Ahmedabad Cyber Police bust ‘Boss Scam’ ring, exposing 4,500 SIM cards and 21,000 OTPs
One WhatsApp “Boss Scam” involving `1.5 crore in Ahmedabad led Gujarat Police to discover a large international cybercrime network operating in India, China, Pakistan and Hong Kong. As a result, the officers arrested two of the main suppliers from West Bengal, seized almost 4,500 dummy SIM cards, traced the sale of more than 21,000 OTPs, and obtained over 10,000 infected devices throughout the country.
The case started in June when an employee was tricked into transferring `1.5 crore after scammers impersonated a senior company executive, or “boss.” The scammers used malicious ZIP files and malware sent through WhatsApp or email to take over the executive’s digital identity, change contact numbers, and request urgent money transfers. The Ahmedabad Cyber Crime Branch recovered `1.3 crore and returned it to the victim before continuing the investigation.
Investigators traced the scam to Imran Ali Piyada from North/South 24 Parganas and Injammul (Injamul Mujibar) Molla from Kolkata, both BA graduates. They were brought to Gujarat on transit warrants. Imran, who worked as a point-of-sale agent for telecom companies such as Airtel, Jio, Vi, and BSNL, is accused of misusing customers’ biometric data to obtain SIMs in their real names and then activating dummy numbers without their knowledge. He provided these numbers and the OTPs needed to activate WhatsApp accounts to cybercriminals.
Over about five years, police say Piyada sold around 21,000 OTPs for e-commerce platforms like Amazon and Flipkart, as well as online gaming apps, earning more than `21 lakh at about `100 each. He also sold about 900 WhatsApp activation OTPs for around `250 each, making another `2.25 lakh. Injammul managed the supply of mobile numbers, dummy SIMs, and WhatsApp accounts. They used devices capable of handling four SIM cards at once and ran WhatsApp groups that openly offered these services. This setup was a clear example of “Cybercrime as a Service.” They used Telegram before switching to WhatsApp to avoid detection.
Analysis of the 4,500 SIM cards linked the operation to 251 complaints on the National Cybercrime Reporting Portal from 26 states. These included 194 cases of online financial fraud and at least three Boss Scam complaints. Soon after, investigators found international links. They discovered Chinese-developed malware running on systems in Hong Kong and traced a related call centre to Islamabad. Bank accounts used in the fraud were accessed through China-based VPNs. The money was reportedly moved through several countries and converted into cryptocurrency to hide its origin. Ahmedabad Police Commissioner Anupam Singh Gehlot said the group gave important local telecom and OTP support to operators in Pakistan and China.
“This group was essentially providing service, offering infrastructure to Pakistan and China to facilitate cyberattacks,” Gehlot said. “They procured SIM cards and provided them to people sitting in other countries. They used Chinese malware and linked these to call centres operated from Islamabad.” More than 10,000 devices, including mobiles, laptops, and desktops connected to the network, have been secured or deactivated, which may have prevented losses of crores of rupees.
The investigation, backed by the Indian Cyber Crime Coordination Centre (I4C), has found that local partners are helping with international fraud schemes. More arrests and inquiries are still happening.
People and companies have been advised to be on the lookout for unexpected files, WhatsApp messages coming from ‘bosses’, or urgent requests for money transfers. Authorities advise that people verify such requests with reliable contacts and report any suspicious activity to the cybercrime helplines. This instance of corporate fraud has revealed a professional criminal network that rented out Indian SIM cards, OTPs, and malware, viewing them as ordinary services.
