Pop-Up to Pay Out: Inside the $144K Scam That Crossed Borders

Time of India

30-05-2025

New Delhi: It was a typical day for 57-year-old Japanese national Sakai Takaharu, casually browsing the internet on his computer, when a pop-up appeared on his screen, setting off a chain of events that would lead him down a harrowing journey of deception and financial loss.
The alert message was alarming, claiming his system was infected with a virus and instructing him to call a specified phone number.
With a sense of urgency, Sakai dialled the number, unwittingly stepping into a sophisticated tech support scam that would ultimately drain his bank account of two crore yen ($144,130 USD). The scammers, posing as Microsoft representatives, convinced Sakai to install remote-control software, giving them access to his computer and sensitive financial information.
They then instructed him to transfer his bank account balance to a new account, supposedly to secure his funds.
Sakai, unaware of the scam, complied, and the scammers disappeared with his money.
Takaharu, a resident of Hyogo prefecture in Japan, was not alone. There were multiple victims of this scam. Soon, Koji Suzuki, Masashi Matsui and Sherpa Norsang also approached the cops in Japan, prompting the National Police Agency of Japan to initiate a full throttle probe.
by Taboola
by Taboola
Sponsored Links
Sponsored Links
Promoted Links
Promoted Links
You May Like
local network access control
Esseps
Learn More
Undo
The investigation that followed revealed a complex network of call centres, fake pop-up advertisements, and cryptocurrency accounts used by the scammers. The perpetrators, based in India, had used sophisticated techniques to make their fake virus alerts and phishing prompts appear legitimate. The Japanese police alerted the CBI here, prompting an investigation and registration of an FIR under sections of extortion, IT Act and criminal conspiracy.
The two organisations worked with Microsoft to generate exact IP addresses and physical locations of the accused.
On Thursday, the agency said it had arrested six individuals after conducting raids at 19 locations in Delhi, UP and Haryana. A few of the individuals involved in the racket are students and were learning Japanese language. The sleuths dismantled two call centers as well.
Probe revealed that the pop-ups were hosted on malicious URLs using Microsoft Azure servers.
"Further, the Japanese language used by the callers was notably unnatural and non-fluent. Additionally, background conversations in Hindi were audible during calls, suggesting that the operations were conducted from India. Analysis of malicious URLs used in fraudulent pop-ups and IP addresses used to subscribe to hosting platforms traced the activity back to India," the CBI added.
In the case of Takaharu, probe revealed that the suspects had purchased 2.1 BTC (Bitcoins) in a Binance account, which was transferred to cryptocurrency accounts linked to one Kapil Gakhar.
In others cases, the suspects instructed the victims to buy Apple Gift Cards as the cost of removing the virus and obtained the codes of the gift card from the victim.
The investigation identified key players who had different roles. They created fake pop-ups, operated call centres, and managed infrastructure to target Japanese victims. "The CBI has seized substantial digital and physical evidence indicative of the large-scale operations of the syndicate. Preliminary analysis confirms that the scam leveraged advanced social engineering techniques and technical subterfuge to manipulate victims," the CBI added.