How Did Scams Become One Of India’s Fastest-Growing Shadow Industries, And Why Does It Seem Almost Impossible To Stop Them?

India’s scam economy has quietly evolved into one of the country’s fastest-growing shadow industries. It often begins with a message so ordinary that few people think twice before opening it. Your bank account has been suspended. Your electricity connection will be disconnected within hours. A courier parcel is awaiting delivery. Your KYC has expired. What appears to be a routine notification can, within minutes, become the start of a scam that empties bank accounts, steals identities, or traps victims in elaborate fraud schemes.

This is no longer an occasional nuisance. Fraud has quietly become a part of everyday digital life in India. Whether through phishing SMSes, spoofed phone calls, fake customer care numbers, WhatsApp investment groups, QR code payment tricks, or the now-infamous “digital arrest” scams, almost every smartphone user has encountered an attempt to deceive them. The sheer frequency of these attacks suggests that being targeted is no longer a matter of if, but when.

That reality was illuminated recently by Sunil Bajpai, Chief Technology Officer at Tanla Platforms, who described the staggering scale of the problem in an interview discussing India’s rapidly evolving cyber fraud ecosystem . According to Bajpai, India is inundated with more than 120 million phishing SMS messages every month, exposing tens of millions of citizens to fraudulent attempts. Yet only a small fraction of victims ever report these crimes, meaning the official figures barely capture the true scale of the problem.

The numbers point to something far more troubling than a rise in cybercrime. They suggest that fraud in India has become highly organised, remarkably scalable, and increasingly sophisticated. Scammers are no longer relying on random chance or crude deception. They are exploiting leaked personal data, trusted digital platforms, social engineering techniques, and increasingly, artificial intelligence, to make their operations more convincing and more profitable than ever before.

The question, then, is no longer why so many Indians are receiving scam messages or fraudulent calls. The real question is how the country reached a point where an entire underground economy can target millions of people every single month with industrial efficiency. Understanding that transformation requires looking beyond the victims and into the machinery that powers India’s rapidly expanding scam industry.
The Business Behind The Scam Industry

The popular image of a scammer is often that of a lone individual sitting behind a computer, sending out fraudulent messages in the hope that someone takes the bait. The reality, however, is far more organised and far more alarming.

Today’s cyber fraud operations increasingly resemble well-run businesses, complete with specialised roles, supply chains, technology infrastructure, and even performance targets.

Behind every phishing SMS or fake customer care call lies an ecosystem of actors working in concert. One group acquires or trades stolen personal data, often sourced from data breaches, compromised applications, or illicit databases circulating online. Another procures SIM cards or virtual numbers, while others create convincing fake websites, clone banking portals, or build fraudulent mobile applications.

Dedicated call centres, sometimes operating across state or even international borders, handle the social engineering that persuades victims to part with their money or sensitive information. Once funds are stolen, they are rapidly moved through networks of mule bank accounts, digital wallets, cryptocurrencies, or shell entities to make tracing and recovery increasingly difficult.

Technology has only accelerated this industrialisation. Scammers can now automate phishing campaigns, personalise messages using leaked customer information, and launch thousands (or even millions) of fraudulent communications simultaneously. Artificial intelligence is beginning to make these operations even more efficient, enabling fraudsters to generate convincing messages, mimic official communications, and lower the cost of carrying out large-scale attacks.

This is precisely why experts such as Sunil Bajpai argue that cyber fraud can no longer be viewed as isolated criminal activity. It has evolved into a sophisticated ecosystem that continuously adapts to new technologies and consumer behaviour. Every improvement in digital banking, online commerce, or mobile connectivity creates fresh opportunities for exploitation, and organised fraud networks have become remarkably adept at identifying and exploiting those gaps.

In many ways, the scam industry now mirrors the legitimate digital economy it preys upon. It has suppliers, distributors, customer acquisition strategies, technological innovation, financial intermediaries, and a relentless focus on scale. The difference, of course, is that its business model depends entirely on deception. And as India’s digital economy expands, so too does the market that these criminal enterprises seek to exploit.

Why India Became The Perfect Market For Scammers

The rise of India’s scam economy is not simply the result of more criminals entering cyberspace. It is also a consequence of the country’s extraordinary digital transformation. Over the past decade, India has become one of the world’s largest digital economies, with hundreds of millions of people embracing smartphones, instant payments, online banking, e-commerce, and government services delivered through digital platforms. While this transformation has improved convenience and financial inclusion, it has also created an unprecedented attack surface for cybercriminals.

Perhaps no innovation illustrates this better than the success of the Unified Payments Interface (UPI). The platform has revolutionised how Indians transfer money, pay bills, shop, and conduct business, processing billions of transactions every month. But the same speed and convenience that make UPI a global success story also leave little room to reverse fraudulent transfers once victims have been manipulated into authorising payments. Scammers understand this dynamic well, designing increasingly sophisticated schemes around QR codes, fake payment requests, screen-sharing applications, and impersonation tactics that exploit consumer trust.

At the same time, India’s rapidly expanding digital footprint has generated an enormous amount of personal data. From phone numbers and email addresses to financial information and identity documents, data has become a valuable commodity. Frequent reports of database leaks, unauthorised data sharing, and information traded on the dark web have equipped fraudsters with the raw material needed to craft highly personalised attacks. A scammer who knows a person’s name, bank, address, or recent purchase is far more likely to gain their confidence than one relying on random messages.

The challenge is compounded by the sheer diversity of India’s digital users. Millions of people have come online for the first time in recent years, many without formal cyber awareness training. Elderly citizens unfamiliar with digital banking, small business owners managing finances on mobile phones, and first-time internet users navigating government portals all present attractive targets for fraudsters. Even digitally savvy individuals can fall victim when scammers convincingly impersonate trusted institutions such as banks, telecom operators, delivery companies, or law enforcement agencies.

Artificial Intelligence Is Giving Scammers A Dangerous New Advantage

If India’s digital revolution created the perfect market for scammers, artificial intelligence is rapidly becoming the force that is transforming how they operate. What once required large teams, significant resources, and painstaking effort can now be accomplished faster, cheaper, and with a level of sophistication that was difficult to imagine just a few years ago.

Today, generative AI can produce polished emails, convincing text messages, and professional-looking websites within seconds. Fraudsters no longer need exceptional language skills or technical expertise to create communications that closely resemble those of banks, government agencies, telecom providers, or global technology companies.

Perhaps even more concerning is the rise of AI-powered voice cloning and deepfake technology. Criminals can now mimic the voice of a family member, a company executive, or even a public official with startling accuracy using just a few seconds of audio available online. Combined with caller ID spoofing and personal information obtained through data leaks, these technologies are making impersonation scams far more believable. A victim who hears what appears to be the familiar voice of a relative in distress or an official demanding urgent action is naturally more likely to comply before questioning its authenticity.

Artificial intelligence is also allowing scammers to operate at a scale that was previously impossible. Automated systems can analyse leaked databases, personalise phishing messages using names and recent transactions, engage victims through AI-powered chatbots, and continuously refine campaigns based on which tactics generate the highest success rates. In many ways, cybercriminals are applying the same data-driven strategies that legitimate businesses use to improve customer engagement – except their objective is deception rather than service.

This is a concern that Sunil Bajpai also put forth, noting that the same technologies capable of strengthening cybersecurity are equally capable of empowering cybercriminals. AI, in other words, is neither inherently good nor bad. It is a tool, and increasingly, both defenders and attackers are racing to determine who can harness it more effectively.

If Everyone Knows The Problem, Why Are Scammers Still Winning?

For a problem as widespread as cyber fraud, the obvious question is why it continues to grow despite years of warnings, public awareness campaigns, and technological advances. Banks regularly issue alerts. Telecom operators claim to be filtering spam. Regulators have introduced new safeguards. Law enforcement agencies have made high-profile arrests. Yet scam calls and phishing messages continue to flood phones across the country every day.

The answer lies in the fact that the fight against cyber fraud is not being waged against a single criminal organisation but against a constantly evolving ecosystem. Every time regulators close one loophole, fraudsters identify another. When telecom operators strengthen spam filters, scammers shift to encrypted messaging platforms. When banks introduce additional verification layers, criminals adapt their social engineering tactics to persuade victims to authorise transactions themselves. It is a game of constant adaptation, where the attackers often need to succeed only once, while defenders must succeed every time.

Jurisdiction adds more to the problem. A phishing message may originate from one state, the fraudulent website may be hosted in another country, the call could be routed through internet-based services, and the stolen funds might pass through multiple mule accounts before being converted into cryptocurrency or withdrawn in cash. By the time investigators piece together the trail, the perpetrators have often disappeared or shifted to new identities and infrastructure.

Recovery is equally challenging. Victims who fail to report fraud immediately often discover that their money has already been dispersed across dozens of accounts in a matter of minutes. Even when cybercrime cells successfully freeze some transactions, recovering the full amount can be difficult, particularly in complex fraud cases involving multiple intermediaries. For many victims, the financial loss is permanent.

Another obstacle is underreporting. Fraud carries a social stigma, and many victims hesitate to approach the authorities out of embarrassment or the belief that nothing will come of it. As Sunil Bajpai pointed out, the number of officially reported cyber fraud cases likely represents only a fraction of the actual incidents occurring across the country. That means policymakers and investigators may be confronting a problem that is significantly larger than the available data suggests.

This raises uncomfortable but necessary questions. Are existing regulations keeping pace with the speed at which digital fraud is evolving? Are telecom companies, banks, technology platforms, and regulators coordinating effectively enough to tackle organised scam networks? And as artificial intelligence lowers the barriers for cybercriminals, are India’s institutions prepared for the next generation of fraud?

These are not questions with easy answers. But they make one thing abundantly clear – India’s scam economy is no longer sustained merely by the ingenuity of criminals. It also thrives on the gaps (technological, regulatory, institutional, and behavioural) that continue to exist across the country’s rapidly expanding digital ecosystem.

The Last Bit, Winning The War Against Scammers Will Take More Than Technology

The scale of India’s scam economy can make the problem seem overwhelming, but it is not insurmountable. The same technological advances that have empowered cybercriminals are also giving governments, banks, telecom operators, and cybersecurity firms more sophisticated tools to detect and disrupt fraud.

Artificial intelligence is increasingly being deployed to identify phishing messages before they reach consumers, flag unusual transaction patterns in real time, and detect suspicious behaviour across digital networks. Financial institutions are investing heavily in behavioural analytics, while telecom providers are introducing stronger spam detection and caller authentication systems.

Companies such as Tanla Platforms are also developing AI-driven solutions aimed at identifying malicious messages before they reach users, reflecting a broader shift within the technology industry towards proactive rather than reactive cybersecurity.

At the policy level, regulators including the RBI, the Department of Telecommunications (DoT), and cybercrime agencies have introduced measures to improve reporting mechanisms, tighten verification processes, and strengthen coordination between financial institutions and law enforcement. These efforts are beginning to make it harder for fraudsters to operate unchecked.

Yet technology alone will not solve the problem. The scam industry has repeatedly demonstrated an extraordinary ability to adapt. Every new security feature is studied, tested, and eventually challenged by criminals looking for fresh vulnerabilities. Cybersecurity, therefore, is no longer a destination but a continuous race between innovation and exploitation.

That makes public awareness just as important as technological innovation. The most sophisticated phishing campaign still relies on a victim clicking a malicious link, sharing an OTP, authorising a payment, or believing a fabricated story. As Sunil Bajpai emphasised, attackers are increasingly exploiting human trust rather than technical weaknesses. Building digital literacy, encouraging people to verify unexpected requests, and promoting faster reporting of suspicious activity are likely to remain some of the strongest defences against cyber fraud.

India’s digital transformation has been one of the country’s greatest economic success stories, connecting millions of people to banking, commerce, education, and government services with unprecedented speed. But that success has also attracted an organised criminal ecosystem that sees the country’s vast digital population as an opportunity for profit.

The challenge now is no longer simply to catch individual scammers. It is to dismantle entire shadow industries that have evolved alongside India’s digital economy.

Whether the country can stay ahead will depend not only on smarter technology, but on stronger institutions, closer collaboration, and a public that is as aware of the risks as it is enthusiastic about the opportunities of a digital future.