Digital arrest scam: the five hours a fake CBI officer held a retired teacher hostage on a video call

The call about a parcel

Mrs Asha Kulkarni is sixty-six. She taught middle-school science for thirty-one years and retired to a two-bedroom flat in Kothrud, Pune, where she lives alone since her husband passed. Her son is a software engineer in Bengaluru. Her pension and her late husband's provident fund sit in a fixed deposit she thinks of as her one safe thing. She is careful. She reads the newspaper, she does not click on lottery messages, she keeps her PIN in her head.

On a Wednesday morning in May, a little after eleven, her phone rang. An automated voice, crisp and official, said a parcel booked in her name had been intercepted by customs and was being returned. To speak to an officer, press 9. She had not booked a parcel. That was exactly why she pressed 9. She wanted to clear up the mistake.

A man came on the line. He gave a name, a badge number, and said he was calling from the courier coordination cell. The parcel, he said, had been sent to Taiwan in her name and contained five passports, three credit cards, and 200 grams of a banned substance. It had been flagged. Her Aadhaar number was on the shipping document.

"Madam, this is now a serious matter," he said, his voice turning grave. "I am transferring you to the cyber crime branch. Please do not disconnect."

The line clicked. A second man answered, harder and colder. He said he was a senior officer with the CBI, investigating a money-laundering network, and that her bank account had received funds from this network. He asked her to switch to a video call so he could "verify her identity for the official record." On the screen appeared a man in a khaki uniform, sitting at a desk, a framed national emblem behind him, a board on the wall that read, in official-looking lettering, what could have been any police station in the country.

"Mrs Kulkarni," he said, looking straight into the camera, "as of this moment you are under digital arrest. You are not permitted to leave this call, to end this call, or to contact any other person, including your family, until the investigation clears you. Doing so will be treated as obstruction and a non-bailable warrant will be issued in your name. Do you understand?"

She understood nothing, and she believed all of it. The uniform. The emblem. The badge number she had written down. The fact that he knew her Aadhaar, her full name, the branch of her bank. Her heart was hammering. She nodded at the screen.

Five hours that did not exist

What followed was a method, not an accident. The officer kept her on the video call and would not let her hang up. He told her to draw the curtains. He told her to sit where he could see her. Every twenty minutes another "officer" or "supervisor" appeared, escalating, contradicting, demanding. They showed her a document on screen with the Supreme Court letterhead and her name typed into it. They told her there was a "confidentiality order" on the case, which is why she could tell no one.

Then came the offer of a way out. To prove the money in her accounts was clean and not part of the laundering network, she would need to transfer it to a "secured RBI verification account" for inspection. Once verified, every rupee would be returned within twenty-four hours, with an official receipt. If she refused, the funds would be frozen and she would be arrested physically by evening.

She broke her fixed deposit. She moved Rs 18 lakh, in three transfers across the afternoon, to account numbers the officer dictated. Each time, he stayed on the video call and watched her do it. Each time, he praised her cooperation and promised the refund was being processed.

At around four in the afternoon her son, unable to reach her all day, did something simple. He called her neighbour on the landline. The neighbour knocked. Mrs Kulkarni, panicking, told the officer she had to answer the door or it would look suspicious. He told her she had two minutes. At the door, the neighbour, a retired bank manager, took one look at her face and the phone in her hand and the words she whispered, and said a single sentence that ended the whole thing.

"Asha, there is no such thing as a digital arrest. The police do not arrest anyone over a video call."

She hung up. The money was already gone. But the spell, the thing that had held her for five hours, broke in that one sentence on her doorstep. She had not been talking to the police. She had been talking to a call centre, run like a business, that does this to a new person every single day.

So what is a digital arrest, legally?

Nothing. It does not exist. There is no provision in Indian law, or in any country's law, that allows a person to be "arrested" or detained over a video call. An arrest is a physical act carried out by an officer with jurisdiction. No legitimate investigation has ever required a citizen to stay on a Skype or WhatsApp video call for hours, draw their curtains, and avoid contact with their family. The entire concept is invented theatre, designed to do one thing: isolate you and run down your judgment until you transfer money.

The agencies the scammers wear like costumes are real. The CBI, the police, customs, the Narcotics Control Bureau, TRAI, the Enforcement Directorate, the courts. That is the trick. They borrow the fear those names carry. But none of those agencies works this way. The CBI does not phone citizens about parcels. TRAI does not video-call you about your SIM. Customs does not demand a "clearance fee" by UPI. The Reserve Bank of India does not hold a "verification account" where you park your savings to prove they are clean.

In June 2026, Google's Fraud and Scams Advisory specifically named digital arrest and police-impersonation scams as a rising consumer threat, the kind of cross-border, high-pressure fraud that is growing faster than awareness of it. India's own cyber crime coordination centre, I4C, and the national helpline 1930 exist precisely because of how widespread this has become. The point of this post is to make sure the next call ends at the word "arrest," not five hours and eighteen lakh later.

The exact script, so you can recognise it instantly

The calls vary in detail but follow one spine. Once you have seen the shape, you cannot un-see it.

• The hook. A recorded or live call says a parcel, a SIM card, a bank account, or an Aadhaar-linked document of yours is connected to a crime. Press a number to "speak to an officer."
• The handoff. You are "transferred" to a more senior agency, the CBI, cyber crime, narcotics, the Enforcement Directorate, each handoff raising the stakes and the fear.
• The uniform. The call moves to video. A man in a police or CBI uniform appears, with an emblem and a station backdrop, to make it real. The setting is staged.
• The detention. You are told you are under "digital arrest" or "virtual custody" and cannot leave the call or contact anyone. This is the lie everything else rests on.
• The isolation. A "confidentiality order" forbids you from telling family. You are told to stay on camera, draw curtains, move to a room alone.
• The proof-of-innocence trap. To clear your name, you must transfer your money to a "secured" or "RBI verification" account for inspection, with a promise of a full refund once verified.
• The deadline. Refuse and a warrant is issued, your accounts are frozen, you are arrested physically tonight. Every minute is made to feel like the last one.

One sentence to keep in your head: the police never put you under arrest and then ask you to send them money to get out of it. That is not how any justice system on earth works.

What the fake portal looks like, and why you should never open it

Many of these crews do not stop at the call. To make it feel official, they push you to a website: a fake "case status" page, a fake court or CBI portal, a fake RBI "fund verification" form, or a payment page styled to look governmental. They send the link by SMS, WhatsApp, or read it out while you type. The domains are throwaway lookalikes built to be believed for a single afternoon and then abandoned. Examples of the shape they take, defanged so they are safe to read here, include cbi-case-verify[.]online, rbi-fund-verification[.]site, ecourt-arrest-warrant[.]info, customs-clearance-pay[.]xyz, and i4c-cybercell-portal[.]top. None of those are real government addresses. Real Indian government sites end in gov.in or nic.in, the genuine cyber crime portal is cybercrime.gov.in, and the central bank is rbi.org.in. A "court portal" on a .online or .top domain is a scam by definition.

If a caller ever sends you any link during a call like this, do not open it. Paste it into the checker below first and let our engine judge it before you ever load it in a browser.

What SafeBrowz sees on the network

A phone call is outside any browser, and we are honest about that below. But the fake portal stage is exactly where a browser-side defence earns its place, because the lookalike government, court, and payment pages live on the web, and that is our home ground. Here is what our 3-layer engine looks for when one of these links is opened.

• Layer 1, Local rules. Government-impersonation lookalikes lean on cheap, high-risk TLDs (.online, .top, .xyz, .site, .info) and on words like "cbi," "rbi," "court," "warrant," "clearance," "verification," and "i4c" stitched onto a non-government domain. Our 60+ URL pattern signatures and 550+ brand database flag a page that wears a government or institutional name on a domain that is not gov.in or nic.in, directly in your browser, before the page is trusted.
• Layer 2, Threat-intelligence APIs. The moment one of these throwaway portals is reported anywhere in the world, cross-referencing against Google Safe Browsing, PhishTank, URLhaus, and reputation feeds means a domain flagged in one country is blocked for the next victim everywhere.
• Layer 3, AI content analysis. The throwaway nature is the whole problem: a "CBI case verification" portal spun up this morning is not on any blocklist yet. AI content analysis, run through our proxy and working in over 100 languages, reads the page itself and recognises the pattern of a fake-authority payment or "fund verification" form even on a brand-new domain with no history.

Which agencies the attackers will impersonate next

The brand pivot in this scam is rapid, because the only requirement is a name that carries fear. We have watched the costume change from customs to CBI to TRAI within a single quarter. Based on the pattern, the next wave of impersonations to expect: the Enforcement Directorate and Income Tax Department (tying the script to "undisclosed income" and GST), the Department of Telecommunications and TRAI (tying it to the SIM and the new telecom rules), state cyber cells dressed up as the national I4C, the National Investigation Agency for a "terror funding" angle, and increasingly the courts themselves, with fake e-court "summons" and "non-bailable warrant" PDFs to push victims onto a payment portal. Each new costume needs a matching lookalike domain, which is precisely the surface a brand-aware scanner is built to catch as it appears.

Why a browser defence matters when the first contact is a phone call

It is a fair question: if the attack starts with a phone call, what can a browser extension possibly do? The answer is that almost every one of these scams has a second stage that lives on the web, and that second stage is where the money actually moves. The "officer" reads out a link to a fake RBI or court portal. The "supervisor" texts a "case status" page to make it feel real. The "clearance fee" is collected on a payment page that impersonates a government gateway. The voice on the call is the pressure; the web page is the mechanism. Breaking the second stage breaks the transaction even when the first stage got through. A scared person who cannot load the fake portal, because the browser blocked it with a clear warning, gets a second of friction at the exact moment they most need to stop and think. That friction is the architectural point. We cannot un-ring the phone, but we can make the fake portal refuse to load.

The red flags inside the call

If a call ever starts to feel like Mrs Kulkarni's, run through these before you touch your phone's banking app. The combination, not any single item, is the tell.

• The words "digital arrest," "virtual custody," or "online interrogation." These do not exist in law. The instant you hear them, you are talking to a scammer. Full stop.
• A video call from "police," CBI, customs, TRAI, narcotics, or a court. No real Indian agency conducts an investigation or an arrest over a video call. A uniform on a screen is a costume.
• A demand that you stay on the call and tell no one. "Confidentiality order," "do not disconnect," "do not contact your family." Secrecy exists only to stop you from getting a second opinion that would end the scam.
• Knowing your Aadhaar, name, or bank to "prove" they are official. This data is widely leaked and bought cheaply. Knowing it proves nothing.
• A demand to move money to a "verification," "secured," or "RBI" account to prove it is clean. No agency on earth asks you to transfer your savings to prove you did not commit a crime. This single demand is the scam, every time.
• A ticking deadline and a threat of immediate arrest. Tonight. Within the hour. Before the warrant is issued. Real legal processes do not run on a video-call countdown.
• A link to a "case portal," "e-court," or "clearance payment" page. Especially on a .online, .top, .xyz, or .site domain. Real government sites end in gov.in or nic.in.

What to do if you are on such a call right now

If this is happening to you at this moment, do it in this order. Do not feel rude. The person on the screen is not a police officer.

• Hang up. You are allowed to end any call. There is no law, no warrant, and no officer that can stop you. Disconnect now, before you do anything else.
• Do not transfer any money. No UPI, no NEFT, no bank transfer, no "verification deposit," no gift cards, no crypto. There is no legitimate reason to move your savings to prove they are clean.
• Break the isolation immediately. Call a family member, a neighbour, or a friend and tell them what is happening out loud. The scam survives only in silence. One outside voice ends it.
• Do not open any link the caller sends. If you already have it, paste it into a checker first. Do not type your details into any "case status" or "verification" page.
• Call 1930. The national cyber crime helpline. Report the call even if you have not lost money. They will guide you.
• If you already transferred money, move in the first hours. Call your bank's fraud line, request an immediate freeze, and file on the steps below. The first hours decide whether a transfer can be held.

How to verify any "official" claim in two minutes

The whole scam depends on you not checking. So check. No real officer will object to you verifying their identity through official channels, because a real officer expects it.

• Hang up and call the agency yourself. Look up the official number for your local police station or the agency from its real gov.in website, never a number the caller gave you, and ask if there is any case in your name.
• Check the domain. Any "official" portal must be on gov.in or nic.in. The real cyber crime portal is cybercrime.gov.in. The real central bank is rbi.org.in. A government "portal" on any other ending is fake.
• Remember the two absolutes. Real police never arrest over a video call. Real agencies never ask you to transfer money to prove your innocence. If either is happening, it is a scam, no matter how convincing the uniform.
• Take your time. Real legal processes give you days and written notice, not a forty-minute video-call deadline. Urgency is the scammer's only real weapon. Slowness is your defence.

How SafeBrowz blocks this threat

SafeBrowz runs a 3-layer detection architecture: Local + APIs + AI.

• Layer 1, Local detection: 60+ URL patterns and 550+ brand-specific signatures run directly in your browser. This catches the fake "CBI case," "e-court warrant," and "RBI fund verification" portals, the lookalike government domains on cheap TLDs, and the fake payment gateways scammers push during the call.
• Layer 2, API checks: Google Safe Browsing, PhishTank, URLhaus, and reputation feeds cross-reference flag known malicious domains the moment they are reported anywhere in the world.
• Layer 3, AI deep scan (Premium): AI content analysis via our proxy, in over 100 languages, reads the page and flags brand-new fake government and court payment portals that have not been blocklisted yet.

Honest disclosure: SafeBrowz cannot stop a phone call. We are a browser extension, not a phone carrier, and we say so plainly. What we block is the second stage, the fake portal or payment page the "officer" sends you to once you are frightened enough to comply. The call itself is defended by the human moves above: hang up, tell someone, and call 1930. Layer the call defence with the link defence and the scammer runs out of room.

Detection signatures are derived from threat-intelligence research and our internal brand database, not from user browsing data. SafeBrowz does not store per-user browsing history.

What victims do right now in India

If you or someone you know has just been hit, the next hours matter more than anything else. Move through this list without waiting.

• Call 1930 immediately. The national cyber crime helpline, run under I4C. Report the fraud and get the transaction flagged. The sooner a transfer is reported, the better the chance the receiving account can be frozen.
• File a complaint at cybercrime.gov.in. The official National Cyber Crime Reporting Portal. Choose the financial fraud category and submit every detail: the phone numbers, the account numbers you sent money to, screenshots, and the call timeline.
• Call your bank's fraud line and freeze. Not the regular branch line. Ask for an immediate hold on the beneficiary transaction and on your own account if needed. Banks can sometimes claw back a recent transfer if you act fast.
• Report to your local police or the nearest cyber crime police station. File a written complaint so there is an official case reference your bank can work with.
• Preserve everything. Do not delete the call logs, the WhatsApp or SMS messages, the links they sent, or the bank transfer receipts. They are your evidence.
• Tell your family and warn others. The shame these scammers count on is exactly what keeps the next victim quiet. Speaking up protects the next person in your circle.

FAQ

What is the digital arrest scam?

The digital arrest scam is a fraud where criminals impersonate the police, CBI, customs, TRAI, narcotics, or a court and call you claiming a parcel, SIM, bank account, or Aadhaar-linked document is connected to a crime. They move you to a video call, claim you are under "digital arrest" and cannot contact anyone, and pressure you to transfer money to a "verification" account to prove your innocence or pay a "clearance." There is no such thing as a digital arrest in law. Real police never investigate or arrest anyone over a video call.

Can the police actually arrest you over a video call?

No. An arrest is a physical act carried out by an officer with jurisdiction, with proper documentation. No Indian agency, including the CBI, the police, customs, TRAI, the Narcotics Control Bureau, or the Enforcement Directorate, conducts an arrest or an interrogation over a Skype, WhatsApp, or video call. Anyone who tells you that you are under "digital arrest" or "virtual custody" and cannot hang up or contact your family is a scammer, no matter what uniform or emblem appears on the screen.

What are the biggest red flags of a digital arrest call?

The words "digital arrest" or "virtual custody," a video call from a supposed officer in uniform, a demand that you stay on the call and tell no one because of a "confidentiality order," and a demand to transfer your money to a "verification" or "RBI secured" account to prove it is clean. Add a ticking deadline with a threat of immediate physical arrest and a link to a "case portal" on a cheap domain like .online or .top. Any one of these is suspicious. Together they are the scam confirmed.

How do I report a digital arrest scam in India?

Call the national cyber crime helpline 1930 immediately, even if you have not lost money. File a complaint at the official portal cybercrime.gov.in under the financial fraud category with all details, the phone numbers, account numbers, screenshots, and call timeline. Call your bank's fraud line and ask for an immediate freeze on the transaction. File a written complaint at your local police or nearest cyber crime police station so your bank has an official case reference. Preserve all messages, links, and receipts as evidence.

I already transferred money on a digital arrest call. What do I do?

Act in the first hours. Call 1930 right away and report the fraud so the receiving account can be flagged and potentially frozen. Call your bank's fraud line, not the branch line, and request an immediate hold on the beneficiary transaction. File at cybercrime.gov.in and at your local cyber crime police station for an official case reference. Do not delete anything: the call logs, messages, links, and bank receipts are your evidence. The sooner a transfer is reported, the better the chance any of it can be held.

Does SafeBrowz block digital arrest scams?

SafeBrowz cannot stop the phone call itself, no browser extension can, and we say so plainly. What it blocks is the second-stage attack that usually follows: a fake "CBI case" page, a fake e-court "warrant" portal, a fake "RBI fund verification" form, or a lookalike government payment gateway where the victim is told to send the money. Our 550+ brand database and lookalike-domain detection catch those impersonation pages in real time, and our AI layer (Premium) catches brand-new scam pages the moment they go live. Pair SafeBrowz with the human rule, hang up and call 1930, and you cover both ends of the attack.

Last updated 2026-06-11