fraudsters create fake applications that resemble legitimate platforms like Groww and Upstox. These phishing pages and fake platforms are circulated at a scale that is extremely difficult for law enforcement agencies to control.

A common question that arises is: if these pages exist, why are they not taken down or blocked? The challenge is that for every page that gets reported and removed, two or three new ones emerge and continue to circulate. This also raises a broader concern about major platforms like Google, Meta, and WhatsApp, where a significant amount of misinformation and fraudulent activity is taking place.

So, that is something we should be asking Big Tech as well. There is no doubt that large technology and IT firms need to take greater responsibility. Incidentally, Gurugram was among the first districts to register an FIR against WhatsApp in 2024. We also issued legal notices to Google. That said, it is easy to place the entire burden on these companies. They are taking certain steps, but the larger issue is that these platforms form the foundational layer for most cybercrimes. Fraudsters use them to run fake ads, circulate misleading content, and scale their operations.  

 If you look at it simply, everyone has a source of income. For instance, journalism earns you money, and I earn a salary as part of a law enforcement agency. Similarly, companies like Meta and Google primarily earn through advertising. Individuals do not directly pay them; their main revenue comes from ad products, supported by machine learning systems and search engine optimization (SEO). 

 SEO, in particular, is often misused. Payments are made to boost the visibility of certain pages or websites, ensuring they appear at the top or reach a wider audience. Cybercriminals exploit these mechanisms to amplify fraudulent content. Typically, fraudsters create fake videos, social media profiles, and pages. When a user clicks on them, they are often added to WhatsApp or Telegram groups that impersonate legitimate firms. For example, groups may claim to be associated with well-known platforms or investment firms, offering so-called “secret investment plans.” There are countless such groups. 

See, when you are operating from a metropolitan city, it does provide some advantage. There is better awareness and relatively stronger systems in place. However, if we look at Tier-2 cities—such as Kanpur, Varanasi, or Patna—many people are still not aware of even basic things, like how to report a fraud on WhatsApp.

There is also a lack of understanding about the processes involved. Every social media platform, IT intermediary, or telecom service provider has a dedicated law enforcement portal, and requests are accepted only through those channels. It is not as simple as calling up a company like Google and asking them to block a fake website.

Law enforcement agencies need to know exactly whom to contact, on which platform, through which email ID, in what format, and with what level of urgency. There is a detailed procedural requirement, along with technical compliance, which often becomes a major challenge.

The second major challenge is tracking the financial trail. Two key concepts make these investigations particularly complex: money mule accounts and money rotation.

Money mules are individuals who rent out their bank accounts to unknown persons for small amounts—as low as ₹3,000. These can include students, shopkeepers, or unemployed individuals who hand over access to their savings or current accounts for quick money.

As a result, cybercriminals accumulate access to a large number of such accounts. There are even organised channels, particularly on platforms like Telegram, where bank accounts are traded. This underground ecosystem is massive—arguably even larger and more difficult to track than traditional hawala networks.

In a typical fraud case, for instance, a ₹10 lakh scam—the money is quickly split across multiple accounts. Within minutes, ₹2 lakh may go to a Delhi-based account, ₹3 lakh to Kolkata, ₹3 lakh to Chennai, and ₹2 lakh to Jaipur. These are usually not single transactions. Victims often make multiple payments—sometimes 10 to 15 transactions in investment fraud cases, and even more in larger scams. Each transaction is routed to a different account.

Even after that, the money does not stay in one place. For example, if ₹3 lakh reaches a bank account in Delhi, it is often further split within 5–10 minutes into five or six different accounts across the country. This rapid layering makes tracing extremely difficult.

Enforcement also depends, to some extent, on responsiveness and coordination. In many cases, it comes down to institutional capacity and even interpersonal coordination. For example, if a complaint comes from a cybercrime unit in a city like Kanpur, the officers may not always know which platform to report on or which email ID to use.

Even when they do identify the correct channel, platforms like Google may raise objections—sometimes citing issues like freedom of speech—especially if the request is not drafted in the required format. Proper drafting and compliance with platform-specific requirements become critical. Even when everything is done correctly, there are further challenges. Under IT intermediary rules, content is expected to be acted upon within 72 hours. However, in practice, several platforms struggle to meet these timelines consistently.

The broader issue is that platforms have not invested sufficiently in law enforcement support systems, whether for content blocking, reporting, or coordination. At the same time, enforcement from the government side also faces limitations. One key issue is the lack of strong data localisation. Additionally, most major technology companies—such as Meta, Google, Microsoft, and Skype—are headquartered in the United States.

There are three key solutions. If these are addressed effectively, cybercrime can be significantly reduced. First is the liability of banks. Many mule accounts are opened due to inadequate verification processes. You would be surprised to know that over the past one and a half years, Gurugram Police has arrested around 49 bank officials, including senior-level personnel, for lapses in due diligence.  

For example, someone can register a fake firm and open multiple current accounts across different banks. Within a couple of days, crores of rupees may flow in and out of these accounts due to rapid money rotation.  Stronger due diligence and real-time monitoring of accounts are critical. If you examine mule accounts, you will often find unusually high transaction volumes within very short periods—clear red flags that should trigger intervention. 

Second is the issue of SIM cards and telecom regulation. There is a large-scale illegal supply of SIM cards being used in cybercrime. Recently, we arrested an individual who had transported nearly 900 SIM cards to Cambodia. These SIM cards are used to create accounts on platforms like WhatsApp and Telegram. Fraudsters often prefer Indian (+91) numbers to build trust.  

Third, and most importantly, is the responsibility of social media platforms. Companies like Meta Platforms, Google, and others must act faster in blocking harmful content. If they do not, they cannot continue to claim or boast that they are platforms with over a billion users. 

 These platforms already use advanced machine learning systems and claim to serve billions of users. If they can track user behaviour and monetise it through targeted advertising, they should also be capable of identifying and blocking fake profiles, fraudulent ads, and malicious content more effectively. Facebook often says that it has over a billion users on its platform. If you are hosting a billion users, you must ensure that those users are not engaging in any nefarious activities. 

So if the platform is tracking every movement and even earning money from it, then what about all these fake pages, fake profiles, and fake advertisements that are being pushed to the top through search engine optimisation, gaining higher visibility? 

And if platforms like Facebook, Instagram, or Google argue that they have too many users to manage, then they should shut the system down. If you cannot control it, why promote it?  

In the last 10 months, around 3,000–4,000 Indians have been deported from Myanmar after being found working in such scam compounds. If you want to understand what is really happening, what cyber slavery is, you should look up places like Myawaddy and Shwe Kokko, where many such scam compounds exist and have been busted.

Through diplomatic interventions, many Indians have been brought back. However, there are also individuals who do not want to return. That is a major issue.

Many of them actually are very happy. There is a narrative about cyber slavery, and yes, there are cases where people are harassed, not necessarily through torture, but because they lack the ability to perform the work expected of them, such as making scam calls effectively.

In today’s world of consumerism, everyone wants to earn more and have a better lifestyle. If someone is unable or unwilling to work here, and someone offers them a job in Thailand, they often take it. From there, they travel through illegal routes and end up in Myanmar, Cambodia, or Laos, where they start working in scam compounds.

There, they earn ₹80,000–90,000 per month. All incidental expenses are covered, and alcohol and other benefits are provided.

Maybe they don’t have a strong moral framework. This money ultimately does not remain within India.