Anatomy of a Scam
Fake Job Scam
A report on anatomy of a scam and how the victim sought support from SFLC.in in recovering the money from scammers.
List of Scams
Practical step-by-step guides to help you identify online scams,and know what to do if you are targeted.
Digital Arrest
Digital Arrest Scam - Guide
Digital arrest is not a real legal process. Scammers may impersonate police or other officials, threaten you with arrest, and demand money to “settle” a case. Hang up, do not pay, verify independently, and report the scam immediately. If you have lost money, contact your bank and call 1930 as soon as possible.
GhostPairing
WhatsApp GhostPairing Scam - Guide
What is the GhostPairing Scam? The WhatsApp Ghostpairing scam has recently emerged as a formidable cyberattack that hinges on WhatsApp’s “Linked Devices” feature that allows users to access their WhatsApp account through external devices as well. The GhostPairing attack tricks the victim into silently adding the attacker’s devices as an invisible linked device on the account. Although the scam originated in Czechia, it has shown up in India from December 2025 onwards. News reports mention a Mumbai-based accountant who received a message from a colleague asking why he had sent her a strange photo link at a late hour when he had done nothing of the sort. Similar messages were found in other chats, even though his phone was not active during those hours. In another case from Coimbatore, a senior citizen noticed that bank-related conversations were appearing on his WhatsApp account that he had never initiated. It was only when his son checked the app settings days later that the problem became obvious: an unfamiliar browser was listed under 'linked devices' in his WhatsApp account. By then, private chats, family discussions, and shared documents had already been exposed. How does the Scam work? Scammers use one of two methods to gain access to the victim’s WhatsApp account: 1. QR Code Scammers are often equipped with reusable templates or webpages where they display the pairing QR Code for their browser or device. They deceive the user into scanning the same under pretexts of opening up the next step to their fictitious process, such as a job prospect, a “free online reward”, or a brand-new investment technique. Students are also made victims of this if the link to this fake web page is circulated across Telegram channels as a student resource, like a textbook or study guide. Once the user scans this QR Code, the scammer is automatically logged into their WhatsApp account. 2. Pairing Code When the scammer initiates the linking request, the other option to complete linking is through an 8-digit pairing code. After entering the victim’s WhatsApp number, the device attempting the link (the scammer, in this case) receives an 8-digit pairing code generated by WhatsApp Web. The user is then manipulated or intimidated to pressure them to enter this code into their WhatsApp. This code is often sent as an OTP for the scammer’s false webpage or as a code to be entered when the scammer builds trust by pretending to be an acquaintance, relative or friend. Although a pre-constructed website or page is often used to market the fake opportunity the scammer uses to gain access, that is not always necessary. The same can also be achieved through a Facebook or Instagram account created purely for interacting with users this way, and some of them rely on pure psychological manipulation after contacting the victim through a call or message. This is done by pretending to be a delivery driver or any of the other people who regularly ask for OTPs, and then acquiring any joining OTPs for linking to the victim’s WhatsApp. Why is this Scam dangerous? The most common effect of this scam is financial loss. The scammer can look through the victim’s WhatsApp account and can obtain sensitive information using bank statements, past transactions, passwords, and so on. The scammer can also impersonate the hacked account and ask for details and money from other sources such as the victim’s family and friends. If fueled by personal vendettas, this attack can also result in the scammer utilising personal and vulnerable information to the user’s detriment through blackmail and threats. The original account-holders themselves are often blackmailed in exchange for the scammer relinquishing their undue access. Government and Public Advisories CERT-In rated the attack as high severity, stating that "this newly identified cyber campaign called GhostPairing enables cybercriminals to take complete control of WhatsApp accounts without needing password or SIM swaps." The Commissioner of Police for Hyderabad City, V. C. Sajjanar, IPS, warned people of the GhostPairing scam on December 21, 2025, posting on X: "If you receive a message saying 'Hey, I just found your photo' with a link — DO NOT click it, even if it appears to come from someone you know." The Commissioner noted that cyber fraudsters can access photos, chats, and other private information, and are capable of sending messages while impersonating the victims and even locking them out of their own accounts. Federal Bank India has published a dedicated awareness page on GhostPairing, detailing the four-step attack chain for its customers.
Phishing
Phishing Scams - General Guide
This guide explores what a phishing scam is, how to identify such scams before they cause harm, and what remedies exist for people facing such scams.
Anatomy of a Scam
Vote Link Phishing Scam: Recovering A Hacked X Account
Social media accounts today are more than communication tools. They often hold years of personal memories, professional connections, and digital identity. Losing access to such an account can have significant personal and professional consequences. Yet users who fall victim to account takeovers often find that regaining access is far more difficult than expected, particularly when platforms rely heavily on automated grievance systems. This was the experience of an X (formerly Twitter) user whose account was compromised after she unknowingly clicked on a phishing link sent through a trusted contact. The attackers quickly changed the registered email address, locked her out of the account, and eventually, the account itself was suspended. Despite immediately attempting to recover her account, she was unable to regain access through the platform's official channels. This is a common pattern of the Vote Link Phishing Scam, which we at SFLC.in have been monitoring for the past few months. The user repeatedly reported the incident to X and followed X's account recovery process by contacting the platform's grievance officer. However, each attempt resulted in standardised, automated responses that failed to address the core issue. Since the attackers had already changed the account's recovery credentials, the platform's automated processes were unable to distinguish the legitimate account owner from an unauthorised user. Instead of resolving the complaint, the grievance mechanism trapped the user in a cycle of ineffective recovery steps. Helpless, the user turned to SFLC.in’s RightsLine, the 24x7 free legal helpline for all forms of online harm. Recognising that the platform's internal grievance process had failed, SFLC.in assisted the user in filing an appeal before the Grievance Appellate Committee (GAC) under Rule 3A of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. The appeal argued that X had failed to provide effective grievance redressal despite repeated complaints and sought restoration of the account through manual verification. The Grievance Appellate Committee was established to provide users with an independent forum when they are dissatisfied with the response of an intermediary's Grievance Officer or receive no meaningful resolution. It reflects an important principle of digital governance, that platforms should not be the sole decision-makers in disputes concerning their own grievance processes. Following the GAC appeal, X initiated a manual review of the case and verified the user's account ownership. The platform subsequently restored access by allowing the account to be transferred to a new registered email address. What weeks of unsuccessful interaction with automated recovery systems could not achieve was ultimately resolved through the statutory appellate process. What is the Vote Link Phishing Scam? The scam uses fake award nominations, podcast opportunities, and voting campaigns to steal social media credentials. Messages are often sent from accounts belonging to friends, colleagues, academics, or other familiar contacts that have already been compromised. The message may claim that the sender or someone they know has been nominated for an award and needs votes. The details can be tailored to the recipient's profession or interests. Reported examples include journalism awards, podcasting opportunities, Spotify-related voting campaigns, and community awards. The message contains a link to a fake voting page. The page may copy the branding of a legitimate organisation but is hosted on an unrelated or fraudulent domain, made specifically for stealing user data. It presents a fake poll and asks the user to log in with X, Instagram, email, or another account. One reported version offered options to continue with Instagram, email, or X. Asking for credentials to a service unrelated to the vote is a key warning sign; for example, a Spotify-related vote should not require an X or Instagram password. Other warning signs include an unfamiliar domain and pressure to vote quickly. In one incident reported to SFLC.in through RightsLine, aan X user received a message on June 20, 2026, from an academic they followed, claiming the academic had been nominated for a journalism award. The linked page asked for the user's X username and password and then claimed an OTP would be sent, but no OTP arrived. Within about 12 hours, the user was locked out of the account, and the associated phone number and email address had been changed. The account recovery process then requested a confirmation code the user did not have. Similar phishing scams have also been reported in the USA . After an account is compromised, it is used to send the same type of message to its followers. In the reported incident, the compromised account sent messages claiming that the account holder had been nominated for a podcasting award and asking recipients to vote. Some recipients were subsequently affected themselves. This allows the scam to spread through trusted accounts and their existing networks. Scammers may also create urgency by saying that voting is about to close, follow up with recipients who do not respond, or ask for a screenshot after the vote. These tactics can encourage people to act without checking the message or link. Anatomy of a Scam Most cyberattacks today do not begin with sophisticated malware or technical vulnerabilities. They begin with people. Social engineering refers to a class of attacks in which cybercriminals manipulate individuals into revealing sensitive information, clicking malicious links, or granting access to accounts and systems. Instead of attacking technology directly, these scams exploit trust, familiarity, and human behaviour. A common form of social engineering is phishing, where attackers impersonate a trusted individual, organisation, or service through emails, text messages, phone calls, or social media. Increasingly, these messages are personalised. Attackers often research their targets, mimic legitimate communication styles, or compromise existing accounts to make fraudulent messages appear authentic. This makes modern phishing campaigns significantly more difficult to identify than the generic spam emails of the past. The impact of these attacks extends far beyond individual users. In 2023, the cyberattacks on MGM Resorts and Caesars Entertainment demonstrated how a simple social engineering tactic could disrupt billion-dollar enterprises. According to Reuters, attackers associated with the Scattered Spider group gained initial access by impersonating employees and convincing IT helpdesk staff to reset login credentials. In this Vote Link Phishing scam as well, the scammers relied on the victim's social connections on X. Once an account was compromised, the attackers were able to use it to send direct messages to the account's followers, making the phishing message appear to come from someone the recipients already knew and trusted. X also allows users to upload their address books and uses imported contact information, subject to users' settings, to help people find and connect with others. A person's account can appear as a suggested account to someone who has their phone number or email address in their contacts. These features are intended to facilitate connections, but they also illustrate how information about a person's social and professional network can make social-engineering attacks more convincing. The important privacy concern is therefore not simply that a platform allows users to send messages. It is that information about relationships, followers, contacts and activity can help an attacker identify people who are more likely to trust a compromised account. In a scam such as this one, the attacker's advantage comes from being able to exploit an existing relationship rather than sending an obviously unsolicited message to a stranger. There is also a question of how platforms respond once an account has been compromised. X identifies unexpected Direct Messages, changes to account information and unusual account activity as signs of a compromised account. It also says that email-address changes generate an alert to the previously used email address, allowing the account holder to attempt to regain control. However, the reported incident illustrates the consequences when an attacker changes the recovery email address and phone number and the legitimate account holder is subsequently unable to access the account. The platforms should be able to detect and rapidly contain this kind of activity, not only for the individual whose account has been taken over, but also for everyone who receives messages from that account while it is under the attacker's control. While online platforms have invested heavily in automated systems to detect suspicious activity, account recovery often remains dependent on standardised workflows that may not adequately address cases involving identity theft or credential compromise. Effective grievance redressal therefore requires more than automated detection. It requires mechanisms capable of evaluating evidence, verifying identity through meaningful review, and providing users with accessible remedies when automated systems fall short. How to Protect Yourself Be cautious of unexpected requests to vote for an award, podcast, competition, or community initiative, even if the message comes from someone you know. Check the full web address before entering any information and make sure it is the official website of the organisation mentioned in the message. Pay attention to what information the page asks for. If a voting page asks for your X, Instagram, or email password when those accounts are unrelated to the vote, do not proceed. Similarly, do not let messages such as “voting ends today” pressure you into acting without checking the link first. If a friend or colleague sends an unexpected voting request, contact them through another app or channel to confirm that they sent it. Their account may have been hacked. Do not send screenshots or other proof of having voted if the page or request seems suspicious. If you have entered your password on a suspicious page, change it immediately through the platform's official website or app. If you use the same password elsewhere, change it there too. Check that your recovery email and phone number have not been changed, and review active sessions for anything unfamiliar. If you are locked out of your account, warn your contacts through another channel that messages from your account may contain a scam link. For users, good digital hygiene remains the first line of defence. However, as social engineering techniques continue to evolve, strengthening platform accountability and ensuring effective grievance redressal will remain just as important as improving individual cybersecurity practices.