Digital Arrest Scams in India: How They Work and What Personal Data Makes Them Convincing

Digital arrest scams have become one of the fastest-growing categories of cyber fraud in India, with cumulative losses reported in the thousands of crores over the past two years. Understanding the mechanism — and specifically what personal data scammers use to make the con work — is the most effective defence.

How the Scam Typically Unfolds

The pattern is consistent across most reported cases:

• The initial contact — a call or message claiming to be from a courier company (often referencing a parcel supposedly containing drugs, fake passports, or illegal SIM cards), a telecom operator, or directly from a law enforcement agency
• The escalation — the call is "transferred" to someone posing as a senior police officer, CBI agent, or ED official, often over video, sometimes in a uniform or a room staged to resemble a government office
• The accusation — the victim is told their Aadhaar, PAN, SIM, or bank account has been linked to a serious crime such as money laundering or narcotics trafficking
• The isolation — victims are instructed to stay on the call continuously, sometimes for hours, and explicitly told not to inform family or contact a lawyer, framed as a legal requirement of the "investigation"
• The extraction — victims are pressured to transfer funds to a "verification" or "RBI escrow" account, with promises the money will be returned after clearance — it never is

There is no provision in Indian law that permits arrest, detention, or investigation via video call. No genuine law enforcement or regulatory agency conducts proceedings this way, and the RBI has explicitly and repeatedly stated it never asks anyone to transfer funds or share OTPs and banking credentials over a call.

What Personal Data Makes the Scam Convincing

What separates digital arrest scams from generic phishing is specificity. A vague scam call is easy to dismiss. A call that references your correct name, a plausible Aadhaar-adjacent detail, or an actual recent parcel or transaction feels different — and that specificity comes from somewhere:

• Data broker and breach sources — names, phone numbers, and sometimes partial ID numbers sourced from past data breaches or broker listings give scammers a starting point that feels personal
• Publicly available information — social media details, employer information, or family names, used to add convincing texture to the script
• Spoofed caller ID and VoIP tools — technically not personal data, but used alongside real details to make the calling number appear to originate from an official source
• AI-generated voices and forged documents — increasingly used to produce fake FIRs, arrest warrants, or ID cards shown on-screen during the video call

The more of your personal information is already circulating — through old breaches, public listings, or broker sites — the more convincing a targeted script becomes. This is part of why reducing your overall digital exposure is a genuine, if indirect, defence against this specific scam category.

What to Do If You Receive Such a Call

• Disconnect immediately. No real investigation proceeds this way, and staying on the call only serves the scammer's isolation tactic.
• Do not call back on any number they provided. Verify independently through official channels — the police helpline 100, or the cybercrime helpline 1930 — from a different phone.
• Do not transfer any money, regardless of the urgency or legal-sounding justification presented.
• Report immediately at cybercrime.gov.in or by calling 1930. Acting within the first 24 hours meaningfully improves the chances of a bank transaction reversal.
• Inform family members despite any instruction not to — the isolation instruction is itself a manipulation tactic, not a legal requirement.

This scam pattern often works alongside information gathered through other exposure vectors — what information can scammers find about you online? covers the broader landscape these tactics draw from.

Reducing what's findable about you across breach databases and public sources is one practical step toward making yourself a less convincing target. Scan My Shadow checks a submitted phone number and email across 1,500+ sources and returns a report showing what's already out there.

Curious what's already out there about you? Scan My Shadow checks your phone number and email across 1,500+ sources and sends you a clear report — no guesswork, just facts. Start your scan.