Skip to main content
zeroShadow

Scams

zeroShadow Tracks Over $100M Lost to Fake Security and Digital Arrest Scams

Jun 8, 2026 | 10 min read

Many security scammers will impersonate a bank or crypto exchange support agent, but there is a rise in scammers claiming to be a law enforcement representative. Victims are coerced into isolating themselves, remaining on continuous video calls for hours, days or weeks. During this time, they ultimately transfer their life savings through bank wires and cryptocurrency transactions under the belief that they are part of an ongoing, legitimate, government investigation.

police impersonator with his eyes covered and $100M stolen

While the examples discussed throughout this article are based on a rapidly growing scam trend affecting the Indian diaspora, the warning signs, social engineering techniques, and prevention measures are relevant to anyone who may be contacted by someone claiming to represent a government authority or financial institution.

For many people, a phone call from someone claiming to represent law enforcement or a government official immediately commands attention. The scammers know this–and are exploiting that trust. zeroShadow has tracked over 60 cases totaling losses of more than $100M USD where a scammer captured the attention of their target by claiming to help with a security incident. Many of these scammers will impersonate a bank or crypto exchange support agent, but there is a rise in scammers claiming to be a law enforcement representative.

These schemes can become especially psychologically manipulative, and financially devastating in what is known as a “digital arrest” or “virtual house arrest” scam. Victims are coerced into isolating themselves, remaining on continuous video calls for hours, days or weeks. During this time, they ultimately transfer their life savings through bank wires and cryptocurrency transactions under the belief that they are part of an ongoing, legitimate, government investigation.

In many of these cases, the scammers are impersonating:

Their goal is simple: create panic, establish authority, isolate the victim, and extract money before the victim seeks outside guidance or becomes aware of what has taken place.

How the scam begins

We have identified multiple cases where the victims of these digital arrest scams are targeting Indians living abroad, particularly in the United States, Canada, and other English speaking countries. Many victims have reported having received one of the following:

police impersonator
A scammer impersonates the Delhi Police.

In one recent case, an Indian national living outside of India was convinced that they were the subject of a criminal investigation involving money laundering. Over the course of several days, the victim remained isolated inside their home while continuously connected to the scammers through video calls, believing they were under official surveillance and prohibited from speaking with family members, friends, or legal counsel.

These scammers are spoofing legitimate Indian phone numbers, including numbers appearing to belong to government agencies, while using fabricated documents bearing official-looking seals and insignia.

They often conduct video calls while dressed in police uniforms or seated in rooms staged to resemble government offices, police stations, or investigative command centers.

The combination of apparent authority, realistic documentation, and constant monitoring creates a convincing illusion that the victim is participating in a legitimate government investigation.

Victims are then told they are under “digital surveillance”. They are not allowed to disconnect the call and cannot speak to family members or lawyers.

No outside communication. They are told that their phone and accounts are being monitored and that they must cooperate to “clear” their name. This is where the “virtual house arrest” begins.

Victims remain on video calls for hours–sometimes days–under constant psychological pressure. Fraudsters instruct them to stay inside their homes or disconnect from society and stay at a hotel. This is in hopes that the victims avoid contact with the outside to follow the scammers’ strict instructions while “the investigation” proceeds.

Taking the Money

Once the scammers have instilled fear and compliance, the scammers are ready to move to the financial extraction stage. This is where victims are instructed to:

In order to execute the financial extraction stage, the scammers will justify these transfers as:

In actuality, once the funds are transferred, the victims’ funds are rapidly being laundered.

Where Crypto Comes Into Play

Cryptocurrency has become increasingly attractive to transnational scam networks because it allows funds to move quickly across borders with varying degrees of anonymity.

Investigations commonly reveal:

By the time victims realize that “the investigation” was fake, the funds have likely been fragmented and laundered.

It is important to note that blockchain transactions are not invisible. On-chain tracing can still provide valuable investigative leads, assist with identifying laundering patterns, and occasionally support freezes or law enforcement action when reported in a timely manner.

Case Study

In October 2025, a victim contacted zeroShadow regarding their $1.6M USD theft that was in result of a digital arrest scam. To protect the victim’s identity, we will refer to him as “Amit”.

In September 2025, Amit had been called numerous times by individuals impersonating the Consulate General of India - San Francisco. These individuals told Amit that a SIM card had been registered in his name in New Delhi and that crimes had been linked to the registered SIM card. The law enforcement impersonators were contacting Amit to let him know that an First Information Report (FIR) had been registered in his name and that he was part of an ongoing investigation.

Amit was then transferred to the “Delhi Police” then to a WhatsApp call where they were connected with an individual using the alias of PS Ritesh, dressed in a Delhi Police uniform.

PS Ritesh claimed that they had an arrest warrant against Amit for “laundering money through crypto using an SBI account”. They then accused Amit of being connected to the Mayank Dang gang and to sanctioned cryptocurrency exchange, Garantex. They told Amit that the Federal Bureau of Investigation (FBI) was preparing to arrest Amit.

The words, the documents, the man dressed in an Indian police uniform, instilled extreme fear in Amit. He was told to isolate himself from everyone, including his family, to not inform anyone about his whereabouts, and to cooperate or else face arrest and deportation.

Amit spent approximately 12 days under digital arrest and surveillance, during this period, he:

Amit provided this information as he was under extreme fear as he was “under investigation”. During this time, he was repeatedly threatened with arrest and that they would not hesitate to harm his family. The scammers also claimed that the U.S. Secret Service had Amit under surveillance and were monitoring his emails, calls, and every action through his camera.

The scammers claimed that only the CBI Chief could provide and authorize a “priority clearance” but demanded that Amit liquidate all his retirement funds for “RBI verification”. Under duress, Amit liquidated approximately $2M USD from his retirement accounts with penalties, resulting in $1.6M USD after taxes.

They then told Amit that the “bank employees” were part of the laundering ring and when transferring funds to a cryptocurrency exchange, if he were to be questioned by the banks or cryptocurrency exchange, he would need to lie to the fraud departments.

The scammers proceeded to reiterate that if Amit did not comply, it would result in the arrest of his family.

Once funds were deposited into Amit’s cryptocurrency exchange accounts, he was instructed to send the funds to a “RBI wallet” for verification.

forged government document
A forged Reserve Bank of India (RBI) government document instructing the victim to transfer funds to a cryptocurrency wallet address. Note: This is not an official government document, this is a forged document.

After transferring over $1.6M USD, the scammers told Amit that it would take approximately one week to “verify” the transactions. On October 3, 2025, Amit was told that the 24/7 surveillance was complete, but that Amit would still need to provide periodic updates on his whereabouts.

The next day, Amit decided to call the “Consulate General of India - San Francisco” using the original phone numbers that contacted him. The phone numbers had been disconnected. Amit then researched and called the real Consulate, on their emergency line and was informed that he had been scammed.

In reference to Amit’s cryptocurrency theft, his funds had been sent from two cryptocurrency exchanges and were sent to Ethereum wallet address: 0x696b4cB1B9d731c617e0339a9e598F7BcD89FB03

The scammer then split the funds and consolidated the stolen funds at Ethereum wallet address: 0xa3b054E1a4Ef2B5a012BF5Ab5b537d5dA61FF863 which has been reported as being associated with a scam.

The victim’s stolen funds were then bridged from the Ethereum to Tron blockchain and immediately deposited into HuionePay, also known as Huione Guarantee.

HuionePay is a Cambodian entity that has been sanctioned by FinCEN due to its facilitation and laundering of illicit proceeds ranging from pig-butchering scams to North Korean state-sponsored thefts .

Below is a visualization of Amit’s stolen funds:

visual movement of funds

Why These Scams Are Effective

These scams succeed because they exploit a powerful combination of:

Scammers are weaponizing these fears when targeting their victims.

The victims are often intelligent, educated, and financially sophisticated individuals. These schemes are not successful because the victims are careless, rather, they succeed because the scammers use advanced social engineering (psychological) tactics designed to override normal decision making under stress.

Red Flags of a Digital Arrest Scam

red flag

Common warning sides include:

Legitimate government agencies do not conduct investigations this way. Globally, law enforcement and government representatives do not require individuals to remain on video calls, purchase or transfer cryptocurrency, or wire funds to prove innocence.

What Victims Should Do Immediately

If someone believes they are being targeted, they should:

  1. End the call immediately.
  2. Contact trusted family members or friends.
  3. Independently verify any claims using official government contact information.
    1. Example: End the phone call, research or lookup the Consulate website, and call the phone number provided.
  4. Notify banks and cryptocurrency exchanges as quickly as possible.
  5. Collect evidence including:
    1. Phone numbers
    2. Wallet addresses and transactions hashes
    3. Emails
    4. Screenshots, Photos
    5. Recorded calls
  6. Report the incident to local law enforcement and relevant cybercrime authorities. If you’re based in the United States, please submit an IC3 complaint at ic3.gov
  7. Seek professional blockchain tracing or incident response support if cryptocurrency was transferred.

Time is of the essence. In some cases, the sooner you report your theft, the higher likelihood there is of preventing the further laundering of your stolen assets.

Digital arrest scams are an evolution in false security social engineering tactics. They are highly organized, emotionally manipulative, technologically enabled, and financially motivated.

As the scammers continue to refine their tactics, public awareness remains one of the strongest defenses.

No legitimate government investigation requires you to isolate yourself, remain under video surveillance, or transfer your money to prove your innocence.

Fear is the weapon. Urgency is the tactic. Isolation is the control mechanism.

Breaking that cycle quickly can prevent devastating losses.

Need Help or Want to Report a Case?

If you or someone you know has been targeted by a “digital arrest,” virtual house arrest, or government impersonation scam involving bank wires or cryptocurrency transfers, it is important to act quickly.

Victims should immediately:

zeroShadow provides blockchain intelligence, incident response, and cryptocurrency tracing support for victims, organizations, exchanges, and law enforcement agencies globally. The team assists with identifying laundering patterns, tracing stolen funds across blockchains, coordinating with service providers, and supporting law enforcement investigations. Contact us here .

Original article by the zeroShadow team.

Share this post