Digital Arrest Scams: How They Work and How Organisations Can Protect Their People

A digital arrest scam is an impersonation fraud in which criminals pose as police, CBI, ED, customs, narcotics or court officials, accuse the victim of a crime over a phone or video call, and then keep the victim under virtual ‘custody’ until they pay. There is no such thing as a digital arrest in Indian law. Recognising that single fact, and acting on it, is what protects people.

For organisations, the risk is not only to individual employees. A frightened employee with payment authority, access to customer data or knowledge of confidential matters is a route into the business. This guide explains how the scam works, what Indian authorities have said, and how employers can protect their people.

What is a digital arrest scam?

A digital arrest scam is a form of social engineering. The fraudster's goal is to create enough fear that the victim stops checking facts and starts following instructions. It sits alongside phishing and other impersonation frauds, but it is more intense: the victim is kept on a live call, sometimes for hours or days.

No such arrest exists in law. Arrests in India are governed by the Bharatiya Nagarik Suraksha Sanhita 2023 (BNSS), which replaced the Code of Criminal Procedure on 1 July 2024. Nothing in that procedure permits an officer to detain someone by video call, demand that they stay on camera, or require money to be moved to a ‘safe’ or ‘verification’ account.

How does the scam typically unfold?

The script varies, but most cases follow a recognisable sequence.

1. The hook. A call or message claims a parcel in the victim's name contains drugs or fake passports, or that their Aadhaar, phone number or bank account has been linked to money laundering.
2. The escalation. The call is ‘transferred’ to a senior officer. Video calls show uniforms, official-looking backdrops, ID cards and documents bearing agency logos.
3. The isolation. The victim is told the matter is confidential and that speaking to anyone will be treated as obstruction. They may be instructed to stay on camera, check into a hotel or keep the call running.
4. The demand. To ‘prove innocence’, the victim must transfer funds for ‘verification’ or pay a ‘settlement’, with a promise of refund once cleared.
5. The layering. Money moves through a chain of mule accounts within minutes, which is why early reporting matters.

The final stage connects these scams to organised money laundering. The funds rarely stay in the first account; they are split and passed on through layers of accounts, often rented or bought from account holders.

Red flags that should end the call immediately

What have Indian authorities said?

The government has run sustained public awareness campaigns on digital arrest.

• In the 115th episode of Mann Ki Baat on 27 October 2024, the Prime Minister warned citizens about digital arrest fraud and set out a three-step response: “Ruko, Socho aur Action Lo” (stop, think, act). Citizens were urged to report through the 1930 helpline.
• The Indian Cyber Crime Coordination Centre (I4C), an attached office of the Ministry of Home Affairs, issued a public advisory in October 2024 stating that CBI, police, customs, ED and judges do not arrest people over video calls, and directing victims to report on 1930 or cybercrime.gov.in.
• The Citizen Financial Cyber Fraud Reporting and Management System (CFCFRMS), launched in 2021, links the 1930 helpline with banks and payment intermediaries so that reported funds can be flagged and held.

On 22 July 2026 the Ministry of Home Affairs told the Rajya Sabha that, as of 30 June 2026, more than INR 11,158 crore had been saved across more than 32.80 lakh complaints through this mechanism. ‘Saved’ here means amounts prevented from reaching fraudsters through timely intervention; it is not the same as money recovered and returned to victims. Official figures that isolate digital arrest cases from other cyber fraud have not been published, so this post does not quote any count for them.

Why are organisations exposed?

Digital arrest is often treated as a consumer problem, but several features make it a workplace risk.

Payment authority. An employee who can release payments may be told that a company transaction is under investigation and that funds must be ‘parked’ for checking. This blends into the pattern of account takeover and business email compromise, where authority is impersonated to move money.

Confidential data. Callers may demand customer lists, board papers or employee records as ‘evidence’, turning a frightened employee into an unwitting insider threat.

Wellbeing and absence. Victims are often kept on calls for long periods, cut off from colleagues and family. Absence, distress and unusual behaviour at work may be the first visible signs.

Reputation and duty of care. Senior staff, finance teams and employees whose details are public, such as those on company websites or professional networks, are attractive targets.

How can employers protect their people?

A practical programme does not need to be elaborate. It needs to be clear, repeated and easy to act on.

Build awareness around one message

Training should centre on a single, memorable fact: no Indian authority arrests anyone over a video call, and no genuine officer asks for money to prove innocence. Reinforce the government's “Ruko, Socho aur Action Lo” message. Short examples of real scripts, uniforms and fake notices help staff recognise the pattern.

Give staff a safe escalation route

Victims often stay silent out of fear or embarrassment. Tell employees that if they receive such a call they can contact a named person in HR, security or legal at any time, without judgement and without needing to be sure it is a scam. Many organisations use their existing vigil mechanism or security helpline for this.

Harden payment controls

• Require out-of-band verification for any urgent or unusual payment request, using a known number, not one supplied by the requester.
• Keep dual authorisation for payments above a threshold and for changes to beneficiary details.
• Make it explicit in policy that no investigation, internal or external, will ever require funds to be moved at short notice.

These steps also protect against phishing and invoice-redirection frauds.

Protect data and devices

Remind staff never to install remote-access or screen-sharing apps at a caller's request, and never to share OTPs. Where an employee has done so on a work device, treat it as a security incident: isolate the device, reset credentials and preserve logs before anything is wiped.

Support victims practically

If an employee has lost money, help them report quickly on 1930 and to their bank, give them time off to deal with the police complaint, and offer counselling where available. The emotional impact of a digital arrest scam can be severe.

What should a victim do immediately?

1. End the call. Do not argue or negotiate.
2. Talk to someone you trust. Breaking isolation breaks the scam.
3. Call 1930 or report on cybercrime.gov.in as soon as possible, with transaction references, account numbers, phone numbers and screenshots.
4. Inform your bank and ask it to block further transfers and flag the beneficiary accounts.
5. Preserve evidence. Keep call logs, chat histories, screenshots of video calls and any documents sent. Do not delete the messaging app.
6. File a police complaint if advised, and keep copies of every acknowledgement.

If company funds or systems are involved, the organisation should also consider whether reporting obligations apply, for example to CERT-In for incidents such as identity theft, spoofing and phishing, and should preserve device evidence properly. Our guide to preserving digital evidence in internal investigations explains the basics, and our post on responding to business email compromise covers the first 48 hours after a payment fraud.

Where does an investigation add value?

Most digital arrest cases are handled by the police and cybercrime cells. A private investigation becomes relevant where company money, data or employees are involved and the organisation needs its own facts: how the payment was approved, whether internal controls were bypassed, what data left the business and whether any insider assisted the fraudsters. Decisions on reporting, recovery and employee action should be taken with specific legal advice.

How Spectra Forensics can help

Spectra Forensics has 19+ years of investigative experience and more than 1,250 investigations behind it. Where a digital arrest or impersonation scam affects an organisation, our digital forensics and eDiscovery service covers forensically sound collection and analysis of devices, messages and logs, and our fraud and whistleblower investigations for corporates cover how a payment or data loss occurred and whether controls failed. To discuss a concern in confidence, contact us.