{"id":9003,"date":"2022-05-11T10:00:54","date_gmt":"2022-05-11T04:30:54","guid":{"rendered":"https:\/\/gtm360.com\/blog\/?p=9003"},"modified":"2025-09-18T15:39:38","modified_gmt":"2025-09-18T10:09:38","slug":"why-is-it-hard-to-catch-cybercriminals","status":"publish","type":"post","link":"https:\/\/gtm360.com\/blog\/2022\/05\/11\/why-is-it-hard-to-catch-cybercriminals\/","title":{"rendered":"Why Is It Hard To Catch Cybercriminals?"},"content":{"rendered":"<p>When the authorities say cash leads to tax evasion, counterfeiting, etc., the common man (&#8220;Joe&#8221;) thinks it&#8217;s because cash is anonymous. When they goad him to ditch cash and move to digital payments, Joe assumes that digital payment will eliminate fraud because it&#8217;s not anonymous.<\/p>\n<p>Then, one day, Joe uses a digital payment like UPI to buy something from, say, &#8220;Jane&#8221;. When he does not get what he ordered, he instinctively feels defrauded.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Man Flattered Spam Caller Believes He Has Car, House, Savings Account To Defraud <a href=\"https:\/\/t.co\/xfDxNfciQu\">https:\/\/t.co\/xfDxNfciQu<\/a> <a href=\"https:\/\/t.co\/KxFOknZ5Jg\">pic.twitter.com\/KxFOknZ5Jg<\/a><\/p>\n<p>&mdash; The Onion (@TheOnion) <a href=\"https:\/\/twitter.com\/TheOnion\/status\/1517662040793530371?ref_src=twsrc%5Etfw\">April 23, 2022<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Joe contacts his bank (&#8220;Payor Bank&#8221;) and supplies the details of the payment including the mobile phone number of Jane, the Alleged Scammer. From the UPI ID, it is possible to infer the details of the bank to which Joe&#8217;s money went &#8211; this is the bank in which Jane has her account (&#8220;Payee Bank&#8221;).<\/p>\n<p>Contrary to Joe&#8217;s expectations, his bank will not be able to retrieve the money from the Payee Bank.<\/p>\n<p>That&#8217;s because, as an Account-to-Account Real Time Payment (A2A RTP), UPI is designed to be an irrevocable Method of Payment (MOP). In plain English, &#8220;Irrevocable&#8221; means &#8220;once gone, gone forever&#8221;. The same is true for all other A2A RTPs like FPS (UK) and Zelle (USA). Therefore, the Payor Bank will throw up its hands and tell Joe to file a police complaint.<\/p>\n<p><a href=\"https:\/\/gtm360.com\/blog\/wp-content\/uploads\/2022\/04\/upi-apps-cybertheft-fi.jpg\" target=\"_blank\" rel=\"noopener\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-9530 size-full\" src=\"https:\/\/gtm360.com\/blog\/wp-content\/uploads\/2022\/04\/upi-apps-cybertheft-fi.jpg\" alt=\"\" width=\"630\" height=\"354\" srcset=\"https:\/\/gtm360.com\/blog\/wp-content\/uploads\/2022\/04\/upi-apps-cybertheft-fi.jpg 630w, https:\/\/gtm360.com\/blog\/wp-content\/uploads\/2022\/04\/upi-apps-cybertheft-fi-200x112.jpg 200w\" sizes=\"auto, (max-width: 630px) 100vw, 630px\" \/><\/a><\/p>\n<p>Joe then goes to the cops and expects them to nab the Alleged Scammer immediately because he can supply her mobile number and \/ or UPI ID (aka <em>Personally Identifiable Information<\/em>). Instead he finds it hard to even get the cops to register his complaint.<\/p>\n<p>In a normal burglary, there&#8217;s usually a tampered lock, broken glass or some anomaly. The victim can use that as evidence to file a complaint with law enforcement. However, in the case of a cybercrime, there&#8217;s no ostensible evidence of crime. It comes down to the Scammee&#8217;s word. While the Scammee can show the debit entry for the money exiting his bank account, that&#8217;s not proof that the Alleged Scammer has received the money. This is because, unlike credit card, A2A MOPs do not provide a legally-valid receipt (with the sole exception of FPS UK that I know of). See <a href=\"https:\/\/gtm360.com\/blog\/2018\/04\/06\/psa-insist-on-receipt-when-you-pay-by-neft-upi-fps-etc\/\" target=\"_blank\" rel=\"bookmark noopener\">PSA: Insist On Receipt When You Pay By NEFT, UPI, FPS Etc.<\/a> for more details.<\/p>\n<p>Let&#8217;s say he crosses that hurdle and persuades law enforcement to investigate the theft. The cops will need to find out the address of Jane, the Alleged Scammer, and nab her. The Scheme Operator &#8211; National Payments Corporation of India (NPCI) in the case of UPI &#8211; might seem the logical place to start the search but scheme operators generally fob off fishing expeditions by cops (as they should, if you ask me).<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">I doubt if that&#39;s the case but taking it at face value, kudos to the powerful for upholding their fiduciary duty of not giving away their internal info in response to fishing expeditions by others.<\/p>\n<p>&mdash; SKR (@s_ketharaman) <a href=\"https:\/\/twitter.com\/s_ketharaman\/status\/1464556794160713735?ref_src=twsrc%5Etfw\">November 27, 2021<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>So law enforcement will need to approach the Payee Bank with the mobile number of the Alleged Scammer.<\/p>\n<p>The Payee Bank has done KYC before opening Jane&#8217;s account. Therefore, it knows the identity, mobile number and address of Jane. However, due to banking secrecy laws, the Payee Bank can&#8217;t reveal its customer details just like that. It will insist on a court order.<\/p>\n<p><a href=\"https:\/\/gtm360.com\/blog\/wp-content\/uploads\/2022\/02\/SEX-SCAM-PUNEMIRROR-2-13FEB2022.jpg\" target=\"_blank\" rel=\"noopener\"><img loading=\"lazy\" decoding=\"async\" class=\"alignright wp-image-9141 size-medium\" src=\"https:\/\/gtm360.com\/blog\/wp-content\/uploads\/2022\/02\/SEX-SCAM-PUNEMIRROR-2-13FEB2022-200x71.jpg\" alt=\"\" width=\"200\" height=\"71\" srcset=\"https:\/\/gtm360.com\/blog\/wp-content\/uploads\/2022\/02\/SEX-SCAM-PUNEMIRROR-2-13FEB2022-200x71.jpg 200w, https:\/\/gtm360.com\/blog\/wp-content\/uploads\/2022\/02\/SEX-SCAM-PUNEMIRROR-2-13FEB2022-1024x362.jpg 1024w, https:\/\/gtm360.com\/blog\/wp-content\/uploads\/2022\/02\/SEX-SCAM-PUNEMIRROR-2-13FEB2022-768x272.jpg 768w, https:\/\/gtm360.com\/blog\/wp-content\/uploads\/2022\/02\/SEX-SCAM-PUNEMIRROR-2-13FEB2022-1536x544.jpg 1536w, https:\/\/gtm360.com\/blog\/wp-content\/uploads\/2022\/02\/SEX-SCAM-PUNEMIRROR-2-13FEB2022-2048x725.jpg 2048w\" sizes=\"auto, (max-width: 200px) 100vw, 200px\" \/><\/a>After law enforcement comes back with a subpoena, the Payee Bank will release Jane&#8217;s contact information and cops can go and nab her.<\/p>\n<p>But, by that time, Jane could have decamped with the money. Remember that we&#8217;re talking about a real time payment method like UPI or FPS or Zelle, where Jane gets the money in her bank account a few seconds after Joe has sent the money out from his bank account, whereas the other activities will take a couple of days (or more if the cybercrime crosses state borders, leading to jurisdiction issues prolonging matters).<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">PSA: Whether it&#39;s heart attack, stroke or payment fraud, Golden Hour is critical. TAKE IMMEDIATE ACTION!!! <a href=\"https:\/\/t.co\/7HlpHq8z2o\">pic.twitter.com\/7HlpHq8z2o<\/a><\/p>\n<p>&mdash; SKR (@s_ketharaman) <a href=\"https:\/\/twitter.com\/s_ketharaman\/status\/1455467277084762113?ref_src=twsrc%5Etfw\">November 2, 2021<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<hr style=\"width: 70%;\" \/>\n<p>The Payor Bank can&#8217;t do anything. The Payee Bank won&#8217;t do anything. Cops can&#8217;t do much.<\/p>\n<p>That&#8217;s why it\u2019s hard to catch cybercriminals.<\/p>\n<p>PS: As shown in the following exhibit, UPI \/ A2A Payments involve Payment Gateways, Payment Service Providers, and many more parties. They make matters even more complicated than explained above. But I&#8217;ve ignored them in the interest of describing the crux of the cybercrime problem in as simple a manner as possible.<\/p>\n<p><a href=\"https:\/\/gtm360.com\/blog\/wp-content\/uploads\/2022\/05\/UPI-PAYMENT-PROCESS-FLOW-ETPRIME-2.jpg\" target=\"_blank\" rel=\"noopener\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-9650\" src=\"https:\/\/gtm360.com\/blog\/wp-content\/uploads\/2022\/05\/UPI-PAYMENT-PROCESS-FLOW-ETPRIME-2.jpg\" alt=\"\" width=\"300\" height=\"631\" srcset=\"https:\/\/gtm360.com\/blog\/wp-content\/uploads\/2022\/05\/UPI-PAYMENT-PROCESS-FLOW-ETPRIME-2.jpg 564w, https:\/\/gtm360.com\/blog\/wp-content\/uploads\/2022\/05\/UPI-PAYMENT-PROCESS-FLOW-ETPRIME-2-95x200.jpg 95w, https:\/\/gtm360.com\/blog\/wp-content\/uploads\/2022\/05\/UPI-PAYMENT-PROCESS-FLOW-ETPRIME-2-487x1024.jpg 487w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p><em>Quora Link:<\/em> https:\/\/qr.ae\/pG3YDo<\/p>\n","protected":false},"excerpt":{"rendered":"<p>When the authorities say cash leads to tax evasion, counterfeiting, etc., the common man (&#8220;Joe&#8221;) thinks it&#8217;s because cash is anonymous. When they goad him to ditch cash and move to digital payments, Joe assumes that digital payment will eliminate fraud because it&#8217;s not anonymous. Then, one day, Joe uses a digital payment like UPI &#8230; <a title=\"Why Is It Hard To Catch Cybercriminals?\" class=\"read-more\" href=\"https:\/\/gtm360.com\/blog\/2022\/05\/11\/why-is-it-hard-to-catch-cybercriminals\/\" aria-label=\"Read more about Why Is It Hard To Catch Cybercriminals?\">Read more<\/a><\/p>\n","protected":false},"author":4,"featured_media":9530,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6,9,7,1],"tags":[72],"class_list":["post-9003","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-bfsi","category-ecommerce","category-retail","category-mandatory-category","tag-cybercrime"],"_links":{"self":[{"href":"https:\/\/gtm360.com\/blog\/wp-json\/wp\/v2\/posts\/9003","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/gtm360.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/gtm360.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/gtm360.com\/blog\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/gtm360.com\/blog\/wp-json\/wp\/v2\/comments?post=9003"}],"version-history":[{"count":24,"href":"https:\/\/gtm360.com\/blog\/wp-json\/wp\/v2\/posts\/9003\/revisions"}],"predecessor-version":[{"id":9649,"href":"https:\/\/gtm360.com\/blog\/wp-json\/wp\/v2\/posts\/9003\/revisions\/9649"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/gtm360.com\/blog\/wp-json\/wp\/v2\/media\/9530"}],"wp:attachment":[{"href":"https:\/\/gtm360.com\/blog\/wp-json\/wp\/v2\/media?parent=9003"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/gtm360.com\/blog\/wp-json\/wp\/v2\/categories?post=9003"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/gtm360.com\/blog\/wp-json\/wp\/v2\/tags?post=9003"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}