Inside India’s cybercrime investigations: How scammers exploit Telegram

BENGALURU: When 17-year-old Samiksha Narsale walked out of the National Eligibility cum Entrance Test (NEET) in May, she thought the past two years of preparation were finally behind her.A week later, allegations emerged that the NEET question paper had been leaked on Telegram. Authorities ordered a retest the following month. Even then, the Telegram channels she followed were flooded with rumours that the new test paper had also been leaked.About 2.2 million students took the NEET in 2026. India’s national qualifying exam for aspiring doctors and dentists, it is one of the country’s most competitive entrance tests. “Suddenly, everyone felt they had to be on Telegram because you didn't know what information might appear there,” Narsale told CNA. Samiksha Narsale, a NEET exam applicant, at her home in Ahilyanagar in the state of Maharashtra. (Photo: Samiksha Narsale) Acting on the National Testing Agency’s (NTA) recommendations, India temporarily blocked the Telegram messaging app from Jun 16 to 22.The NTA said the ban was “in response to the organised use of the platform by cheating rackets to defraud candidates” ahead of the re-examination on Jun 21. Telegram challenged the temporary ban, but a New Delhi court upheld the government’s decision, ruling that the restrictions were legal and reasonable. For investigators and cybersecurity researchers, the NEET controversy was only the latest example of a larger trend. Telegram has become a recurring feature in India’s cybercrime investigations.“What began as a communication tool is now an alternative to dark web forums,” said Shobhit Mishra, a threat intelligence researcher at CloudSEK, an Indian firm that monitors cybercrime ecosystems.Threat actors use Telegram as command-and-control infrastructure for malware, a marketplace for selling compromised data, and a platform for large-scale phishing and fraud campaigns in India, said Mishra.As governments across Asia grapple with the criminal misuse of messaging platforms, India's response also raises broader questions about whether platforms like Telegram have become critical infrastructure for organised cybercrime and what governments can realistically do about it.TELEGRAM UNDER THE SCAM SPOTLIGHTResearcher Mishra explained that whether a threat actor is selling leaked exam papers, pushing a fake crypto investment scam or distributing pirated software, they need three things: mass reach, anonymity and automated interactions.“Telegram provides all three out of the box, making it the most versatile tool available to modern cybercriminals,” he added.Telegram’s publicly searchable channels, anonymous usernames, automated bots, large groups that allow up to 200,000 members, and 4 gigabytes file-sharing limit make it useful for criminal networks, according to CloudSEK. These features are routinely exploited to automate phishing campaigns, credential theft and malware operations.Telegram disputes that characterisation. “Cybercrime can and does happen on every digital platform,” the company told CNA in a written statement.“It is categorically wrong to claim that Telegram is a piece of infrastructure for a problem that is endemic to the internet itself.” The company said its features “are not built to facilitate crime and provide no advantages for it”, adding that many have since been adopted by other platforms including WhatsApp and Instagram. Investigators also point out that Telegram is often only part of the fraud chain.Victims are often first contacted through WhatsApp messages or Facebook advertisements before being moved to Telegram, where organised fraud networks coordinate the operation, said Shubham Singh, a cybersecurity expert who works with Indian law enforcement on digital crime investigations. Singh said the victims vary, but the mechanics are often similar. Shubham Singh, cybersecurity expert speaking at a national conference on cyber awareness in Goa in September 2025. (Photo: Shubham Singh) Senior citizens and aspiring investors are lured with promises of quick returns, unemployed jobseekers are drawn in through recruitment scams, while students are targeted with leaked examination papers and coaching material. That is exactly what happened to Ananya (name changed to protect her identity), a 24-year-old woman from the state of Maharashtra.What began as a WhatsApp message offering paid work for writing fake Google reviews, quickly moved to Telegram.There, Ananya was contacted by someone identifying herself as a “receptionist”, who introduced her to a Telegram group where members regularly posted screenshots showing the money they had supposedly earned from completing simple online tasks. To begin, she was asked to write a few Google reviews and was paid small amounts for completing them. She was then encouraged to deposit a small sum of that money for “investment tasks”, which was promptly returned with a modest profit, reinforcing the impression that the opportunity was genuine.Only then did the operation change.A second person, claiming to be a “teacher”, took over the conversation. She instructed group members to make increasingly larger deposits, promising ever greater returns.Looking back, Ananya believes the entire operation had been carefully choreographed.“Whenever I asked questions, everyone gave the same answer: 'Just follow the teacher's instructions.' It didn't matter who I asked, the receptionist, the teacher or the other members. It felt like everyone was following the same script,” she told CNA.She said scammers benefited from Telegram’s features that let users discreetly edit chats and quickly create new accounts after old ones were reported. “Even after the director's account was marked as a scam, the teacher simply took over. It became clear that even if one account disappeared, another person would step in and continue the same scam,” she added. A person shopping on a mobile phone with a debit card. (Photo: iStock) According to Singh, the cybersecurity expert who works with Indian law enforcement, these scams are often run by small teams with clearly defined roles: recruiters build trust, money mules receive funds and technical operators manage the infrastructure. THE LIMITS OF INDIA’S CRACKDOWN Ananya reported the fraud to India's national cybercrime helpline after realising she had been scammed. Although her complaint was registered, investigators were unable to trace the money trail.“It took more than a month to trace the transactions. By then, the money had already been split across several bank accounts. I couldn't recover even a quarter of what I had lost.”Cybersecurity expert Singh pointed out that by the time investigators begin tracing the money, it has often already passed through multiple accounts, sometimes split into dozens of smaller transactions or converted into cryptocurrency. “Cyber fraudsters don't use their own bank accounts,” he said. “They use mule accounts and cryptocurrency wallets. By the time investigators reach one account, the money has already moved, sometimes to multiple accounts elsewhere,” he said.As the scams became more organised and visible, the Indian government's attention increasingly turned to the platforms being exploited by criminal networks.Investigators caution that the solution is not simply to ban messaging applications.Rahil Shaikh, a cybercrime investigator with the Maharashtra Police, told CNA that millions of legitimate users, particularly students preparing for exams, also rely on the platform because it makes sharing study materials easy.“The competition in these exams is enormous. Students are looking for any source that helps them prepare,” he said. “That's why they install Telegram. It has become a place where coaching material, lectures and educational content are shared.”Telegram told CNA it “actively combats misuse” of its platform using AI-powered moderation tools and automated systems that detect and stop millions of spam messages and scam campaigns.The company also defended its position in court, arguing that the temporary ban, imposed in response to misuse by a small number of users, would unfairly affect around 150 million legitimate users in India, including students and educators. The platform removed more than 43.5 million channels and groups in 2025, with daily takedowns increasing sharply over the course of the year, according to statistics published by Telegram and independently analysed by cybersecurity firms including Check Point Research. Rahil Shaikh, a cybercrime investigator with the Maharashtra Police at a cyber awareness event held at Armoured Corps Center and School in Maharashtra. (Photo: Rahil Shaikh) Police investigator Shaikh said that while Telegram generally cooperates with law enforcement requests, investigations are often hampered by the way criminal networks exploit the platform's features.“If usernames change, if conversations are deleted or if a VPN (virtual private network) is used, traceability becomes difficult and it takes much longer to investigate,” he said. “The platform needs to introduce features that restrict these activities,” said Shaikh, adding that the platform should strengthen authentication and deploy AI-based moderation to detect and remove illegal files, malicious links and fraudulent content before they spread.Edmund Goh, Head of INTERPOL's Asia and South Pacific Cybercrime Operations Desk, told CNA that platform restrictions can disrupt a criminal network's operations and raise its costs, but rarely eliminate it outright. “Well-resourced criminal groups adapt and relocate quickly to rebuild their businesses,” he added. LESSONS FOR ASIAIndia is not alone in grappling with the criminal misuse of messaging apps.Across Southeast Asia, cyber scam compounds have grown into industrial-scale operations, using mainstream messaging platforms, social media, telecommunications networks and financial systems to recruit workers, coordinate fraud and target victims across borders. “India's experience reflects a broader regional or even global challenge rather than an issue unique to one country or platform,” said Goh. A man passes Interpol signages at Interpol World in Singapore July 2, 2019. (Photo: Reuters/Edgar Su) Experts said criminal groups increasingly follow where users are, exploiting mainstream messaging platforms and social media to recruit victims, advertise illicit services and coordinate operations across jurisdictions. Goh cautioned against viewing Telegram as the problem itself.“If we only address the issue at a platform level, criminals will simply migrate to alternatives,” he said. Instead, he argued for a “whole-of-ecosystem response”, pointing to Singapore’s approach of combining police advisories, anti-scam technology, rapid coordination with banks, account intervention and sustained public awareness campaigns.That broader approach is echoed by Andrei Skorobogatov, director of communications at the Global Anti-Scam Alliance (GASA).“Criminals should not be allowed to have a safe place to hide. These platforms need to stand up and fight these crimes, working with global law enforcement and industry partners,” he said.