Hacker News Reader

>There is a scam going on in India. Random females, who are either naked or scantily clothed, will call up on WhatsApp Video. If you pick up the call, say while in the bathroom and not fully clothed, they will take screenshots and threaten you that they will make that picture “viral” to extort money.

This is baffling. First, how much % of the day do you spend naked? 1-2%? So the success rate of any given call is going to be 1-2% at most, given that otherwise theres nothing scandalous to post. Second, do people just instinctively accept video calls, while they're naked? That seems very unlikely to me.

The receiver don't have to be naked. So, here is the story that got me to look into this a bit to learn what was happening. Father-in-law don't keep all the phone numbers updated, so, he picks up all calls -- mostly video calls from his kids and grandkids.

One day, he picked up a WhatsApp Video, where the woman on the other end was pretty much naked. Father-in-law was in the couch and gave the phone to my wife, asking who is on the other end. After some verbal exchanges to stop calling us; a barrage of WhatsApp message began -- screenshots of a semi naked women and father-in-law on a video chat.

I ignored the first time wife complained. By the 3rd, or so message, I called up a friend to give them a casual call and let them know who he was. Yeah! This whole scamming to get people's picture in phone screenshots getting "viral" seems to be a common scam in India.

If all it takes is a screenshot, why not just photoshop it? Why do you need to call at all? I know there are a lot of scam calls trying to get payment credentials or get people to make payments but this MO sounds quite implausible.

The screenshot is likely the precursor the the video they record since the call got established. For most non-tech, and generations prior to us, would be startled, and likely to act in a haste to avoid further embarrassment. Let's say they have a success rate of less than 10% (1 in 10 calls), it is worth their time sitting in cabin somewhere in a town in India earning ₹25,000 a month working for an "Support Call Center" helping them setup this scam patterns.

You wanna try a sure-shot scam/Spam game right now?

1. Register a domain in India or via an Indian registrar, I will guarantee you that in the next few days to weeks, you will get all the needed spam in your inbox associated with that domain registration. If you have given your phone number, then they will call up there too.

2. Register a company. Baam! Phone calls, emails, and the very famous Book Parcel scam via the post office to the registered address, and what not.

Have fun. India is definitely not for beginners. /wink

> Register a company

I think that works everywhere, not just in India. I'm getting spam to my Estonian company's and my Russian sole proprietorship's email addresses at least every week.

Same, but it's all from India!

Norway too. When you register a sole proprietorship in your name in Norway, you will soon get multiple other Norwegian companies contacting you.

Some of them purport to help you “start your business”. They will charge you money and provide about zero value. They are not trying to help anyone at all, they are just looking to exploit inexperienced people.

And the worst ones will use wording to make themselves seem like this is another required step in order to complete the creation of your company. All the while being very careful so that although the wording tricks other people they can still snake their way out of trouble by pointing to some part or the message they sent that somehow clears them of any way to get them fined or otherwise punished for actual fraud.

This was already a problem years ago when I registered my own sole proprietorship. I am sure that today with the ease of generating convincing garbage using LLMs the problem is probably even greater.

Same in the US. Register a domain, and a few months before it expires you will get an official-looking invoice requesting payment to renew it. In small print somewhere it will disclose that it is a "solicition for services" and not an invoice. The tipoff should be that the renewal is about 10x the price of the original registration but I guess enough people are taken in that it's worth doing.

Since they send these notices by mail, there will be a disclosure in it somewhere, otherwise it would be mail fraud which is a rather serious federal crime.

I would guess 1) it is easier to screenshot than to find a picture of someone and then photoshop it in 2) scams are almost always about fear and urgency -- if you tell them you are going to photoshop it and let them think about it for a while, your chances of getting paid are much smaller than if you go 'gotcha now pay me or I hit send'

Because the person making the call does have proof that the victim actually picked up the call. If they needed to they could show up in person and show the blackmailing material to someone else (wife, boss), and show them on their screen that the victim picked up the call, and prove it. That's surely worth something.

Showing up in person to blackmail is a sureshot way to get beaten up by victim and their supporters in India, 99% of the times. It is like police-on-the-way pay up right now scams happening in USA. Scammer takes advantage of fear of insult of police showing up & in handcuffs. If the police actually show up, the fear is gone, it can't be undone.

The naked video chat scam, when it was new, was mostly banking on victim wanting to keep it secret or wanting to go away. Once of somebody shows up, that shame is gone; and beating ensues.

Yes, Photoshop happens, simple clothed people face gets plastered of fake screenshots.

There are plenty of other scams going on. Like international caller will call and say your son/daughter/relative is on trouble (hospital, police, accident) amd pay right now to get him saved from that said trouble.

Or caller will say that I will send you X amount of money to safe keep, but pay x/100 now to get X across.

And many.

> So the success rate of any given call is going to be 1-2% at most, given that otherwise theres nothing scandalous to post

OP didn't mention it explicitly, however, chatting with a scantily clad person on the other end can be used as blackmail material too no matter what state of dress you are in.

Crazy that a country as populous is acting so prudent.

How so?

Hmm, where do I begin?

1. Bringing a mic and camera equipped device to the bathroom.

2. Accepting video calls from naked people.

3. Acting ashamed for having a naked person on screen.

I tried to make a joke because the premise sounds crazy and extremely hypocritical to me.

I think the word prudent is throwing people off. Did you mean prudish?

I totally did, thank you!

1-2%?! Do you sleep in your clothes?

And while many of us don’t by habit take video calls from strangers when we are disrobed, at scale in India it’s sure to happen.

if i'm clothed 98% of the day, it was a bad day. i wear as little as possible at all times. takes all kinds, however, but i'm sitting in mccarthy, alaska rn, in a robe i brought from my home in anchorage, so i'd only have to put on pants when necessary.

Good update on your geographical situation and current pants configuration.

I withheld using UPI through the pandemic and a long while after that because of the no. of fraud cases I kept reading about and my reservations about UPI’s origins. But gave in and got in after moving to a new city and getting stuck in multiple places for the want of 5/10 rupees in change that somehow nobody seemed to had.

I mostly just use it my grocery store and vegetable store or in those no-change situations. Yet, in the last week alone I have blocked at least 3 WhatsApp chats from unknown numbers about offers, business deals, one even very friendly female hi.

Now I know from where

If you have 'custom' UPI ID (and not <phone number>@bank) then UPI payment is not an issue

No, a custom UPI ID won’t save you from your phone number being shared with merchants. [1] UPI payments also leak the person’s full legal name on transactions. Whether this is useful in merchant payments (not personal payments to known people) is highly doubtful.

[1]: https://scroll.in/article/1045536/are-your-upi-payments-farm...

I wanted even things like my bank name or UPI app itself to be private. So I discovered that we can creat a 9 digit UPI number/ID and use that. But doesn’t seem to help. Support for that seems to be non-existent. I have tried entering it places that ask for UPI id like online portals, but no. Only the @ format seems to be supported everywhere

You can create an alphanumeric UPI handle on most UPI applications.

This will hide your phone number.

Eg: My UPI id is sudshekhar.cheq@trans.

Most other UPI apps allow you to create such handles AFAIK.

Nowadays, you can also keep your bank details private by using UPI with a wallet instead of savings account.

The UPI protocol lets the acquirer lookup this to get additional information, and this is being used by several acquirers, notably Smartbuy@HDFC to provide phone numbers to merchants.

I think most data selling happens via branch employees / telecom operators instead of "at the top"

Banks / UPI vendors have to comply with very strict data regulations and the confirmation of a "data leak" is enough to attract heavy penalties from the NPCI and RBI. Most banks and UPI service providers will never risk it, specially post the DEPA guidelines which have recently been adopted.

See this thread on twitter for reports: https://nitter.net/jackerhack/status/1632029845642412033, https://nitter.net/jackerhack/status/1630636510994378752

Both these tweets can be addressed by adopting a UPI enabled wallet.

Using Cheq, you can keep your bank account plus mobile number secret. Everyday small value transactions can also be consolidated separately from your main bank account.

I don't think anyone is selling data in the UPI ecosystem but if they are, that's a very short-sighted strategy to make money for sure.

Nope. An alphanumeric UPI handle won’t hide your phone number [1]

UPI payments also ~~leak~~ share the person’s full legal name on transactions…and the phone number.

[1]: https://scroll.in/article/1045536/are-your-upi-payments-farm...

Hey, please try making a payment through a Cheq alphanumeric VPA. Your phone number won't get shared with the merchants.

Legal Name -> Yes, everyone gets to see your full name post scanning the UPI payment app.

But this is a feature not a bug. Since in most cases I want to confirm the identity of the person I am paying to.

And allowing people to display any name as their UPI username will lead to much more identity fraud than you can imagine.

Yes, upi ID generated by wallet app (I use PhonePe) doesn't tell others anything about my bank. It simply says money sent from davchana@ybl (YBL is Yes Bank, but my connected accounts to PhonePe are not Yes Bank). All PhonePe accounts are ybl irrespective of your connected banks.

I'm not sure if it's possible with UPI but I know in Kenya many people will get a second, cheaper phone to use for m-pesa (mobile money), I think partially so the battery doesn't die on it but it could also reduce the types of calls you're talking about, or at least make it obvious that someone is calling your mobile money number.

Is that possible with UPI? Or even a dual sim? I'm not sure if the account is tied to the person or the number.

I think the issue is that Bank Accounts also need phone numbers linked to them and it seemed like only one phone number could be tied to an account. Having a secondary phone number used to combat spam also being the sole number tied to a Bank account could be bad. I could be wrong about the single phone number for an account, but that was what I experienced recently.

Account is tied to person's account number. Apps usually need current crop of phones, 5-7 years old phones not supported by app store are also not supported by apps.

Using ICICI bank iMobile you can create a random UPI id totally unrelated to your phone number I agree with the problems you mention, and in general there is an increasing trend of taking phone numbers of customers in India, e.g. once at a Nike store, I was told the purchase couldn't be complete without the phone number.

I refuse to give phone numbers and usually the cashier will enter their own fake phone number to let the system proceed further. Some shops like decathlon tried to force us to install their app, create an account and then scan and pay through that – at the cashier counter. I just left the entire shopping cart there and walked out without purchasing. Such crazy things do happen but those companies will learn the lesson quickly as Indians are quite savvy about these things.

I do the same but in this case I had already made the payment and they refused to give me an invoice without a contact number, and I didn't have any interest in a confrontation. If I had not made a payment I would have simply walked out.

Next time, tell them that the Union Minister of State for Electronics and IT has said that people shouldn’t give their phone numbers at retailers if there’s no justifiable reason. [1]

If they refuse to give an invoice, tell them you’ll report them for GST evasion. [2]

[1]: https://www.onmanorama.com/news/india/2023/02/13/rajeev-chan...

[2]: https://theprint.in/economy/govt-launches-gst-reward-scheme-...

> but then you got a phone call later on - naively to upsell something, or the next step up, trying to scam you

This should have been obvious in retrospect. Call spam is India's biggest export.

Anyone doing video calls sorta deserves it, especially if they are accepting video calls from people they don't know.

EDIT: we kind of solved this problem in Brazil (PIX is similar do UPI, predates it in fact), as the user can opt to user other identifiers, or even generate a random GUID-like identifier.

> PIX is similar do UPI, predates it in fact

PIX was announced in 2019, UPI was launched in 2016.

>I wish that the transaction is obfuscated and the phone numbers and/or UPI ID are hidden.

You can create a Private UPI ID it's supported on PayTM. Your phone number is not revealed when you send / receive payments.

Damn. UPI shares your phone number?

Instant PLONK.

But I have been hearing raves about how great it is, from my Indian friends.

Not the protocol itself. Your ID is an arbitrary alphanumeric string that you register with a provider. But most people just use their phone number.

See https://news.ycombinator.com/item?id=37371646

I’ll avoid repeating my previous comment [1], which has details on this. Unlike the mistaken belief of several people on this post, UPI does share the phone number even if a person uses an alphanumeric UPI ID instead of the initial or common phonenumber@provider address.

[1]: https://news.ycombinator.com/item?id=37371646

No, you can make any upi id, like emails. Apps, being lazy, start giving phonenumber@app id to its new users. I always have used custom@app upi ID.

> You pay for a nice hot cup of ₹10 Chai on the streets but then you got a phone call later on - naively to upsell something..

Not sure what is this about.

Everyone pays using QR Code. No personal information like phone numbers are passed on to the merchant.

Paying via QR code is irrelevant, the receiver will see the UPI id you paid via, and 99.9% UPI ids are phone@<some_alias>. The QR code just is a shortcut to typing the UPI id.

You can create a virtual Id to protect phone number