Fake Customs with Remote Access/Website Fraud — How to Identify & Stay Safe

INDIA — By BharatSecure Threat Intelligence Team · Updated Sep 11, 2026

Severity: Critical | View Full Scam Details

Fake Customs Remote Access Scam (2025): How Fraudsters Are Draining Indian Bank Accounts Using WhatsApp and AnyDesk

Scammers posing as customs officials are calling Indians on WhatsApp, claiming their parcels contain drugs — then emptying their bank accounts within minutes using remote access apps. This scam has a risk score of 10/10 and is surging across India right now.

What Is the Fake Customs with Remote Access/Website Fraud?

This is a multi-stage psychological fraud where callers impersonate customs officers or courier company representatives to terrorise victims into handing over remote control of their devices and money. It combines phishing, identity theft, and banking fraud in a single attack.

The scam targets everyday smartphone users — people who shop online, use UPI, or have an Aadhaar-linked bank account. No technical knowledge is required to fall victim; the weapon is fear, not tech illiteracy.

The financial damage is severe. According to Ministry of Home Affairs data, phishing-related cybercrimes cost Indians over ₹250 crore in a single recent year. BharatSecure's threat-intelligence database has catalogued 38,282 phishing URLs and domains verified by CERT-In, RBI, and OpenPhish — many mimicking official customs, courier, and government portals.

CERT-In (cert-in.org.in) and I4C (cybercrime.gov.in) have both issued standing advisories urging citizens never to act on unverified package alerts received via WhatsApp or unofficial numbers.

Exactly How This Scam Works — Step by Step

1. First contact via WhatsApp. You receive a call or message from an unofficial number, claiming to be from a courier service or customs authority. The caller says a parcel addressed to you has been intercepted.

2. The accusation. The caller alleges the package contains drugs or other illegal items and that your Aadhaar number is linked to the shipment. You feel confused — you never ordered anything.

3. Manufactured urgency. You're told you must pay a fine or "clearance fee" immediately or face arrest. The script is designed to prevent calm thinking.

4. Fake evidence is shared. Spurious documents, screenshots, or even a video call "from a police officer" may be shown via WhatsApp to appear credible.

5. The remote access trap. You're instructed to download a remote access app — commonly disguised as a "customs verification tool" or "legal compliance app." Once installed and shared, the caller has full control of your screen.

6. Bank accounts drained. With remote access active, the caller navigates your banking app, authorises UPI transfers, or harvests credentials. In reported cases, victims have lost amounts like ₹1.5 lakh within minutes — with transactions they cannot trace or reverse in time.

Real Warning Signs (What to Watch For)

• Contact arrives via WhatsApp from an unknown or unofficial-looking number, not an official government helpline
• Caller claims your Aadhaar number is linked to illegal activity
• You're told a package is "flagged for drugs" — even though you made no such order
• Immediate payment is demanded to avoid arrest or prosecution
• You're asked to download any app (AnyDesk, TeamViewer, QuickSupport, etc.) during the call
• "Official" documents are shared only over WhatsApp, never through a verifiable government portal
• The caller threatens you with CBI, Narcotics Control Bureau, or police action within minutes
• Any communication that creates panic and demands you act before you can think or verify

What Happens to Victims

The financial impact is immediate and devastating. UPI transactions, once completed, are extremely difficult to reverse — the RBI's chargeback mechanism for UPI fraud requires victims to report within hours, and recovery is not guaranteed. Victims have reported losing anywhere from ₹50,000 to several lakhs in a single session. With remote access granted, scammers can also harvest saved passwords, OTPs, and net banking credentials for follow-up attacks.

The psychological toll is equally serious. Victims report shame, anxiety, and confusion — particularly because the scam exploits the fear of being wrongly implicated in a crime. Many delay reporting, which further reduces the chance of fund recovery. If your Aadhaar details were shared during the call, contact UIDAI immediately to monitor for misuse.

What RBI, CERT-In, and I4C Say

CERT-In (cert-in.org.in) has repeatedly warned the public that no legitimate authority will demand remote access to your device or payment via phone to resolve a legal matter. Their advisories urge citizens to verify any package-related communication directly with the courier company through official contact numbers only.

RBI guidelines are unambiguous: no regulated entity will ask for your OTP, UPI PIN, or remote device access over a phone call. Any such request is a red flag.

I4C (Indian Cyber Crime Coordination Centre) operates the 1930 cybercrime helpline, which victims should call immediately after any such incident. Reports can also be filed at cybercrime.gov.in.

The legal framework under BNS 2023 (Bharatiya Nyaya Sanhita) and the IT Act covers offences including cheating by personation, identity theft, and unauthorised access — all applicable to this scam pattern.

How to Protect Yourself

1. Never download any app suggested by an unknown caller, regardless of how official they sound
2. Hang up immediately if a caller threatens you with arrest over a parcel — this is the script of a fraud, not a real legal process
3. Verify independently: Call the official courier helpline or customs authority directly using numbers from their official website — never from the number provided by the caller
4. Never share OTPs, UPI PINs, or screen access with anyone, for any reason
5. Do not engage with WhatsApp "evidence" — fake documents are easy to manufacture
6. Check suspicious links at BharatSecure.app before clicking anything shared by an unknown contact
7. Alert family members, especially those who shop online frequently or are less familiar with these tactics

What to Do If You've Been Targeted

• Call 1930 immediately — India's national cybercrime helpline. Speed is critical for any chance of fund recovery.
• File a report at cybercrime.gov.in — keep your complaint number safe for follow-up.
• Call your bank's fraud helpline and ask them to freeze your account or block UPI if a transaction has occurred or is suspected.
• Revoke remote access instantly: uninstall any app you were asked to download and restart your device.
• Change all passwords and UPI PINs from a clean, secure device.
• Contact UIDAI if you shared Aadhaar details during the call.
• Consult a cybercrime lawyer for case-specific legal guidance — this article does not constitute legal advice.

Frequently Asked Questions

Can real customs authorities contact me on WhatsApp about a seized package? No. Official Indian customs communications come through registered postal addresses or official government email domains — not personal WhatsApp numbers. Any such WhatsApp contact should be treated as suspected fraud and reported to 1930.

What should I do if I've already downloaded the remote access app? Uninstall it immediately, then restart your phone. Change your UPI PIN and net banking password from a different, secure device. Call your bank's fraud helpline and call 1930 — do this within the hour to maximise your chances of recovery.

My Aadhaar number was mentioned by the caller. Does that mean they have my real data? Scammers may obtain partial personal details through data leaks or social engineering. Knowing your Aadhaar number does not give them legal power over you. Report the incident to UIDAI and to 1930. A legitimate authority will never threaten you over phone based on Aadhaar data alone.

Is there any way to recover money lost through a UPI transfer in this scam? Recovery is possible but not guaranteed, and time is critical. File a complaint with 1930 and your bank within hours of the transaction. RBI guidelines require banks to investigate fraud complaints, but reversals depend on whether the funds are still traceable. Consult a lawyer for case-specific advice.

If you received a suspicious message or link claiming to be from customs or a courier service, scan it instantly at BharatSecure.app — and call 1930 if you believe you've been targeted.

Disclaimer: This article describes a pattern of fraud reported in public sources for public-safety awareness. It is not legal, financial, or medical advice. To request correction or removal of any content, write to hello@bharatsecure.app.