Asia

From WhatsApp to GoDaddy: How India is trying to stop cybercrime before it happens

Over the past two months, India has tightened oversight across its digital ecosystem, with moves affecting WhatsApp, Telegram, Truecaller and GoDaddy. What are the trade-offs? Experts weigh in. 

New: You can now listen to articles.

This audio is generated by an AI tool.

Shadma Shaikh

Read a summary of this article on FAST.

Get bite-sized news via a new
cards interface. Give it a try.

Click here to return to FAST
Tap here to return to FAST

BENGALURU: A video call from a supposed police officer caught retired Bengaluru resident Vijay Mohan off guard. The caller, dressed in police uniform, claimed a parcel addressed to him had been intercepted and found to contain illegal drugs and forged passports.

The fraudsters then shifted the conversation to WhatsApp, sharing documents and instructions that made the investigation appear genuine. 

Within hours, Mohan, whose name has been changed to protect his identity, had transferred more than 500,000 rupees (US$5,223) to the scammers.

Reported digital arrest scams – in which fraudsters impersonate officials, threaten victims with arrest and demand money – and related cybercrimes in the country rose over threefold to 123,672 cases in 2024 from two years prior.

During the same period, reported losses surged more than 20 times to 19.36 billion rupees, according to India’s Ministry of Home Affairs.

As scams grow larger, faster and more sophisticated, the Indian government is extending its oversight across the digital ecosystem.

In recent months, it temporarily restricted Telegram during the medical entrance test re-examination, asked Meta to pause WhatsApp’s username rollout, tightened rules for caller identification platform Truecaller, and introduced new requirements for domain registrars and hosting providers like GoDaddy.

“Rather than waiting until cyber scams happen and issue takedown notices, the regulators (in India) have been proactive through these measures,” said Tejas Bharadwaj, senior research analyst with the Technology and Society Program at Carnegie India.

The recent measures signal a shift from relying primarily on removing harmful content after the fact to trying to prevent scams earlier through product design, platform features and internet infrastructure.

Experts that spoke to CNA broadly agree that cybercrime has evolved faster than the systems built to stop it. Modern scams no longer rely on a single app or platform, but exploit multiple layers of the digital ecosystem, from telecom networks and messaging apps to fake websites, payment rails and AI-generated content. 

That said, the debate is over how far the government should go: some experts said it must intervene earlier and coordinate action across platforms, others warn that attempts to shape product design and technical systems could give the state powers far beyond fighting cybercrime. 

INDIA’S ATTEMPT TO STOP CYBERCRIME AT THE SOURCE

By early 2025, 86.3 per cent of Indian households had internet access, up from just 23.8 per cent between July 2017 and June 2018, according to data from government surveys. 

But as more Indians transact, communicate and work online, cybercrime has grown in both scale and sophistication. Indians have lost an estimated US$5.64 billion to cyber fraud over the past six years, according to Carnegie India.

Show More

Show Less

Fraud, once viewed largely as a consumer protection issue, is increasingly seen as a systemic threat capable of undermining trust in India’s digital economy, Bharadwaj said.

Regulators are no longer treating cyber fraud as a series of isolated incidents but as a challenge that cuts across the country’s digital infrastructure, he added.

Experts said the nature of cybercrime itself has fundamentally changed.

“Cyber enabled fraud in India has moved from relatively linear scams to highly adaptive, multi-stage operations,” said Sanjay Katkar, founder and CTO of Seqrite, an Indian cybersecurity company.

“Fraud has evolved from being just about a fake link or a one-time social engineering lure,” he told CNA. 

“It has now transformed into an ecosystem that combines impersonation, malware, mule accounts, payment rails, automated reconnaissance and increasingly AI-generated content.” 

Katkar said cybercrime has become “industrialised”, with specialised groups now handling different platforms of the scam infrastructure. 

As a result, interventions focused on a single platform are becoming less effective because fraudsters simply move to another part of the ecosystem.

Instead, he argues, preventing scams increasingly requires coordinated action across telecom operators, technology platforms, banks, cybersecurity agencies and law enforcement, allowing them to share intelligence and disrupt fraud before victims lose money.

That shift by the Indian government is also changing what is expected of the companies operating in the country’s digital infrastructure.

Rather than responding only after fraudulent activity is reported, platforms are increasingly being pushed to detect and remove malicious activity proactively, said experts.

India’s Ministry of Consumer Affairs said that a major e‑commerce platform had strengthened its internal detection and filtering systems and removed 12.1 million counterfeit product listings between Aug 4, 2022 and Jun 5, 2025. 

In a Jan 2026 announcement, Flipkart – India’s e-commerce giant – said it had acted against more than 10 million non-compliant or counterfeit listings and removed 13,000 sellers from its platform that violated its marketplace policies.

Mayank Sohar, founder of Brand Scale, a firm that advises multiple consumer brands, said companies in India are largely addressing trust challenges by investing in stronger brand presence and verified communication channels. 

“While there are government interventions like the National Consumer Helpline, it still has some distance to travel with respect to making grievance redressal easier,” said Sohar.

CYBERCRIME BEYOND PLATFORM CONTROL 

Looking back, cybercrime victim Mohan said the fraud did not hinge on any single person or platform, but on how seamlessly the scammers moved from Google Meet to WhatsApp and then through the banking system. 

“Cyber scams nowadays have evolved from isolated phishing campaigns into highly coordinated attack chains that span multiple layers of the internet,” said Goran Risticevic, Vice President and Managing Director for Asia Pacific at Cloudflare, a web infrastructure and cybersecurity company. 

This means action by one company often disrupts only one part of a much larger campaign, making modern cybercrime harder to stop.

Cloudflare’s own data illustrates how persistent that activity has become. 

During the second quarter of 2026, the company blocked an average of 12.9 billion cyber threats per day targeting India. That accounted for roughly 3.1 per cent of all content requests it handled in the country, a level of malicious traffic that Risticevic described as a “baseline” rather than an occasional surge.

That fragmentation also changes how different companies experience the same attack.

Telecom operators may flag suspicious phone numbers, messaging platforms flag fake accounts, registrars flag fraudulent domains, and banks flag unusual transfers, experts said.

“Each platform may only see one fragment of the campaign, while the attacker sees the full picture,” said Seqrite’s Katkar.

According to him, this is why tackling cybercrime increasingly requires organisations to share intelligence rather than respond in isolation.

Katkar said that the greatest opportunity to disrupt cyber fraud lies in targeting the infrastructure that enables them before victims lose money. 

That includes mule accounts, fraudulent domains, fake applications, compromised identities, suspicious transaction networks and hosting infrastructure used to support large-scale scam operations.

“Infrastructure-level intervention is becoming more important because attackers now operate highly organised and scalable fraud ecosystems designed for speed, automation and rapid monetisation,” he said.

CNA reached out to the Ministry of Electronics and Information Technology (MeitY), the Telecom Regulatory Authority of India (TRAI) and Truecaller for comment but did not receive a response.

A GoDaddy spokesperson told CNA, “The matter is currently before the Delhi High Court, and we don’t comment on pending litigation.”

In April, GoDaddy filed an appeal against a Delhi High Court order imposing stricter obligations on domain registrars and hosting-related intermediaries to tackle fraudulent websites. 

HOW FAR SHOULD GOVERNMENTS GO? 

Some experts question where governments should draw the line between tackling scams and influencing the design of digital products.

For Prateek Waghre, an independent technology policy researcher, the government’s recent interventions mark a notable shift from regulating outcomes to shaping product features.

“The emerging tendency of the government to intervene at the level of specific features and platform design at its discretion is extremely worrisome,” he said. 

“Most technology and product features come with trade-offs, but the Indian state appears to be capitalising on them to add to its arsenal of proverbial sticks it can wield at its discretion.”

He points to WhatsApp usernames as an example. While the government argued the feature could make impersonation scams easier, Waghre said usernames can also improve privacy by allowing users to communicate without sharing their phone numbers.

Apar Gupta, founder of the Internet Freedom Foundation, an Indian digital rights organisation, believes the recent interventions reveal what he calls a “philosophy of permission”.

Earlier, the government typically stepped in after harm had occurred. Now it is intervening much earlier at architecture level, Gupta said.

He pointed to measures ranging from WhatsApp usernames and caller identification rules to the government’s Sahyog portal, a system that enables authorities to issue takedown requests and coordinate with online intermediaries to remove allegedly unlawful content. 

Gupta said the concern is that the government may shape digital products without clear legal authority or judicial oversight. He argued that changes should be transparent, grounded in law and independently reviewed, while authorities focus on prosecuting criminals rather than weakening features used by millions.

These concerns extend beyond anti-fraud measures, with digital rights advocates warning that recent takedown orders could also restrict political expression.

Earlier this month, the Indian government directed GitHub to disable repositories hosting Bitchat, an offline messaging app used during student protests in Delhi – a move the Internet Freedom Foundation called unconstitutional. 

Separately, the Delhi Police asked social media platforms to remove posts it described as abusive or defamatory towards Prime Minister Narendra Modi and other constitutional authorities during the protests.

Yet when it comes to cybercrime, even these critics acknowledge that the underlying problem is real. As cybercrime spreads across telecom networks, messaging platforms, domains, hosting providers and financial systems, governments around the world are under growing pressure to respond, experts said.

Katkar argues the debate should not be framed as infrastructure versus platforms. 

“What we need going forward is smarter, intelligence-led protocols that protect trust in the digital economy without creating friction that weakens inclusion or innovation,” said Katkar.

Source: CNA/ss(cf)

Sign up for our newsletters

Get our pick of top stories and thought-provoking articles in your inbox

Get the CNA app

Stay updated with notifications for breaking news and our best stories

Get WhatsApp alerts

Join our channel for the top reads for the day on your preferred chat app

Get bite-sized news via a new
cards interface. Give it a try.

Click here to return to FAST
Tap here to return to FAST

About The Author

admin

See author's posts