Stalk, Hack, and Track

A 22-year-old college student based in Naupada, Thane was recently held for harassing his female friend by creating fake Instagram profiles. The accused wrote 400-odd emails to the victim from 15 fake accounts. Online harassment by cyber bullies and cyberstalkers has become a problem of epidemic proportions.

In November this year Bollywood actor Varun Dhawan had approached the Santacruz police alleging that a female fan was harassing him on WhatsApp. The fan told Dhawan that she would commit suicide if the actor failed to acknowledge his feelings for her.

In April this year, a team of Mumbai Police arrested a youth from Maharashtra's Naxalite area, Kurkheda, for allegedly harassing a TV actress Sonarika Bhadoria? who acted in Devon ke Dev Mahadev, for 7-8 months over the phone.

The accused continuously sent vulgar messages and called her on her phone. The accused had also threatened the actress to accept his marriage proposal failing which he would commit suicide. The case was registered in Kurar police station by Bhadoria in February.

While speaking to DNA, Sonarika said, "I was fed up and scared by seeing his messages. When I blocked his number he used at least 25 numbers to contact me. When I switched off my phone for a few days, he started calling my relatives and father. Initially, I ignored but in February I approached the police and filed a complaint."

In July this year, a 23-year-old Mulund based girl, who worked in a private firm, had started receiving a series of phone calls from unknown callers. Initially, she ignored these calls, but later while browsing the Internet, she came across a post on Facebook which had her photographs and a number along with a message, "I am free, call me for fun now." The post went viral on Facebook after which she started receiving harassment calls from unknown persons. Police probe revealed that some unknown people had created a fake Facebook account of the victim under the name 'Riya Paveen' and used her photographs and contact numbers.

While the instances of the cases are on the rise, the detection rate of such cases in Mumbai is poor and shocking.

According to the statistics provided by the Cyber Crime Police Station (CCPS) at Bandra-Kurla Complex (BKC), 52 cases of cyberstalking were registered with them between 2013 and 2016, of which only 17 cases were detected with 17 persons arrested in these cases.

Cyber experts believe that the number of such cases registered with the Mumbai and state police is just the tip of the iceberg and the actual number of instances of cyber crime are much more than what is reported.

According to experts in most cases of cyberstalking, victims do not come forward and approach the police, fearing parents and society. In several cases, the stalker or harasser uses private photographs or videos of the victim to blackmail the victim.

As per police, in most of the detected cases, it is found that the culprits and victims were either known to each other or were in a relationship which later turned sour for various reasons. The accused then indulged in cybercrime in order to seek revenge by harassing the victims.

"In cases of one-sided love affair, it becomes easy for us to track the victim as sometimes the victims have a strong suspicion about the culprit, but in those cases where the perpetrator is unknown, it becomes difficult for us to trace that person and such cases remain undetected," said a senior police officer.

"Lack of cyber knowledge on part of the police is a major problem for solving cybercrime cases. The police are not well-trained in handling cybercrimes. In cases of cyberstalking, the police initially do not register the case and delay the process. Later due to lack of technical training, the detection process gets delayed. If the detection is delayed the conviction also gets delayed," said cybercrime lawyer, N.S. Nappinai.

"This might come as a surprise, but there is no legal provision to tackle women cyberstalkers. In fact, there is no specific law to tackle cyberstalking in India. Usually, it is covered under Section 67 of the IT Act, but that is applicable only if there has been transmission or online publication of obscene material. For cyberstalking, the police mostly file a case under Section 354D of the Indian Penal Code (IPC). However, the language of the section makes it clear that it only covers a male accused and a female victim," revealed a cyber legal expert requesting anonymity.

"The detection rates in case of cyberstalking, cyberbullying are low as, in most cases, the stalker is unknown and a fake profile is used to stalk the victims. When the police seek help from Twitter, Instagram, and Facebook their response takes time. It's a time-consuming process which makes detection difficult," says cyber expert Ritesh Bhatia.

Emerging cybercrimes

Phishing to vishing

While the authorities are already lagging behind in curbing the vishing cases and creating awareness among citizens, vishing callers are innovating techniques to obtain card details of online users and make transactions in foreign currency on foreign websites for which they do not need an OTP. The Mumbai police have identified several cases in the recent past where the victim neither received a call nor he/she shared an OTP but the user's card details were used to siphon off money from their bank accounts. In June this year, one Vishal Sahija became a victim of one such fraud. Sahija had not shared his card details and had not received any OTP but fraudulent transactions were carried out from his card in Turkish currency. According to cyber experts, the CVV number, card number and expiry date of the card can be used to transfer money online. One of the biggest challenges here is to identify how the card details are being obtained. Investigators believe that the fraudsters must be receiving the details from an insider who might be involved in such fraudulent transactions of foreign currency. While hundreds of people have been duped by vishing callers, a Juhu-based woman received her money back after a transaction of Rs 3 lakh was carried out from her father's bank account. When she found about the fraud, she contacted the bank, which blocked her account and stopped all transactions.

Precautions

• Do not share your card number, CVV number and expiry date of the card. In case of suspicious transactions, contact the bank immediately.

Cloning and skimming

The Bandra police had in April this year arrested eight attendants from a posh restaurant in Bandra where the attendants would copy the data of their customers' cards using a skimming machine and would clone the cards with blank cards to withdraw money from their bank account. The police said, after skimming the cards, the waiters would ask the customers to type their passwords in the machine but the customers unsuspectingly would share the passwords with the waiters or write it down on the bill, which they would use later while withdrawing the money. In March this year, the Bandra-Kurla Complex cyber police arrested a Bulgarian national who had allegedly skimmed and cloned the cards of hundreds of people from an ATM machine. Skimming, the police said, is a technique in which with the help of a skimming machine, the data of a credit/debit card can be copied and later pasted on blank cards to clone it.

In another case in June this year, the Colaba police identified a case where a software engineer's card was cloned and Rs 3 lakh was withdrawn from his bank account from an ATM in Australia. However, the victim was refunded by the bank as his card was cloned and the victim had immediately informed the bank about the fraudulent transaction.

Precautions

• Beware while swiping your cards at restaurants and bars. Do not let anyone else enter the pin number on the swipe machine.
• In case of fraud, immediately inform the police and bank about the transaction. The police will issue a form using which the money can be refunded by the bank.

Email spoofing

E-mail spoofing is a widely used technique by online fraudsters to dupe corporates who have frequent communication with their clients or business allies in other countries. Here, the fraudster makes a duplicate email-id with a similar email address and asks the company to make payments. Several cases have been registered in Mumbai in the past wherein the companies have almost been duped.

Precautions

• Always call your client if you get an email asking you to deposit money in an account different from the one you usually use.
• Tell your employees about the techniques used by cybercriminals. Give them information on email spoofing and man-in-the-middle attacks so they can take steps to avoid being cheated.

Beware Chinese malware

Cyber crooks are now armed with a Chinese malware, using which they can empty a whole ATM without any efforts and siphon off all the money within minutes. According to cyber experts, they infect malware into the ATM machines using a pen drive after which the ATM machine starts malfunctioning and the fraudsters empty the cash. In Maharashtra, the first suspected case was registered in Mumbai's Nagpada police station in July this year, where two masked men entered an ATM of Corporation Bank and stole Rs 30 lakh. The police and the bank are not certain about the modus operandi. They have now sought the help of ethical hackers and cyber experts to solve the case.

How to report FB bullying

In case of facing bullying on Facebook, visit 'Bullying Prevention Hub' for resources and tips that help teens, parents and educators to deal with bullying behaviour and its consequences.

Developed in partnership with the Yale Center for Emotional Intelligence, the Bullying Prevention Hub is a resource for teens, parents and educators seeking support and help for issues related to bullying and other conflicts. It offers step-by-step plans, including guidance on how to start some important conversations for people being bullied, parents who have a child who is being bullied or accused of bullying, and educators who have students who are involved with bullying.

Steps for reporting cyber bullying/abuse on Twitter:

• Being the target of online abuse is not easy to deal with. Knowing the appropriate steps to take to address your situation can help you through the process.
• Document the violent or abusive messages with print-outs or screenshots.
• Be as specific as possible about why you are concerned.
• Provide any context you have about who you believe might be involved, such as evidence of abusive behaviour found on other websites.
• Provide information regarding previous threats you may have received
• You can report the content to Twitter.
• Block the harasser's account and report immediately.

'Our awareness programmes are successful, cases are being registered'

Deputy Commissioner of Police (Cybercrime) Akbar Pathan talks to DNA on increasing awareness about cybercrimes.

What steps have been planned to curb the rising cybercrime cases?

We soon plan to set up four additional cybercrime police stations in four different regions. Recently the Mumbai Police formed Cybercrime Investigaiton Cell in every police station.

Was there a proposal to set up a special cybercrime court?

Yes, it was proposed by us to put cases on fast track and increase the rate of conviction. The state government will take the final decision.

The police lacks technical training in handling cybercrime cases.

We organise training sessions for the police not only associated with the cyber crime police station but for those posted in local police stations as well, so that they can be updated about the emerging trends and technology in the cyber world.

There is an increase in the number of cases registered.

It is good that the cases are being registered and the victims are coming forward to register cases. This shows that the awareness programmes have been successful and people are registering the cases.Deputy Commissioner of Police (Cybercrime) Akbar Pathan talks to DNA on increasing awareness about cybercrimes.