Inside India’s cybercrime investigations: How scammers exploit Telegram
Inside India’s cybercrime investigations: How scammers exploit Telegram
From exam-paper leaks to investment scams, Telegram has repeatedly featured in India’s cybercrime cases. CNA speaks to investigators about why scammers favour the platform - and what Asia can learn from India’s response.
BENGALURU: When 17-year-old Samiksha Narsale walked out of the National Eligibility cum Entrance Test (NEET) in May, she thought the past two years of preparation were finally behind her.
A week later, allegations emerged that the NEET question paper had been leaked on Telegram. Authorities ordered a retest the following month.
Even then, the Telegram channels she followed were flooded with rumours that the new test paper had also been leaked.
About 2.2 million students took the NEET in 2026. India’s national qualifying exam for aspiring doctors and dentists, it is one of the country’s most competitive entrance tests.
“Suddenly, everyone felt they had to be on Telegram because you didn’t know what information might appear there,” Narsale told CNA.
Acting on the National Testing Agency’s (NTA) recommendations, India temporarily blocked the Telegram messaging app from Jun 16 to 22.
The NTA said the ban was “in response to the organised use of the platform by cheating rackets to defraud candidates” ahead of the re-examination on Jun 21.
Telegram challenged the temporary ban, but a New Delhi court upheld the government’s decision, ruling that the restrictions were legal and reasonable.
For investigators and cybersecurity researchers, the NEET controversy was only the latest example of a larger trend. Telegram has become a recurring feature in India’s cybercrime investigations.
“What began as a communication tool is now an alternative to dark web forums,” said Shobhit Mishra, a threat intelligence researcher at CloudSEK, an Indian firm that monitors cybercrime ecosystems.
Threat actors use Telegram as command-and-control infrastructure for malware, a marketplace for selling compromised data, and a platform for large-scale phishing and fraud campaigns in India, said Mishra.
As governments across Asia grapple with the criminal misuse of messaging platforms, India’s response also raises broader questions about whether platforms like Telegram have become critical infrastructure for organised cybercrime and what governments can realistically do about it.
TELEGRAM UNDER THE SCAM SPOTLIGHT
Researcher Mishra explained that whether a threat actor is selling leaked exam papers, pushing a fake crypto investment scam or distributing pirated software, they need three things: mass reach, anonymity and automated interactions.
“Telegram provides all three out of the box, making it the most versatile tool available to modern cybercriminals,” he added.
Telegram’s publicly searchable channels, anonymous usernames, automated bots, large groups that allow up to 200,000 members, and 4 gigabytes file-sharing limit make it useful for criminal networks, according to CloudSEK.
These features are routinely exploited to automate phishing campaigns, credential theft and malware operations.
Telegram disputes that characterisation.
“Cybercrime can and does happen on every digital platform,” the company told CNA in a written statement.
“It is categorically wrong to claim that Telegram is a piece of infrastructure for a problem that is endemic to the internet itself.”
The company said its features “are not built to facilitate crime and provide no advantages for it”, adding that many have since been adopted by other platforms including WhatsApp and Instagram.
Investigators also point out that Telegram is often only part of the fraud chain.
Victims are often first contacted through WhatsApp messages or Facebook advertisements before being moved to Telegram, where organised fraud networks coordinate the operation, said Shubham Singh, a cybersecurity expert who works with Indian law enforcement on digital crime investigations.
Singh said the victims vary, but the mechanics are often similar.
Senior citizens and aspiring investors are lured with promises of quick returns, unemployed jobseekers are drawn in through recruitment scams, while students are targeted with leaked examination papers and coaching material.
That is exactly what happened to Ananya (name changed to protect her identity), a 24-year-old woman from the state of Maharashtra.
What began as a WhatsApp message offering paid work for writing fake Google reviews, quickly moved to Telegram.
There, Ananya was contacted by someone identifying herself as a “receptionist”, who introduced her to a Telegram group where members regularly posted screenshots showing the money they had supposedly earned from completing simple online tasks.
To begin, she was asked to write a few Google reviews and was paid small amounts for completing them. She was then encouraged to deposit a small sum of that money for “investment tasks”, which was promptly returned with a modest profit, reinforcing the impression that the opportunity was genuine.
Only then did the operation change.
A second person, claiming to be a “teacher”, took over the conversation. She instructed group members to make increasingly larger deposits, promising ever greater returns.
Looking back, Ananya believes the entire operation had been carefully choreographed.
“Whenever I asked questions, everyone gave the same answer: ‘Just follow the teacher’s instructions.’ It didn’t matter who I asked, the receptionist, the teacher or the other members. It felt like everyone was following the same script,” she told CNA.
She said scammers benefited from Telegram’s features that let users discreetly edit chats and quickly create new accounts after old ones were reported.
“Even after the director’s account was marked as a scam, the teacher simply took over. It became clear that even if one account disappeared, another person would step in and continue the same scam,” she added.
According to Singh, the cybersecurity expert who works with Indian law