Student Duped By Fake ICE Agents, Loses $5,000 In Scam.

കൊച്ചി : Non Banking Finance Company (NBFC) കളുടെ തട്ടിപ്പ് കേരളത്തില്‍ കടൽ പോലെ വ്യാപിച്ചുവരികയാണ്. തിരിച്ചു കൊടുക്കുവാന്‍ കഴിയില്ലെന്നറിഞ്ഞുകൊണ്ടാണ് പല സ്വകാര്യ ധനകാര്യ സ്ഥാപനങ്ങളും കടപ്പത്രങ്ങളിലൂട...

കൊച്ചി> കൊച്ചി കേന്ദ്രീകരിച്ച് പ്രവർത്തിക്കുന്ന ആതിര ഗ്രൂപ്പ് നടത്തിയത് 115 കോടിയുടെ നിക്ഷേപ തട്ടിപ്പ്. സാധാരണക്കരായ ദിവസ വേതനക്കാര്‍ അടക്കമുള്ളഴവരാണ് തട ...

ദില്ലി> 'കണ്ടെത്തിയത് ഗുരുതക്രമക്കേട്, ചൈനീസ് ബന്ധമുള്ള സേവനദാതാക്കൾ '. ഡിജിറ്റൽ വായ്‌പയുമായി ബന്ധപ്പെട്ട ഗുരുതര ക്രമക്കേടുകളുടെ പേരിൽ മുംബൈ കേന്ദ്രമായ എക്സ‌സ്10 ഫിനാൻഷ്യൽ സർവീസസ് ലിമിറ്റഡ് (X10 Finan...

തിരുവനന്തപുരം> തട്ടിപ്പിൻ്റെ മറ്റൊരു മുഖം കൂടി. ഓഹരി വിപണിയിലൂടെ വൻ തുക ലാഭമുണ്ടാക്കാമെന്ന് പ്രലോഭിപ്പിച്ച് വീട്ടമ്മയിൽ നിന്ന്  1,32,61,055 രൂപ തട്ടിയെടുത്തതായി പരാതി. ശ്രീകാര്യം സ്വദേശിയായ യുവതിയുടെ ...

 A concerning trend has sent shockwaves across cybersecurity authorities, with central cyber and intelligence organisations tracking and documenting large-scale data leaks perpetrated by bank staff and third party contractors.  According to a senior…

A newly released report by cybersecurity firm CTM360 reveals a large-scale scam operation utilizing fake news websites—known as Baiting News Sites (BNS)—to deceive users into online investment fraud across 50 countries.

കൊച്ചി> നോൺ ബാങ്കിങ്ങ് ഫിനാൻസ് കമ്പനികൾ ഇറക്കുന്ന NCD(Non Convertable Debenture) കൾ എട്ട് നിലയിൽ പൊട്ടുകയാണ്. ഇതോടെ പല NBFC (Non Banking Finance Company)കളും അഭിമുഖീകരിക്കുന്നത് വൻ തകർച്ചയാണ്. കടപ്പത്...

A finance worker at a multinational firm was tricked into paying out $25 million to fraudsters using deepfake technology to pose as the company’s chief financial officer in a video conference call, ...

 Sri Lanka is trying to recover $2.5 million after a cyberattack on the Finance Ministry’s payment system redirected funds away from their intended recipient, exposing fresh weaknesses in the country’s public financial controls. Officials say the breach involved email manipulation, and the issue surfaced after opposition lawmakers alleged that treasury money had landed in a hacker’s account instead of reaching the correct creditor. The incident has prompted a high-level probe, with authorities treating it as both a financial loss and a serious security breach.  According to finance ministry secretary Harshana Suriyapperuma, cybercriminals were first detected trying to enter the External Resources Department’s system in January 2026, and the ministry took steps with overseas partners to stop further damage. He said the earlier attempt was contained, but the later payment breach still led to losses that are now under review. The stolen amount formed part of a larger $22.9 million payment, with $2.5 million reportedly disbursed between December 2025 and January 31, 2026.  The incident has drawn wider attention because it involves government debt repayment funds and an apparent failure in payment verification. Australia’s high commissioner in Sri Lanka said Canberra was aware of irregularities in payments owed to it, and Australian officials are assisting the investigation. That international angle has made the breach more sensitive, since the diverted funds were tied to a sovereign obligation rather than a routine domestic transaction.  A high-powered committee has been formed to investigate the hacking incident and identify how the payment was rerouted. Opposition lawyers have also asked Parliament to examine the matter, arguing that public finances fall under legislative oversight. The issue has been raised before the Committee on Public Accounts, adding political pressure on the government to explain how the breach happened and whether more funds may have been exposed.  The episode is a damaging reminder that cyberattacks can hit not just banks and companies but also state payment systems handling international debt obligations. For Sri Lanka, which is still recovering from its severe economic crisis and debt default, even a single diverted payment can deepen concerns about administrative safeguards and digital resilience. The investigation will likely focus on email security, approval controls, and how quickly suspicious payment changes were detected.

 KelpDAO has become the latest DeFi project to face a major security crisis after a $290 million heist that investigators say is likely tied to North Korea’s Lazarus Group. The attack targeted rsETH, a restaked ether asset used across several protocols, and drained about 116,500 tokens in a matter of hours. What makes the incident alarming is that the exploit did not appear to rely on a typical smart-contract flaw. Instead, it seems to have abused the project’s cross-chain verification setup, showing how a vulnerability in infrastructure can be just as damaging as a bug in code.  According to the project’s public statement, KelpDAO detected suspicious cross-chain activity involving rsETH on April 18, 2026, and quickly paused rsETH contracts across Ethereum mainnet and Layer 2 networks. The team said it was working with LayerZero, Unichain, and other partners to investigate the breach and contain the damage. On-chain activity later showed that the stolen funds were moved through Tornado Cash, a common laundering route used to hide crypto theft.  LayerZero’s early findings suggest the attack was highly coordinated. Researchers believe the hackers compromised RPC nodes and then used a DDoS campaign to force the system into failing over to poisoned infrastructure, where fraudulent cross-chain messages could be accepted as legitimate. In other words, the attackers appear to have tricked the bridge layer into believing a transfer had been properly authorized. That design weakness, rather than the asset itself, seems to have opened the door to the theft.  The impact propagated quickly beyond KelpDAO. Because rsETH is accepted as collateral in lending markets, the exploit created risk for other DeFi platforms, including Compound, Euler, and Aave. Aave responded by freezing and blocking new deposits or borrowing using rsETH collateral. The wider market reaction highlights how one compromised bridge can ripple across multiple protocols, creating uncertainty far beyond the original target.  The KelpDAO incident is another reminder that DeFi security depends not only on smart-contract audits, but also on the trust assumptions behind cross-chain systems. As protocols grow more interconnected, attackers need only find one weak link to trigger losses on a massive scale. For users and developers alike, the lesson is clear: layered security, diversified verification, and conservative bridge design are no longer optional.

 A massive fraud campaign abusing Indonesia’s official Coretax tax platform has siphoned off an estimated 1.5–2 million dollars in losses nationwide, highlighting how cybercriminals now weaponize public digital services at industrial scale.  Launched around July 2025 and ramped up ahead of the 2026 tax filing season, the operation preyed on taxpayers who believed they were interacting with legitimate Coretax channels. Although Coretax is only available as a web service, victims were deceived into thinking an official mobile app existed, turning their smartphones into entry points for financial theft. This gap between user perception and the platform’s real distribution model became the core social engineering hook. According to Group-IB, the attackers built a multi-stage attack chain that blended classic phishing with modern mobile malware techniques. It started with phishing websites that visually mimicked the Coretax portal and other trusted brands, then continued via WhatsApp messages and calls from impostors posing as tax officials. These contacts pushed users to download Android application packages (APKs) masquerading as Coretax tools for filing or synchronizing tax data. Once installed, the malicious apps granted remote access, allowing fraudsters to control infected devices, freeze screens, and intercept sensitive data. The campaign has been linked to the GoldFactory threat cluster, known for deploying advanced Android remote access trojans such as Gigabud.RAT and MMRat. Investigators uncovered 228 new malware samples tied to the operation, underlining the industrialized nature of the scheme. Beyond Coretax, the same infrastructure impersonated more than 16 reputable brands, including government services, airlines, pension funds, and energy providers, significantly widening the pool of potential victims. This brand-hopping strategy enabled attackers to reuse tooling while constantly refreshing lures. At its peak, the operation aimed at roughly 67 million Indonesian taxpayers and, more broadly, at 287 million individuals exposed to abused brands across the country. While the overall compromise rate remained relatively low—around 0.025% of users—the scale of the population meant financial losses and associated costs still reached between 1.5 and 2 million dollars. Among financial institutions protected by Group-IB, predictive detection and layered defenses limited successful fraud to just 0.027% of malware-compromised devices. This illustrates how early detection and behavioral analysis can sharply reduce downstream financial impact. Researchers warn that the operation appears to follow a malware-as-a-service model, supported by a centralized framework that has already generated nearly a thousand phishing URLs. The same toolkit could easily be repurposed against taxpayers and banking customers in other countries, with Thailand, Vietnam, the Philippines, and South Africa cited as likely next targets. For Indonesian users, the key defense is to remember that Coretax does not have a mobile app and is only accessible via official government websites. Verifying domains, refusing APK installations sent over messaging apps, and questioning unsolicited “tax officer” calls are now critical to staying safe during tax season.

 A sophisticated fake GST registration racket operating across 23 Indian states has resulted in a multi-crore tax evasion scam, exploiting weaknesses in the Goods and Services Tax (GST) system to generate fraudulent input tax credit (ITC) and evade government revenue on a large scale. The modus operandi largely involves creating fake GST registrations using forged documentation, including bogus Aadhaar and PAN cards, to establish shell entities with no actual business operations. These entities then issue fabricated invoices and generate e-way bills for non-existent transactions, facilitating the fraudulent input tax credit claims across genuine and shell companies. Regulatory authorities, including the Directorate General of GST Intelligence (DGGI), have uncovered several instances where syndicates employed layered transaction trails and fictitious suppliers to divert and siphon funds through systematic bogus invoicing.  Major raids and investigations in cities such as Chennai and Belagavi have led to the arrest of key accused individuals, recovery of fake documents, freezing of bank accounts, and seizure of property documents linked to the scam. For example, one case in Belagavi revealed fake invoices totaling approximately ₹145 crore, leading to the arrest of an individual under the CGST Act. This GST fraud network targets not just government revenue, but also paves the way for large multinational firms to benefit from inflated ITC, according to Enforcement Directorate findings. This cross-border and multi-entity approach compounds the scale and complexity of investigations, with dummy entities being used to link bogus invoices and move money through multiple shell companies across several states. In response, the government has intensified compliance drives and implemented reforms, such as biometric Aadhaar authentication for GST registration in select states and more stringent registration checks. Authorities warn that unsuspecting individuals could have their PAN and Aadhaar details misused for fake GST registrations, making vigilance essential for both businesses and citizens.  The ongoing investigations continue to unravel the extent of the network, highlighting the need for robust digital authentication, proactive monitoring, and inter-agency coordination to tackle these sophisticated financial crimes.

 A Kochi-based pharmaceutical company owner has suffered a loss of ₹25 crore in what is being described as the largest single-person cyber fraud case in India.  The incident involved a sophisticated online trading scam, executed through a fake trading application that lured the victim with promises of lucrative returns. Despite being an experienced trader, the businessman fell prey to deception after engaging with the fraudulent app for nearly two years. The scam unfolded over four months, during which the victim was lured by substantial profits displayed on his initial investments. These early gains convinced him of the app’s legitimacy, prompting more substantial investments. Investigators from the Cyber Cell revealed that the app consistently showed double profits, creating an illusion of credibility and financial success. This psychological manipulation is a common tactic used by cyber fraudsters to build trust and encourage deeper engagement from unsuspecting victims.  Trouble began when the businessman attempted to withdraw his funds, only to be met with repeated delays and a variety of excuses from the operators of the fake platform. As withdrawal requests were consistently stonewalled, suspicion grew. It was only after persistent failed attempts to access his money that the reality of the fraud became clear to the victim.  Upon reporting the crime, swift action was taken by law enforcement. The Indian Cyber Crime Coordination Centre was immediately alerted and subsequently forwarded the information to the Thiruvananthapuram Cyber Operations Headquarters. A formal case was registered, and efforts have been initiated to freeze the remaining funds before they could be routed to additional accounts. Investigation revealed that the fraudulent app was under the control of a foreign national, indicating possible international links and making the operation broader and more complex. The case has prompted a larger crackdown on similar cyber threats, with the Cyber Cell widening its probe to trace the perpetrators and prevent further occurrences.  This incident highlights the growing sophistication of online financial scams in India, emphasizing the need for increased vigilance, especially even among experienced investors. Awareness and prompt reporting remain essential defenses against such evolving cyber threats.

 In May of this year, an anonymous person called and texted elected lawmakers and business executives pretending to be a senior White House official. U.S. senators were among the recipients who believed they were speaking with White House chief of staff Susie Wiles. In reality, though, it was a phoney.  The scammer employed AI-generated deepfake software to replicate Wiles' voice. This easily accessible, low-cost software modifies a public speech clip to deceive the target.  Why are deepfakes so convincing?  Deepfakes are alarming because of how authentic they appear. AI models can analyse public photographs or recordings of a person (for example, from social media or YouTube) and then create a fake that mimics their face or tone very accurately. As a result, many people overestimate their ability to detect fakes. In an iProov poll, 43% of respondents stated they couldn't tell the difference between a real video and a deepfake, and nearly one-third had no idea what a deepfake was, highlighting a vast pool of potential victims. Deepfakes rely on trust: the victim recognises a familiar face or voice, and alarms do not sound. These scams also rely on haste and secrecy (for example, 'I need this wire transfer now—do not tell anyone'). When we combine emotional manipulation with visual/auditory reality, it is no surprise that even professionals have been duped. The employee in the $25 million case saw something odd—the call stopped abruptly, and he never communicated directly with colleagues—but only realised it was a scam after the money was stolen.  Stay vigilant  Given the difficulty in visually recognising a sophisticated deepfake, the focus switches to verification. If you receive an unexpected request by video call, phone, or voicemail, especially if it involves money, personal data, or anything high-stakes, take a step back. Verify the individual's identity using a separate channel. For example, if you receive a call that appears to be from a family member in distress, hang up and call them back at their known number. If your supervisor requests that you buy gift cards or transfer payments, attempt to confirm in person or through an official company channel. It is neither impolite or paranoid; rather, it is an essential precaution today.  Create secret safewords or verification questions with loved ones for emergencies (something a deepfake impostor would not know). Be wary of what you post publicly. If possible, limit the amount of high-quality videos or voice recordings you provide, as these are used to design deepfakes.

  Japan is witnessing an alarming rise in online brokerage account hacks, with cybercriminals manipulating low-volume penny stocks across international markets. Since February, these fraudulent activities have totaled over ¥100 billion (approximately $710 million or ₹6,070 crore)—a trend that continues to escalate. Hackers gain unauthorized access to investor accounts and purchase illiquid stocks—both in Japan and overseas. This artificially inflates the stock prices, allowing fraudsters to sell their own pre-acquired holdings at a profit. In response, some Japanese brokerage firms have halted buy orders for select stocks listed in China, the U.S., and Japan. Eight major brokerages—including Rakuten Securities Inc. and SBI Securities Co.—have confirmed unauthorized trades on their platforms. The attacks have exposed systemic vulnerabilities in Japan’s cybersecurity framework and could derail the government’s push for wider retail investment, particularly for retirement savings. Victims say they are left confused and unsupported. Securities firms have largely avoided covering user losses, leading to growing distrust among investors. Mai Mori, a 41-year-old part-time worker, said her Rakuten Securities retirement account was compromised. She lost ¥639,777, or about 12% of her portfolio, after hackers used her account to buy Chinese stocks. “The police told me that in most fraud cases, the victims often end up having to just quietly accept the loss,” said Mori. “Basically, there’s not much that can be done.” Rakuten told her to report the case to police, but authorities in Aichi prefecture refused, claiming that the victim was Rakuten, not Mori. The brokerage later stated it bore no responsibility. A Rakuten spokesperson told Bloomberg, “We will continue to examine each case individually and respond in good faith.” Other brokers including SBI, SMBC Nikko, Monex Group, Matsui Securities, Nomura Securities, Daiwa Securities, and Mitsubishi UFJ Financial Group made similar statements emphasizing individual case-by-case evaluations. Another Tokyo-based investor in his 50s, who requested anonymity, lost ¥50 million when his account was hijacked to purchase Japanese and Chinese stocks on margin. Despite receiving a suspicious notification, his brokerage was unable to freeze the account in time. Even though he previously only held index funds, his account was used to buy speculative stocks, including DesignOne Japan Inc., whose daily trading volume surged massively on the day of the hack. Japan’s Finance Minister Katsunobu Kato has urged brokerages to discuss compensation “in good faith.” The Japan Securities Dealers Association is also working on making multi-factor authentication mandatory for all trading accounts. “It’s not acceptable to issue a blanket denial of compensation,” said Chairman Toshio Morita. “Firms must consider each customer’s circumstances and respond appropriately.” According to the Financial Services Agency (FSA), fraudulent trading cases skyrocketed from 33 in February to 736 by mid-April. While precise victim losses remain unclear, the breach has slowed momentum behind Japan’s investment expansion programs. “Among people already using the system, including myself, there’s a sense that the financial firms need to do their jobs properly,” said researcher Yusuke Maeyama of NLI Research Institute. “When issues like this come up, it just reinforces their fears.” Cybersecurity experts say criminals use tactics such as adversary-in-the-middle attacks and infostealer malware to hijack accounts. According to Nobuhiro Tsuji from SB Technology, these attacks begin with phishing emails or malicious ads that redirect users to fake websites designed to intercept login credentials. Some scams even mimic real websites alongside fake ones in split-screen browser layouts. Infostealers, on the other hand, are malware that can extract stored passwords and personal data from infected devices without the user’s knowledge. Japan's preference for browser-based trading platforms over mobile apps—which offer better security—has contributed to the problem, said Yutaka Sejiyama of Macnica. A recent Macnica Security Research Center report found at least 105,000 leaked credentials linked to Japan. Many victims, like Mori, have voiced their concerns on social media, sharing their losses and frustrations. Some even considered legal action but backed out due to the time and effort involved. Mori is now contemplating closing her Rakuten account but is unsure which firm to trust, fearing hidden fees or pressure tactics from full-service brokerages.

 Hong Kong police have detained eight people accused of running a scam ring that overcame bank verification checks to open accounts by replacing images on lost identification cards with deepfakes that included scammers' facial features.  Senior Superintendent Philip Lui Che-ho of the force's financial intelligence and investigation division stated on Saturday that the raid was part of a citywide operation on scams, cybercrime, and money laundering that took place between April 7 and 17. Officers arrested 503 persons aged 18 to 80. Losses in the cases surpassed HK$1.5 billion (US$193.2 million.  Officers arrested the eight suspects on Thursday for allegedly using at least 21 Hong Kong identification cards that were reported lost to make 44 applications to create local bank accounts, according to Chief Inspector Sun Yi-ki of the force's cybersecurity and technology crime branch.  “The syndicate first tried to use deepfake technology to merge the scammer’s facial features with the cardholder’s appearance, followed by uploading the scammer’s selfie to impersonate the cardholder and bypass the online verification process,” Sun said.  Following the successful completion of online identification checks at banks, thirty out of the forty-four applications were accepted. In half of the successful attempts, artificial intelligence was used to construct images that combined the identity card's face with the scammer's. The others just substituted the scammer's photo for the one on the ID. Police claimed the bank accounts were used to apply for loans and make credit card transactions worth HK$860,000, as well as to launder more than HK$1.2 million in suspected illegal proceeds. Sun said the force was still looking into how the syndicate obtained the ID cards, which were claimed lost between 2023 and 2024. On suspicion of conspiracy to defraud and money laundering, police detained the six men and two women and seized numerous laptops, phones, and external storage devices.  The accused range in age from 24 to 41, with the mastermind and main members of the ring allegedly belonging to local triad gangs. Lui urged the public against renting, lending, or selling access to their bank accounts to anyone. The 333 men and 170 women arrested during the citywide raid were discovered to be engaged in 404 crimes, the most of which were employment frauds, financial swindles, and internet shopping scams. They were caught for conspiracy to defraud, gaining property by deception, and money laundering. Two cross-border money-laundering operations were busted in coordination with mainland Chinese authorities over the last two weeks.  Lui claimed that one of the syndicates laundered alleged illicit earnings from fraud operations by hiring tourists from the mainland to purchase gold jewellery in Hong Kong. Between last December and March of this year, the syndicate was discovered to have been involved in 240 mainland scam instances, resulting in losses of 18.5 million yuan (US$2.5 million).  “Syndicate masterminds would recruit stooges from various provinces on the mainland, bringing them to Hong Kong via land borders and provide hostel accommodation,” the senior superintendent stated. Syndicate members would then arrange for the recruits to purchase gold jewellery in the city using digital payment methods, with each transaction costing tens to hundreds of thousands of Hong Kong dollars. On Tuesday last week, Hong Kong police apprehended three individuals who had just purchased 34 pieces of gold jewellery for HK$836,000 per the syndicate's orders. Two of them had two-way passes, which are travel documents that allow mainlanders to access the city. The third suspect was a Hong Konger. On the same day, mainland police arrested 17 persons. The second cross-border syndicate arranged for mainlanders to create accounts in Hong Kong using fraudulent bank, employment, and utility bill documents. Police in Hong Kong and the mainland arrested a total of 16 persons in connection with the investigation. From December 2023 to April, the syndicate was involved in 61 scam instances in the city, resulting in losses of HK$26.7 million. Accounts were created to receive the scam money.

  FBI Warns Smartphone Users About Malicious Apps Smartphone users are being urged to exercise caution when downloading apps as some may be designed to steal personal data and send it to fraudsters, leading to potential scams. This alert applies to…

Al Pacino reveals in his autobiography how he lost $50M to a crooked accountant's Ponzi scheme, forcing him to take 'crummy movie roles.' This serves as a stark warning about managing your finances.