To chase a crooked shadow

Personal data breaches, thanks to compromised online security protocols, are leading to a spike in identity thefts in India’s consumer economy. What does it mean to be impersonated by a cybercriminal?

In the first week of April, Delhi-based Rishi Kapoor approached Electronica Finance Ltd, a non-bank finance company, to jointly avail a commercial loan for expanding the family business headed by his father. During routine queries, the loan officer, after reviewing his credit history, informed him that there were outstanding loans in his name. Kapoor presumed the reference was to the loan he had taken out previously to purchase a car and replied it had been repaid. The matter rested there as both sides said they would revert. Two weeks later, India was in the throes of a ferocious second wave of Covid; Delhi, along with most of India, went into lockdown. The Kapoors decided to drop their business expansion plan — and, by extension, the loan proposal.

However, the loan officer’s claim of outstanding dues against his name continued to bother Kapoor.

A month later, he casually mentioned this to a friend, who, in turn, cautioned Kapoor he may have been a victim of identity theft — among the fastest-growing cybercrimes in India, and across the world.

Kapoor, like most victims, was initially pretty sure this could not happen to him as he was always careful about his online transactions. But then fear got the better of him and, in early June, he checked his credit scores tracked by Transunion Cibil, the credit information company.

Imagine his shock when he found he had not one, but three outstanding loans: two loans from Bajaj Finance to purchase consumer goods and one from HDFC Ltd for purchase of a used car. Together, they added up to Rs389,588 (approx. Dh19,000), a tidy sum for the 36-year old salaried professional. “I alerted HDFC and Bajaj Finance and copied the Reserve Bank of India [on the complaint] on 4 June,” Kapoor says. While Bajaj Finance is yet to respond, HDFC got back claiming it was an internal error of the bank which led to the linking of Kapoor’s account with someone who had “similar demographic details”. A new update provided by Cibil shows that the HDFC loan is no longer an outstanding against Kapoor, who is still unsure whether or not he will file a police case.

The good news, he points out, is there is no forensic record of this money either being received by him or paid by him as EMI (equal monthly instalments) repayments. Further, neither lender had approached him for defaulting on the EMI payments from March: whoever had taken out the loan in his name was paying the EMIs.

But the bad news is that Kapoor’s online identity may have been compromised. In other words, his personal specs, including his unique Income Tax Permanent Account Number (PAN), is out on the dark web. He remains vulnerable to fresh hacks.

Kapoor’s is not an isolated case. Data suggests that there has been a spike in the last one year as most people were forced to work from home (WFH) with domestic Internet access unable to ensure required security protocols. The fear is that, if left unchecked, these rapidly growing cybercrimes — largely homegrown at the moment — have the potential to undermine India’s rapidly growing online commerce space. While the big headlines are being grabbed by Amazon and Flipkart, the social commerce sector, led by the likes of Meesho, is now taking business beyond the metros to smaller towns and villages too.

Whack a mole

Norton Cyber Safety Insights, a cybersecurity firm, in its 2021 report released in April found that 120 million Indian consumers were victims of some kind of cybercrime in the last 12 months, when most people were confined to their homes and transacted online. Of this, a record 27 million adults, like Kapoor, were victims of first-time identity theft. “In a year of lockdowns and restrictions, cybercriminals have not been deterred,” says Ritesh Chopra, Director Sales and Field Marketing, India & SAARC Countries, NortonLifeLock. “More Indian adults fell victim to identity theft in the past 12 months and most are concerned about data privacy.” The survey reports identity theft was the “stand out trend” last year. The growth in the number of people reporting an identity theft for the first time was 14 per cent in 2020 compared to 10 per cent in 2019. “And almost one in two people were actual victims of ID theft,” he adds.

What is true for individuals is worse for companies. According to the Experian’s Global Insights Report (January/February 2021) released recently, 46 per cent businesses in India witnessed an increase in fraud in the last one year.

One reason for this surge in Internet users in India is the low tariffs on data — a trend that got a big fillip after Jio launched its services, forcing other telcos to match their low tariffs. According to the ‘ICUBE 2020’ report compiled by The Internet and Mobile Association of India (IAMAI) and Kantar, the global data, insights and consulting company, India reported 622 million Active Internet Users (AIU) in 2020; it was 384 million in 2017. This is projected to grow to 900 million by 2025, by which time Internet users in rural India will outnumber their urban counterparts.

The data also reveals that, in urban India, Internet users are evenly divided. The cluster of top nine metros account for 33 per cent, while small towns account for 40 per cent. The same study indicates that nearly one in two AIUs have engaged in some kind of online e-commerce: shopping, banking, booking train or plane tickets etc. This usage pattern has only accelerated in the post-Covid era when people have been forced to stay indoors. “There has been an accelerated digital adoption, especially after the adoption of #WFH. We are ordering online groceries, medicine, classes… Entertainment consumption has shifted online too,” says Chopra.

With so much personal information out there, cyber criminals are acquiring the edge which makes it easier for them to evade scrutiny of security protocols and rewrite existing white collar crime modus operandi. As Sanjay Bahl, Director General, Indian Computer Emergency Response Team (CERT-in), the nodal government agency in India dealing with cyber security threats, explains: “Everything is evolving, including crime. Earlier identity theft was restricted to stealing credit card details and hacking passwords. Today, personal data is shared on so many platforms (social media, hotels, hospitals and restaurants etc): if any of these platforms is hacked, your personal data is compromised.”

WFH has meant that security protocols of companies have been diluted with employees accessing the Internet on their home WiFi, which are, at times, unsecured or protected by a weak password. “While Internet access is growing, the vulnerability of users is growing proportionately since the attack surface is increasing,” Bahl points out.

Brijesh Singh, Inspector General of Maharashtra, who was earlier headed the anti-cybercrime cell for the state, says cybercrimes are assuming a financial form: “Mass cyber-attacks are happening primarily because of data breaches. A data breach is not as simple as it looks. It utilises the personal information so gained to stage further attacks.”

The last one year has seen a big spurt in data breaches across the world. CERT-in recently informed the Indian Parliament that over 26,100 websites were hacked during 2020 compared to 17,560 two years ago. The recent high-profile breaches include Air India (which compromised the details of 4.5 million passengers) and Domino’s India (details of 180 million orders were stolen).

(Anil is a journalist based in New Delhi, India. He tweets @capitalcalculus)