Shiva Shankar* from Pollachi in Tamil Nadu is unemployed. His stint as a freelance photographer didn’t earn him much; and so, he was making a bulk of his earnings by investing in cryptocurrency market trading apps. In May, Shiva came across an advertisement on Instagram about Zepbit, a cryptocurrency trading app for the digital currency, Bitcoin. “The link for the app directed me to a page where I gave my contact information and my employment status. A Zepbit representative then contacted me. I was sent a link to download the app via WhatsApp,” said the 25-year-old.
Initially, Shiva invested Rs 5,000 and earned Rs 10,000 from the app. He was able to withdraw that amount from the app’s wallet and transfer it to his Google Pay account, which encouraged him to invest more, he said. Over the month of May, through multiple payments, Shiva invested Rs 1.7 lakh in Zepbit. According to him, he earned Rs 19 lakh as returns from Bitcoin trading. However, there was a catch. “I couldn't withdraw the Rs 19 lakhs. The amount was stuck in the Zepbit wallet,” said Shiva. He alleged that he was asked to pay Rs 4 lakh by the Zepbit representatives to withdraw the amount.
Following this, Shiva filed a complaint against the app with the Coimbatore Cyber Crime Police on May 26. Several users of Zepbit app have taken to social media with complaints about losing money on the app and being unable to make withdrawals. Many have also called the app fake.
The app isn't available over Google Play Store or Apple Store, nor does it have a website or other online presence. Customer support is extended over WhatsApp. The URL for the download link of the Zepbit app says the app is hosted on Amazon Web Services (AWS) servers. Another user who lost money over the app has filed a police complaint in Madhya Pradesh.
“I realised they were scamming me when they asked me to make a UPI transaction worth Rs 4 lakh to withdraw the returns I had made. The Zepbit representatives asked me to go to their Mumbai office and collect the Rs 19 lakh. But the address they gave doesn't exist,” said Shiva. “Zepbit allegedly didn’t ask for many details apart from my bank account details for me to make withdrawals, phone number and email address,” he added.
On June 18, Shiva’s complaint against Zeptbit was dropped by the Cyber Cell. Speaking to TNM, Jayadev, an inspector with the Cybercrime Cell of Coimbatore, said the complaint could have been closed there due to no response from the complainant. However, Shiva says that there have been no follow ups from the police except one call. “A police officer called and I explained the situation. However, after that, there was no communication from the police,” said Shiva.
Meanwhile Jayant said that the Cell’s ability to probe such cases is limited. “We have received two such mobile app related cases. But our ability to investigate such cases is limited. The best we can do is forward the case to agencies that are better equipped to investigate such cases.”
Sandeep Sahoo, Director at SaveThem India, a team of cybersecurity professionals researching the Chinese operated instant loan and online betting apps since March 2020, says the Zepbit app is not of Indian origin. “The Zepbit app has its origins in Hong Kong. This app’s IP address is from Hong Kong and is being relayed to Mumbai. The app is also using the meta package of another trading app called Winbiz,” said the researcher, who examined the codes of the Zepbit app.
Earlier in April, the Cybercrime Police under the Rachakonda Commissionerate in Hyderabad, arrested three persons for developing a fake online trading app called Winbiz and cheating people. They were Ashok Kumar Arumugam (37), a consultant; his colleague Sanjeev Kumar (23), who was acting as the company secretary of Hanuvel Consultant India Pvt. Ltd; and Asim Akhtar (34), a manager at HSBC Bank. They were arrested from Bengaluru.
The arrest was based on a complaint by a woman from Hayathnagar in Hyderabad, who was approached by the Winbiz app's representative, promising high returns for trading on the platform. She invested Rs 20 lakh on the Winbiz app between February 24 and March 15, and earned a profit of Rs 54 lakhs but like Shiva Shankar, was unable to withdraw the amount, said a police press release.
“When the police catch scammers, the case might get solved, but the crime doesn't stop. The app doesn't just go out of service because the scammers got caught. It could get launched under a different name,” points out Sandeep. “The Zepbit app scammers are using the same meta-package as Winbiz. It can mean that Winbiz owns Zepbit; and it is also possible that the scammers just changed the brand name from Winbiz to Zepbit.” Sandeep added that his team has observed similar tactics being used in loan app scams.
Sandeep warns the public to be wary of installing unknown apps, and to read terms and conditions of the apps. They should also ensure that the apps have a working customer care service and peruse reviews on legitimate app stores before investing. “Without any sort of investigation, if you install the app, the scammers can hijack your data. For instance, Zepbit has code in the app that collects credit and debit card details and also details from payment apps such as Paytm and PhonePe. Apps like Zepbit also have code that will infect other apps such as clocks, calendars etc. so even if you delete the scamming app, your phone can still be hijacked,” warned Sandeep. He added that such tactics were also used by the lending apps to steal KYC data and banking details of its victims.
Smith Gonsalves, a Cyber Expert who specialises in enhancing the information security of MNCs and assisting Law Enforcement Agencies in Cyber Crime related cases, urges victims of app-based frauds to reach out to the National Cybercrime Reporting Portal of India with their complaints, "Most times these apps can be a malware designed to steal information from user phones which can later be misused. The advertisements of these apps which are seen on Instagram, Facebook, Discord, Telegram are being promoted by digital marketing brokers. Unfortunately, Facebook and Instagram don't verify the entities that give ads over their platform,” says Smith.
He added that several of these scammers have been linked to China-based entities and have an elaborate network, “Two months ago, the Mumbai Cyber Cell nabbed two men from West Bengal who were developers and digital marketing consultants. The men helped create websites for cryptocurrency apps making them seem legit,” he recounted. The scammers function like a company and create their own departments. They have teams working on KYC data collection, running call centres and a team hatching plans on who to scam next, Smith explained. “The data collected by these apps can be later sold over the darknet to other scammers.”
As for Shiva, he has little hope in being able to withdraw the Rs 19 lakh he apparently earned on Zepbit. “The Rs 1.7 lakh I invested was money that I borrowed from my friends and relatives. I don't know what I am going to tell them,” he rued.
Meanwhile, the Coimbatore Cyber Crime Cell has assured that it will reopen the complaint filed by him.