CBI probes deep-rooted fake call-centre nexus; top cop under scanner

Racket accused of “digital arrests”, crypto off-ramps; protection money trail points to senior ranks, say sources

By the Sarhind Times Investigations Desk | Mumbai / New Delhi | October 14, 2025

The Central Bureau of Investigation (CBI) has widened its probe into a sprawling fake call-centre ecosystem in Maharashtra, examining an alleged protection racket that, investigators believe, reached into the state’s senior police echelons. The inquiry follows a string of raids and earlier arrests tied to high-pressure “digital arrest” scams—extortion operations that coerce victims on video calls while impersonators pose as police, tax, or narcotics officials. Preliminary findings under review include cash-collection channels, VOIP masking infrastructure, mule banking layers and crypto cash-outs that enabled the network to move crores across districts while hopping locations to dodge enforcement.

A recent report suggests a senior IG-rank officer is among those under scrutiny for alleged protection money arrangements, as the agency maps kingpins, financiers and front facilities linked to hubs in Nashik, Pune and other nodes. The probe builds on CBI and allied agency actions since July–August, including the Igatpuri resort-run centre that impersonated “Amazon” support, and a Pune unit tied to international victims—cases that yielded live scripts, devices and crypto trails.

How the “digital arrest” con works

Scripted fear. Victims receive a call about a SIM misuse, NDPS/PMLA violation, or parcel with contraband. Callers then push the victim to a “senior officer” on a controlled video session.

Total control. The victim is ordered not to disconnect, position the camera a certain way, and “cooperate to avoid arrest”. Personal data is harvested in real time; a confession may be scripted.

The drain. Funds are moved via instant payments to mule accounts, gift-card rails, or crypto ramps. Threats escalate if the victim resists. India has recorded massive losses to such scripts; explainers peg cumulative damages since 2022 in the thousands of crores.

CBI’s recent multi-state raids into “digital arrests” examined mule networks and telecom channels as part of a consolidated FIR based on NCRP complaints—signalling a pivot to choke infrastructure, not just individual floors or boiler rooms.

Maharashtra: from shopfloor to shield

Enforcement documents and press statements since August outline the anatomy of the state’s fake-centre economy:

Factory-style staffing. Diallers, verifiers, closers—60+ operators on a floor; live calls caught during raids.
Moving targets. Leases in co-working towers or resorts; shifts every few months; proxy directors fronting shell firms.
Digital smoke. VOIP terminations, rapid-switch virtual numbers, and scripts calibrated to foreign regulators’ jargon.
Money plumbing. Gift cards, crypto wallets, and a daisy chain of mule accounts—some linked to bank staff under probe in allied cases.

It is this plumbing—particularly the alleged “collection” for protection—that has brought a top-tier officer under the scanner, according to reportage citing investigation sources close to the case.

What’s new in the CBI approach

From raids to ecosystem mapping. Instead of floor-wise busts alone, the thrust is to map financiers, VOIP suppliers, SIM farms, mule aggregators, and crypto off-ramps—so the same syndicate cannot simply reboot a week later.
Cross-border liaison. Several centres targeted foreign nationals (US/Canada) using brand impersonations; the Igatpuri action drew external acknowledgements and liaison.
Public-servant angles. Recent FIRs name “unknown public servants of banks” alongside private accused, reflecting a willingness to test complicity in the formal system that helped the scam scale.

The policy vacuum scammers exploit

Instant rails without instant red-flags. UPI and card rails move money in seconds; rule engines at some banks and payment gateways lag the fast-mutation of extortion scripts.
Telecom grey zones. Overseas DIDs and masking make traceback slow; bulk KYC loopholes persist in the edges of SIM distribution.
Fragmented response. Multiple agencies (state police, cyber cells, central agencies) touch pieces of the chain; without unified playbooks, multi-district rings survive resets.

Cyber-fraud analysts interviewed across prior cases have urged automated red-flagging of number patterns (rapid-switch virtual numbers tied to scripted phrases), SIM-farm heat maps, and real-time mules freeze at the first credible alert from NCRP flows. Recent CBI moves suggest parts of this advice are finally in play.

Under scanner: “protection money” and command responsibility

The most sensitive strand is the alleged monthly collection to shield floors—an old-world racket layered atop new-age VOIP. If the probe substantiates a money trail to senior ranks, it could trigger disciplinary proceedings and PMLA/PC Act hooks. Reportage points to an IG-rank officer being probed after witness and financial leads flagged recurring “payments for peace”. The agency has not named the officer; all accused retain the presumption of innocence until due process concludes.

The Igatpuri and Pune blueprints

Igatpuri resort hub (Aug 10). Five arrests; 60+ operators; live spoofed “Amazon” support calls; proceeds via gift cards/crypto.

Pune Kharadi/Hadapsar axis. Prior city-police busts seized 64 laptops, 41 phones and threat scripts; CBI followed with an allied case naming unknown bank public servants and private accused operating since January 2025.

These case studies illustrate the same three-layer tactic set: fear, immobilise, drain—delivered over networks designed for disposability.

What victims should know (and do)

Red flags

Any unsolicited call alleging NDPS/PMLA or “parcel with drugs” + demand to stay on video continuously.
Instructions to transfer funds to “safe accounts for verification”, or buy gift cards/crypto to avoid arrest.
Threats of public shaming, suspension of bank accounts/SIMs, or “bailable offence” lines to hurry you.

Immediate actions

Hang up. Call the official helpline of the relevant agency; never use numbers shared by the caller.
Report on the National Cybercrime Reporting Portal (cybercrime.gov.in).
Alert your bank and file an FIR; ask for transaction freezing and mark beneficiary accounts as mule risks.
Preserve screenshots, call logs, and payment references.

National explainers warn that “digital arrests” have extracted thousands of crores from Indian citizens since 2022; early reporting materially raises odds of fund recall and network disruption.

What banks, telcos, fintechs can deploy—now

Script-signature models. NLP to detect hallmark phrases across rapid-switch numbers; flag outbound patterns to telcos and I4C pipes in near-real-time.
Consortium mule lists. A cross-bank negative list with decay windows; velocity-based soft locks when a newly-opened account receives fragmented UPI credits from many unrelated senders.
Gift-card choke points. Threshold-based manual reviews; merchant education to spot bulk gift-card buys tied to coercion scripts.
VOIP hygiene. Stronger KYC for enterprise DIDs; anomaly detection on DID churn; red-team testing of enterprise on-boarding.
Warmline to CBI/I4C. 24×7 escalation rails so first-responder banks can freeze backwards—not just the last hop.

CBI’s latest sweep explicitly targets mule accounts and telecom channels, indicating an operational shift that industry should mirror.

Civil-liberties checklist for clean raids

Rights groups are simultaneously pressing for clear SOPs so that genuine BPOs and residents in shared buildings are not wrongfully detained. Suggested guardrails include:

Search warrants naming specific suites/floors.
Videography of searches; quick return of uninvolved tenants’ IDs/devices.
A time-bound device-imaging protocol, with hashes provided to counsel.
Helpline and grievance windows for collateral impact during multi-floor operations.

The road ahead: four tests for the probe

Financial forensics. Can the money chain from floors to alleged protectors be pinned to bank, hawala or crypto trails that hold up in court?
Telecom traceback. Will DID sellers and VOIP hosts face KYC consequences that deter instant respawns?
International restitution. With US/Canada victims documented in Igatpuri/Pune cases, can cross-border cooperation scale beyond ad-hoc?
Command accountability. If senior complicity is proven, will disciplinary and criminal consequences be even-handed—beyond transfers and quiet exits?

For now, the CBI’s public trail shows a pivot from kelp-cutting (floor busts) to root-pulling (ecosystem disruption). If the protection-money tunnel collapses, Maharashtra’s call-centre mafias may finally lose their air.

#CBI #CyberCrime #FakeCallCenter #DigitalArrest #Maharashtra #LawEnforcement #CyberSafety #VOIP #Crypto #MoneyLaundering
#CBI #CyberCrime #DigitalArrest #Maharashtra #Fraud