New Delhi: In November 2022, California resident Michele Finch got a call that her bank accounts were being targeted by Russian and Chinese hackers. She was advised to transfer all her money to an account “managed by the Federal Reserve”.
Finch transferred USD 6.5 million (nearly Rs 54 crore) in 31 tranches between November 2022 and April 2023 to bank accounts she believed were managed by the Federal Reserve, America’s central bank.
None of that money reached the Federal Reserve-managed accounts, and Finch is yet to get any of it back.
Instead, they landed in Hong Kong-based bank accounts controlled by a group of businessmen allegedly running a fake call centre from Gurugram and Noida that duped foreign nationals.
Finch approached the US authorities, prompting the Federal Bureau of Investigation (FBI) to launch an investigation. The FBI found that it all started with a Voice over Internet Protocol (VoIP) call from an impersonator called ‘Eric Wolf’, who allegedly approached Finch claiming to be a Microsoft executive, and told her he would guide her in safeguarding her bank accounts against hackers.
As it turned out, ‘Eric Wolf’ was not acting alone. He was a part of a group of impersonators who allegedly took control of her computer and convinced her to transfer the funds.
The FBI located some of the Internet Protocol (IP) addresses used to install malware on her computer and make VoIP calls, and shared them with India’s Central Bureau of Investigation (CBI). An IP address is an identifier for every device connected to the internet. Each IP address is unique.
Working on the inputs, the CBI in July 2024 busted the call centre allegedly involved in the ‘scam’ and arrested 44 people. The Enforcement Directorate (ED) then came in to probe the money trail.
The ED has now uncovered the scale and modus operandi of the racket, which involved duping US citizens, moving funds to overseas accounts they controlled, and routing the proceeds back to Indian bank accounts.
The call centre was allegedly being operated by a firm incorporated in the name of Chandra Prakash Gupta. The ED arrested him in December 2025.
However, a trio of Abhinav Kalra, Arjun Gulati and Divyansh Goel has been identified by both agencies as the masterminds behind the plot. However, the agency has not made them accused in the money laundering case so far.
A Special Court in Gurugram had last year issued non-bailable warrants against the three for failing to appear before the ED in this case, while Gupta, who allegedly received Rs 3.17 crore from the proceeds of crime, remains in judicial custody.
The group allegedly defrauded foreign citizens to the tune of Rs 268 crore using the modus operandi, with Kalra, Goel and Gulati receiving a total of nearly Rs 124 crore from the proceeds of crime, according to the ED investigation.
“As per the FIR, the accused persons, have, pursuant to the said scheduled offence, cheated and defrauded foreign nationals, primarily citizens of the United States of America to the tune of approximately USD 15 million,” the agency alleged in the prosecution complaint, the equivalent of a charge sheet.
“However, consequent to investigation conducted under PMLA, 2002 so far by this Directorate, it is revealed that a number of preparators were involved in the tech support scam, who defrauded an amount of Rs 268.83 crore,” the agency further alleged.
IP address to nail syndicate
Tipped off by the FBI, the CBI raided the premises in Gurugram’s Cyber City in July 2024. It recovered 131 hard drives and six laptops, allegedly containing incriminating material related to the call centre.
Based on the CBI’s proceedings in the case, the ED filed an Enforcement Case Information Report and began examining the ownership records of the firms running the call centre.
In continuation of the CBI’s probe, the ED found that the set of accused was running a call centre in the name of a different firm in Uttar Pradesh’s Noida. The call centre was operated by CSPRO Technology OPC, which Gupta incorporated in 2020. Later, the Noida call centre closed in October 2023.
But it didn’t end there. The activities were allegedly shifted to a new call centre in Gurugram, operating under the name Innonet Technology OPC Pvt. Ltd, incorporated as a one-person entity in the name of Gupta in July 2023.
The ED earlier last month charged Gupta, his firm CSPRO Technology (OPC) Pvt. Ltd and Chartered Accountant Aakash Kumar Dubey under provisions of the Prevention of Money Laundering Act, 2002.
The FBI shared with Indian agencies details of the forensic examination of Finch’s computer, primarily the installation of malware by two user names—Max Rogers & Eric Wolf—who had gained unauthorised access to her computer after installing remote desktop applications.
The FBI traced the malware installation and its presence on the computer between November 2022 and April 2023 to a single IP address, 180.151.233.18. They also had a list of other suspect IP addresses with roots in India.
As part of the probe, the ED verified the KYC and details of the Internet Protocol Detail Records (IPDR) and traced the Internet Service Provider (ISP).
In response, the agency submitted that a statement of an AGM of Shaym Spectra was recorded, who revealed that the said IP address was statically allocated to M/s CSPRO Technology (OPC) Pvt. Ltd. Additionally, they Internet service provider also provided information to the agency that the connection was installed on the basis of the driving license of Gupta.
Additionally, the agency submitted before the court statements from several call centre employees, who explained the entire process of duping foreign nationals.
US to Delhi-NCR via Hong Kong
The ED submitted that the FBI provided details of the funds transferred by Finch to the alleged group of fraudsters.
According to the information shared with Indian agencies, Finch’s USD 6.5 million landed in accounts at Hang Seng Bank Limited and Hong Kong and Shanghai Banking Corporation.
The ED has alleged that these funds were converted into cryptocurrencies as well as cash before all of it was recouped in India in the form of cash. The agency has identified two Chartered Accountants (CAs) who assisted the syndicate in integrating the proceeds of crime.
As part of the conspiracy and money laundering alleged by the ED, the masterminds of the “tech support scam” sought the help of these two CAs and incorporated as many as 33 shell companies.
These companies, the agency alleged, were used for accommodation entries against cash to the mastermind of the syndicate. Based on the CAs’ statements and an analysis of these firms’ books of accounts, the agency alleges that the CAs worked at the commission, up to 5.5 per cent of the total value of transactions.
The masterminds of the plot, the agency further alleged, used these funds from duping foreign nationals in the acquisition of lavish properties such as houses, penthouses and cars
“They have also acquired 12 high-end cars, luxury watches, jewellery and other valuable assets from the Proceeds of Crime. The investigation revealed that the accused persons were leading an extravagant lifestyle, (undertaking) numerous foreign tours, (and using) a chartered plane, etc.,” the agency alleged in the prosecution complaint.
(Edited by Ajeet Tiwari)
Also Read: How West Delhi brothers duped 20,000 Americans in $10m scam. US-based aunt & Russian software helped