The library.

Where it shows up

• APK file shared on WhatsApp or Telegram by a 'friend of a friend'.
• Site that looks like a real broker's, with a name one letter off.
• App downloaded from a link in a YouTube ad or Instagram DM.

The playbook

1. You see returns of 5–15% a month on a slick dashboard.
2. Small deposits 'work' — you can withdraw a little, which builds trust.
3. You deposit more. The dashboard keeps going up.
4. At withdrawal, the app demands a 'tax', 'compliance fee', or 'upgrade charge'.
5. Each fee is the last one. None of them are. Eventually the app or 'support' disappears.

Red flags

• Not listed on Google Play / Apple App Store — installed via APK or sideload.
• Promised returns are absurd compared to a fixed deposit or index fund.
• Withdrawals work in small amounts but break above a threshold.
• Support is over WhatsApp, Telegram or a chat widget — never a phone number.
• Brand mimics a known broker (Zerodha, Groww, ICICI Direct) with a near-identical name or logo.

How to verify

• Search the app name on SEBI's intermediary list at sebi.gov.in.
• Check the broker is listed on NSE/BSE member directories.
• Search '<app name> scam' or '<app name> reddit' — these surface quickly.
• If the app is missing from official stores, that alone is enough to walk away.

Where it shows up

• Instagram or YouTube reels of Nirmala Sitharaman, Mukesh Ambani, Ratan Tata, Anand Mahindra, Virat Kohli endorsing an app.
• Facebook ads with a 'news anchor' breaking the story of a new state-backed scheme.
• Cloned audio of a CEO in a 'leaked' phone call about a hot stock.

The playbook

1. Hook video offers a free WhatsApp/Telegram group or app download.
2. Inside, a 'mentor' shares 'inside calls' that always succeed (because they're fabricated).
3. You're invited to invest through a private platform — never a regulated exchange.

Red flags

• Lip-sync that is almost right but drifts on certain consonants.
• Backgrounds, lighting, or graphics that look generic or are reused across videos.
• A public figure 'personally' endorses a private trading app.
• The video routes you to a Telegram group or sideloaded app.

How to verify

• Search the public figure's official social handles for the same announcement. It won't be there.
• Run the video URL through Google reverse image search.
• Cross-check the 'news' on the source publication's actual website.

Where it shows up

• Cold call or WhatsApp message from a 'broker' offering Tata Capital, NSE, OYO, Reliance Jio pre-IPO shares.
• Telegram group 'leaking' the grey-market premium and offering allotment.

The playbook

1. You're told to transfer money to a 'pool account' to secure an allotment.
2. Once paid, the broker introduces a 'lock-in', then a tax, then disappears.

Red flags

• Anyone claiming to guarantee an IPO allotment. Allotment is by random lottery for retail.
• Pre-IPO 'unlisted' deals routed through personal UPIs or non-DP bank transfers.
• Urgency: 'only 24 hours left', 'shares closing today'.

How to verify

• IPO allotment is via your demat account through a registered broker. No exceptions.
• Unlisted share dealing happens through SEBI-registered brokers with a contract note.
• Check the company's investor relations page for any actual share-sale process.

Where it shows up

• Unsolicited add into a Telegram or WhatsApp group with names like 'Bull Run 🚀 VIP'.
• Instagram ad selling a paid stock tips channel with screenshots of profits.
• DMs from 'Dr Anjali Sharma — SEBI registered research analyst'.

The playbook

1. The group runs a pump-and-dump on a small-cap stock — calls to buy at the bottom, then sells while you hold.
2. Or: a paid 'premium tier' with a recommended broker (their fake app).

Red flags

• Guaranteed accuracy, screenshot-only proof of returns.
• Recommendation to use a specific broker app you've never heard of.
• Calls in stocks with very low daily volume.
• SEBI Research Analyst (RA) registration number is missing, expired, or doesn't match the name.

How to verify

• Look up the RA on the SEBI website's intermediary search. Number, name, validity must all match.
• Avoid acting on tips for low-volume stocks — that's the favourite playground for this.
• A real RA does not need to add you to a free group at midnight.

Where it shows up

• Telegram message from someone you barely know, sharing 'their' app.
• Office colleague who's 'doubled their money' and wants you in too.
• Local agent in a small town with a printed brochure.

The playbook

1. Deposit USDT into a wallet inside the app.
2. Earn daily 'rewards' that compound — on paper.
3. Withdraw early to build trust, then deposit much more.
4. App imposes a 'KYC fee', 'tax', or 'maintenance charge' before unlocking.
5. Eventually withdrawals freeze; the project 'pauses for an audit'.

Red flags

• Daily fixed returns of any kind. Real markets do not work that way.
• Your USDT goes to a wallet you don't control.
• Referral commission on bringing new people in.
• Whitepaper is generic, team page uses stock photos.

How to verify

• Trace the receiving wallet on a chain explorer. Pooled inflows to a single wallet are a signature pattern.
• Reverse image search the founders' photos.
• A real exchange or DeFi protocol does not pay you to recruit friends.

Where it shows up

• Match on Bumble, Hinge, Tinder, or 'wrong number' texts that turn into long conversations.
• Instagram DMs from an attractive stranger who is unusually warm.
• A new 'friend' through a mutual on LinkedIn — invariably in finance.

The playbook

1. Weeks of relationship-building. No pressure. No money talk.
2. Their 'uncle' or 'aunt' is a hedge fund manager / mentor. They learn from them.
3. They share an app or website. They invest with you. You both win at first.
4. You scale up. Withdrawals freeze. They are also 'shocked'. The platform demands fees.

Red flags

• The relationship is moving fast emotionally but they refuse video calls or in-person meets.
• Their photos and stories are too consistent — too curated.
• An 'investment opportunity' arrives via an app or site you've never heard of.
• Your partner gets defensive or hurt if you question the platform.

How to verify

• Reverse image search every photo they've sent.
• Insist on a live video call before any money decisions.
• Show the platform to a third party — a friend in finance, the AI on this site, anyone.
• If you can't withdraw a small test amount cleanly, walk away from everything else.

Where it shows up

• Random WhatsApp call from an unknown number, video on by default.
• Match on a chat app that escalates to a 'private' video call within hours.

The playbook

1. A few seconds of explicit video is enough.
2. Later, you get a 'CBI officer', a 'cyber crime' inspector, or the woman herself demanding money to delete the video.
3. Sometimes the threat is a 'YouTube upload' or a message to your contacts.

Red flags

• Stranger video call with someone undressed on the other side, almost immediately.
• Follow-up demands paid via UPI, Paytm, or USDT.
• Caller ID changes between calls — same threat, new persona.

How to verify

• There is no policeman who calls you over WhatsApp and demands UPI payment. None.
• Block, do not pay, and report at cybercrime.gov.in or call 1930.
• Tell one person you trust. The shame is the lever — remove it and the threat collapses.

Where it shows up

• Automated call: 'Your SIM card will be deactivated in two hours…'
• Caller in police uniform on a video call, 'live' from a 'CBI office'.
• FedEx / DHL voice: 'A parcel in your name was intercepted with drugs/passports.'

The playbook

1. Caller routes you through a 'senior officer' to add credibility.
2. You are told not to disconnect the call or tell anyone — it would be 'obstruction of justice'.
3. You are walked through transferring money to a 'safe RBI account' for 'verification'.
4. The money is gone within minutes via mule accounts.

Red flags

• Anyone asking you to stay on a call and not tell family.
• An 'RBI account', 'safe escrow', or 'temporary custody' for your money. These do not exist.
• A police video call. Indian police do not investigate over Zoom.
• Threats of immediate arrest unless you transfer money in the next 30 minutes.

How to verify

• Hang up. Call 1930 (cybercrime helpline) or 112 from a different phone.
• Indian law enforcement serves notice in person or by post. Not by video call.
• RBI does not maintain accounts for citizens. There is no 'RBI safe account'.

Where it shows up

• SMS from a number resembling the bank's: 'Dear customer, your KYC will expire today…'
• Caller claiming to be from your bank, credit card, electricity provider, or telecom operator.
• Email with a one-click 'KYC verification' link.

The playbook

1. You install AnyDesk, TeamViewer, or Quick Support and share the code.
2. Caller now sees your screen — including OTPs.
3. Small 'test transaction' confirms the bank details, then they drain the account.

Red flags

• Anyone asking you to install AnyDesk / Quick Support / TeamViewer.
• OTP requested for 'verification' — your bank will never ask.
• Urgent KYC deadline that has to be done right now.

How to verify

• Banks never ask you to install screen-sharing apps. Ever.
• Call the number on the back of your card, not the one that called you.
• If you've shared an OTP, call the bank's fraud line immediately.

Where it shows up

• Marketplace buyer who 'sends a refund' that's actually a request to pay.
• Stranger on UPI claiming they paid you by mistake.
• Lottery / cashback notification asking you to approve receipt.

The playbook

1. A UPI collect request lands in your app. The narration looks reassuring.
2. You enter your PIN to 'receive', but UPI PIN is only ever used to send.
3. Money leaves your account.

Red flags

• UPI PIN being asked to receive money. It is not required to receive — ever.
• Pressure to act fast before the 'refund expires'.

How to verify

• UPI PIN = sending money. No exceptions.
• Decline any collect request you didn't initiate. Block and move on.

Where it shows up

• Stranger who 'helped someone like you recover ₹14 lakh from the same app'.
• Self-styled 'crypto recovery expert' active on LinkedIn or Reddit replies.
• 'CBI officer' or 'cyber lawyer' offering to retrieve your money for a retainer.

The playbook

1. Pay a retainer, court fee, or 'crypto unfreeze' charge upfront.
2. Once paid, demands escalate: tax, conversion fee, judge bribe.
3. Original loss is doubled before the victim accepts the second loss.

Red flags

• Anyone reaching out to you offering to recover funds. Recovery doesn't happen via cold DM.
• Upfront fees of any kind for recovery.
• Promises with timelines — 'we'll have it back in 72 hours'.

How to verify

• Real recovery is via cybercrime.gov.in or 1930, and it is slow, uncertain, and free.
• There is no 'crypto reversal' technology. Blockchain transactions are final.

Where it shows up

• App store listings for 'instant ₹10,000 in 5 minutes'.
• Telegram or SMS push: 'No paperwork, just KYC'.

The playbook

1. App grants a small loan after sweeping your contacts, photos, and SMS.
2. Repayment window is 7 days. Interest rates are extortionate.
3. On delay, recovery agents call your boss, your family, and morphed photos circulate.

Red flags

• App asks for full contacts, photos, and SMS access before disbursement.
• Lender is not in the RBI list of NBFCs or banks.
• Loan terms aren't disclosed before you click 'apply'.
• Repayment via personal UPI handles instead of the lender's account.

How to verify

• Check the lender on RBI's regulated entities list.
• Reject any app that demands contacts / photos before disbursing.
• If harassed: file at cybercrime.gov.in. Document everything. Don't pay 'settlement fees' to recovery agents.

Where it shows up

• WhatsApp / Telegram offer of ₹3,000–10,000 a day for liking videos or rating products.
• Posing as a recruiter from a 'digital marketing agency' or 'overseas brand'.

The playbook

1. Small payouts for the first few tasks build trust.
2. A 'prepaid' or 'combo' task is introduced — you 'invest' ₹2,000 to earn ₹2,800.
3. Tasks grow. You're told you must complete the set or lose everything.
4. You deposit more chasing the original promise. The platform locks at withdrawal.

Red flags

• Any 'job' that requires you to deposit money to earn more.
• Onboarding entirely over WhatsApp / Telegram, no real company website.
• Payouts via personal UPIs, never a payroll system.

How to verify

• Real part-time work pays you. It does not ask you to pay first.
• If a 'deposit task' shows up, the prior payouts were bait. Stop and walk away.