#FactCheck - Viral Clip Not Harish Rana’s Farewell, Linked to Surat Woman’s Organ Donation

Introduction

The scam involving "drugs in parcels' has resurfaced again with a new face. Cybercriminals impersonating and acting as FedEx, Police and various other authorities and in actuality, they are the perpetrators or bad actors behind the renewed "drugs in parcel" scam, which entails pressuring victims into sending money and divulging private information in order to escape fictitious legal repercussions. 

Modus operandi  

The modus operandi followed in this scam usually begins with a hacker calling someone on their cell phone posing as FedEx. They say that they are the recipients of a package under their name that includes illegal goods like jewellery, narcotics, or other items. The victim would feel afraid and apprehensive by now. Then there will be a video call with someone else who is posing as a police officer. The victim will be asked to keep the matter confidential while it is being investigated by this "fake officer."

After the call, they would get falsified paperwork from the CBI and RBI stating that an arrest warrant had been issued. Once the victim has fallen entirely under their sway, they would claim that the victim's Aadhaar has been used to carry out the unlawful conduct. They then request that the victim submit their bank account information and Aadhaar data for investigation. Subsequently, the hackers request that the victim transfer funds to a bank account for RBI validation. The victims thus submit money to the hackers believing it to be true for clearing their name.

Recent incidence:

In the most recent instance of a "drug-in-parcel" scam, an IT expert in Pune was defrauded of Rs 27.9 lakh by internet con artists acting as members of the Mumbai police's Cyber Crime Cell. The victim filed the First Information Report (FIR) in this matter at the police station. The victim stated that on November 11, 2023, the complainant received a call from a fraudster posing as a Mumbai police Cyber Crime Cell officer. The scammer falsely claimed to have discovered illegal narcotics in a package addressed to the complainant sent from Mumbai to Taiwan, along with an expired passport and an SBI card. To avoid arrest in a fabricated drug case, the fraudster coerced the complainant into providing bank account information under the guise of "verification." The victim, fearing legal consequences, transferred Rs 27,98,776 in ten online transactions to two separate bank accounts as instructed. Upon realizing the deception, the complainant reported the incident to the police, leading to an investigation.

In another such incident, the victim received an online bogus identity card from the scammers who had phoned him on the phone in October 2023. In an attempt to "clear the case" and issue a "no-objection certificate (NOC)," the fraudster persuaded the victim to wire money to a bank account, claiming to have seized narcotics in a shipment shipped from Mumbai to Thailand under his name. Fraudsters threatened to arrest the victim for mailing the narcotics package if money was not provided. 

Furthermore, In August 2023, fraudsters acting as police officers and executives of courier companies defrauded a 25-year-old advertising student of Rs 53 lakh. They extorted money from her under the guise of avoiding legal action, which would include arrest, and informed her that narcotics had been discovered in a package she had delivered to Taiwan. According to the police, callers acting as police officers threatened to arrest the girl and forced her to complete up to 34 transactions totalling Rs 53.63 lakh from her and her mother's bank accounts to different bank accounts.

Measures to protect oneself from such scams

Call Verification: 

• Be sure to always confirm the legitimacy of unexpected calls, particularly those purporting to be from law enforcement or delivery services. Make use of official contact information obtained from reliable sources to confirm the information presented.

Confidentiality:

• Use caution while disclosing personal information online or over the phone, particularly Aadhaar and bank account information. In general, legitimate authorities don't ask for private information in this way.

Official Documentation: 

• Request official documents via the appropriate means. Make sure that any documents—such as arrest warrants or other government documents—are authentic by getting in touch with the relevant authorities.

No Haste in Transactions: 

• Proceed with caution when responding hastily to requests for money or quick fixes. Creating a sense of urgency is a common tactic used by scammers to coerce victims into acting quickly.

Knowledge and Awareness: 

• Remain up to date on common fraud schemes and frauds. Keep up with the most recent strategies employed by online fraudsters to prevent falling for fresh scam iterations.

Report Suspicious Activity: 

• Notify the local police or other appropriate authorities of any suspicious calls or activities. Reports received in a timely manner can help investigations and shield others from falling for the same fraud.

2fA:

• Enable two-factor authentication (2FA) wherever you can to provide online accounts and transactions an additional degree of protection. This may lessen the chance of unwanted access.

Cybersecurity Software: 

• To defend against malware, phishing attempts, and other online risks, install and update reputable antivirus and anti-malware software on a regular basis.

Educate Friends and Family:

• Inform friends and family about typical scams and how to avoid falling victim to fraud. A safer online environment can be achieved through increased collective knowledge.

Be skeptical

• Whenever anything looks strange or too good to be true, it most often is. Trust your instincts. Prior to acting, follow your gut and confirm the information.

By taking these precautions and exercising caution, people may lessen their vulnerability to scams and safeguard their money and personal data from online fraudsters.

Conclusion:

Verifying calls, maintaining secrecy, checking official papers, transacting cautiously, and keeping up to date are all examples of protective measures for protecting ourselves from such scams. Using cybersecurity software, turning on two-factor authentication, and reporting suspicious activity are essential in stopping these types of frauds. Raising awareness and working together are essential to making the internet a safer place and resisting the activities of cybercriminals.

 References:

• https://indianexpress.com/article/cities/pune/pune-cybercrime-drug-in-parcel-cyber-scam-it-duping-9058298/#:~:text=In%20August%20this%20year%2C%20a,avoiding%20legal%20action%20including%20arrest.
• https://www.the420.in/pune-it-professional-duped-of-rs-27-9-lakh-in-drug-in-parcel-scam/
• https://www.newindianexpress.com/states/tamil-nadu/2023/oct/16/the-return-of-drugs-in-parcel-scam-2624323.html
• https://timesofindia.indiatimes.com/city/hyderabad/2-techies-fall-prey-to-drug-parcel-scam/articleshow/102786234.cms

Introduction

Search Engine Optimisation (SEO) is a process through which one can improve website visibility on search engine platforms like Google, Microsoft Bing, etc. There is an implicit understanding that SEO suggestions or the links that are generated on top are the more popular information sources and, hence, are deemed to be more trustworthy. This trust, however, is being misused by threat actors through a process called SEO poisoning.

SEO poisoning is a method used by threat actors to attack and obtain information about the user by using manipulative methods that position their desired link, web page, etc to appear at the top of the search engine algorithm. The end goal is to lure the user into clicking and downloading their malware, presented in the garb of legitimate marketing or even as a valid result for Google search.

An active example of attempts at SEO poisoning has been discussed in a report by the Hindustan Times on 11th November, 2024. It highlights that using certain keywords could make a user more susceptible to hacking. Hackers are now targeting people who enter specific words or specific combinations in search engines. According to the report, users who looked up and clicked on links at the top related to the search query “Are Bengal cats legal in Australia?” had details regarding their personal information posted online soon after.

SEO Poisoning - Modus Operandi Of Attack

There are certain tactics that are used by the attackers on SEO poisoning, these are:

• Keyword stuffing- This method involves overloading a webpage with irrelevant words, which helps the false website appear higher in ranking.
• Typosquatting- This method involves creating domain names or links similar to the more popular and trusted websites. A lack of scrutiny before clicking would lead the user to download malware, from what they thought was a legitimate site.
• Cloaking- This method operates by showing different content to both the search engines and the user. While the search engine sees what it assumes to be a legitimate website, the user is exposed to harmful content.
• Private Link Networks- Threat actors create a group of unrelated websites in order to increase the number of referral links, which enables them to rank higher on search engine platforms.
• Article Spinning- This method involves imitating content from other pre-existing, legitimate websites, while making a few minor changes, giving the impression to search engine crawlers of it being original content.
• Sneaky Redirect- This method redirects the users to malicious websites (without their knowledge) instead of the ones the user had intended to click.

CyberPeace Recommendations

• Employee Security Awareness Training: Security awareness training can help employees familiarise themselves with tactics of SEO poisoning, encouraging them to either spot such inconsistencies early on or even alert the security team at the earliest. 
• Tool usage: Companies can use Digital Risk Monitoring tools to catch instances of typosquatting. Endpoint Detection and Response (EDR) tools also help keep an eye on client history and assess user activities during security breaches to figure out the source of the affected file.
• Internal Security Measures: To refer to lists of Indicators of Compromise (IOC). IOC has URL lists that show evidence of the strange behaviour of websites, and this can be used to practice caution. Deploying Web Application Firewalls (WAFs) to mitigate and detect malicious traffic is helpful.

Conclusion

The nature of SEO poisoning is such that it inherently promotes the spread of misinformation, and facilitates cyberattacks. Misinformation regarding the legitimacy of the links and the content they display, in order to lure users into clicking on them, puts personal information under threat. As people trust their favoured search engines, and there is a lack of awareness of such tactics in use, one must exercise caution while clicking on links that seem to be popular, despite them being hosted by trusted search engines.

References

• https://www.checkpoint.com/cyber-hub/cyber-security/what-is-cyber-attack/what-is-seo-poisoning/
• https://www.vectra.ai/topics/seo-poisoning
• https://www.techtarget.com/whatis/definition/search-poisoning
• https://www.blackberry.com/us/en/solutions/endpoint-security/ransomware-protection/seo-poisoning
• https://www.coalitioninc.com/blog/seo-poisoning-attacks
• https://www.sciencedirect.com/science/article/abs/pii/S0160791X24000186
• https://www.repindia.com/blog/secure-your-organisation-from-seo-poisoning-and-malvertising-threats/ 
• https://www.hindustantimes.com/technology/typing-these-6-words-on-google-could-make-you-a-target-for-hackers-101731286153415.html

‍

Introduction
‍

India's digital governance system is experiencing a significant transformation. The Department of Telecommunications (DoT) has extended the deadline for implementing SIM binding requirements for messaging platforms to December 31, 2026, while also stepping back from earlier proposals such as mandatory periodic web logouts. 

The government extended the current proposal but decided to cancel its previous requirement, which mandated messaging platforms to implement mandatory logout periods. The authorities implemented this action to control the increasing occurrence of digital impersonation, financial fraud, online scams and identity theft, which occurs through messaging applications.

The authorities are said to have implemented this action to control the increasing occurrence of digital impersonation, financial fraud, online scams and identity theft, which occurs through messaging applications.
‍

What Has Changed
‍

The SIM binding mandate, which the Telecommunication Cyber Security framework introduced in late 2025 requires messaging platforms to maintain user account connections with active SIM cards that match their registered mobile numbers. 

Platforms received a brief period for compliance with the original rules. Industry stakeholders, which included messaging services and device manufacturers, reported that they faced major technical and operational problems when trying to constantly verify SIM status on different devices and operating systems. 

The government postponed the compliance date to December 2026 to give organisations extra time for the gradual implementation of requirements. The policy now permits platforms to use risk-based or adaptive logout mechanisms, which enable security management without enforcing standard security procedures through their web messaging application platforms. 

‍

Why the Extension Was Necessary
‍

The extension operates as a recognition of both technical feasibility constraints and ecosystem's complex nature. Multiple devices at present enable messaging platforms to function which includes smartphones and desktops and web interfaces with real time synchronization. The system needs complete operational system and hardware component integration to maintain active SIM verification throughout all environments because stakeholders estimated that this process would take time to achieve proper results. 

The operating system providers and smartphone manufacturers expressed their worries about system limitations, which include testing procedures and compatibility problems. 

The government recognised through its deadline extension that security requirements need technical feasibility and scalability to function properly without causing service interruptions or requiring immediate implementation.

‍

Security Rationale Behind SIM Binding
‍

The SIM binding system serves its main purpose to enhance accountability while it protects digital communication systems from unauthorised use. Authorities have identified that messaging accounts can remain active even after the associated SIM card is removed, deactivated, or moved across regions. The situation creates paths for criminals to commit fraud and impersonation while perpetrating cybercrime across international borders because they can use digital identities that are hard to trace. 

The SIM binding system exists to solve this problem by 

• requiring active, Virtual KYC-verified SIMs to authenticate messaging accounts. 
• Users cannot access the system until they connect their active SIM. 
• The system maintains the capacity to track and authenticate digital identities. 

The measure aims to eliminate a security gap that digital communication systems currently use for fraudulent activities and identity theft.

‍

Shift Toward Risk-Based Regulation
‍

The current development marks a major change because it no longer applies fixed rules that used to determine what organisations must do, but now uses risk assessment methods. The previous plan, which required users to log out every six hours from web sessions, has been replaced by platforms that now log users out based on their risk assessment. The shift demonstrates that cybersecurity needs to implement security measures that require specific context and need to match the existing environment. Organisations face challenges when trying to apply standard rules because users exhibit various behaviours while using different devices on multiple platforms. 

The risk-based model enables platforms to detect suspicious activity through dynamic monitoring, which establishes strict security measures for high-risk situations while preserving system access during periods of low risk.

‍

Implications for the Digital Ecosystem
‍

The extension, together with its related policy alterations, creates significant effects for organisations. The extra time allows the industry to create systems that can work together with different ecosystems while testing their implementation process and matching their required operational standards. 

The shift shows policymakers that they should adopt a process that combines multiple rounds of assessment with stakeholder input to develop their regulations. 

The upcoming changes will create invisible effects for users, which will determine the future methods of digital identity verification and the security functions of communication platforms.

‍

Conclusion
‍

The extension of the SIM binding deadline represents a new approach to regulations instead of being a regulatory rollback. The process requires both dedicated efforts and actual implementation to create secure digital environments. 

India needs to establish secure and scalable user-friendly systems while advancing its digital infrastructure development. The current developments show progress toward achieving a solution that protects cybersecurity needs while considering technological facts and user experience. Organisations face two main obstacles in modern interdependent systems: they must protect their systems while maintaining user trust and system protection, and their capability to operate over extended periods.
‍

References
‍

• https://www.thehindu.com/sci-tech/technology/government-shelves-periodic-web-logout-for-chat-apps-extends-sim-binding-to-december-31/article70811929.ece
• https://www.gadgets360.com/telecom/news/dot-sim-binding-mandate-extension-2026-report-11301917

‍