Hello, This is Divya: WhatsApp message leads to Rs 21.06 crore crypto scam targeting Gwalior CA

Cryptocurrency investment scam: A simple WhatsApp message that began with the words, "Hello... this is Divya speaking," allegedly triggered one of India's biggest cryptocurrency investment frauds, leaving a 70-year-old chartered accountant from Gwalior poorer by more than Rs 21 crore.

The victim, Ashok Vijayvargiya, a senior chartered accountant and Chief Returning Officer of the Madhya Pradesh Chamber of Commerce and Industries, was allegedly convinced to invest in USDT (Tether), a cryptocurrency pegged to the US dollar. What appeared to be a highly profitable investment opportunity ultimately turned out to be an elaborate scam that lasted for nearly seven months.

According to the police, between December 2025 and July 2026, Vijayvargiya transferred Rs 21,05,92,000 to multiple bank accounts while a suspected fake online trading platform continued displaying imaginary profits of more than Rs 33 crore.

Money spread through thousands of bank accounts

Investigators say the fraud was carefully designed to make tracing the money extremely difficult.

The State Cyber Cell's preliminary investigation found that the funds did not remain in a few accounts. Instead, they were allegedly dispersed through a four-layer banking network involving over 20,000 transactions across several states.

The police identified 77 first-layer bank accounts that directly received the victim's money. From there, the funds were transferred to 493 second-layer accounts before moving into nearly 12,700 third-layer accounts.

The trail continued through another 7,500 transactions in the fourth layer, where investigators believe the money was withdrawn through ATMs, converted into shopping and cash vouchers, used for online payments or converted into cryptocurrencies, including USDT.

In total, investigators are examining nearly 20,049 financial transactions.

Rs 2 crore frozen, majority of funds already moved

The Cyber Cell has so far managed to freeze around Rs 2 crore spread across different bank accounts. However, officials believe most of the money had already been withdrawn, converted or transferred before banks could intervene.

Investigators are now scrutinising all the identified first-layer accounts while trying to establish where the money finally ended up after passing through multiple banking layers.

Fraud trail extends across several states

According to investigators, the banking trail stretches across multiple states, including Karnataka, Tamil Nadu, Andhra Pradesh, Kerala, Haryana, Uttar Pradesh, Gujarat, Rajasthan, Madhya Pradesh, Jharkhand, West Bengal and Chhattisgarh.

The police suspect that many of these accounts may belong to money mules—individuals who allow criminals to use their bank accounts in exchange for commissions—while others could be linked to fake firms, intermediaries, digital wallet operators or organised cybercrime syndicates.

How the alleged scam began

The complaint states that Vijayvargiya first received a WhatsApp message in December 2025 from an Indian mobile number.

The sender introduced herself as "Divya" and claimed to be an investment adviser offering lucrative returns through cryptocurrency trading, particularly USDT.

As conversations progressed, communication allegedly shifted to other WhatsApp numbers, including one carrying the United States country code 1 (516) 713-7291.

Investigators are verifying whether this number actually originated in the US or whether it was a virtual number generated through internet-based communication services.

The fraudsters allegedly sent Vijayvargiya a link to an online trading portal and helped him create an account that displayed opportunities to invest in USDT, Bitcoin and other digital assets.

Small profits built confidence

The police say the fraud followed a pattern commonly seen in online investment scams. The initial investments were deliberately small.

On December 25, 2025, Vijayvargiya transferred Rs 10,000 four times through UPI. A few days later, around Rs 1 lakh was transferred using a friend's UPI account. The online portal displayed steady profits, reinforcing his confidence. The turning point came on January 7, when Rs 1.88 lakh was actually credited into his HDFC Bank account as returns.

Because the payment reached his bank account, Vijayvargiya reportedly believed the platform was genuine and continued investing significantly larger amounts.

Investments rose to crores

Even before receiving the initial payout, Vijayvargiya had allegedly transferred Rs 15 lakh through RTGS from his Union Bank account on December 31. Over the following months, crores of rupees were transferred into numerous beneficiary accounts shared by the alleged fraudsters.

Business associates have reportedly informed investigators that Vijayvargiya may have invested not only his own money but also funds belonging to more than 35 acquaintances and business associates who trusted his financial advice.

The police are examining these claims during the ongoing investigation.

Fake profits crossed Rs 33 crore

As more money was invested, the online trading portal continued displaying increasing profits. Eventually, the account allegedly reflected a withdrawal value of approximately Rs 33.25 crore. However, when Vijayvargiya attempted to withdraw the amount, the transaction was blocked. The alleged fraudsters then demanded Rs 10.84 crore, claiming it was required as income tax before the money could be released.

To make the demand appear genuine, they allegedly claimed they would contribute Rs 5.34 crore themselves and asked Vijayvargiya to arrange the remaining amount. Despite additional payments and repeated assurances, the promised funds never arrived.

The fraudsters allegedly made another demand of Rs 1 crore as a "risk margin", saying it was necessary because the withdrawal amount exceeded the permissible limit.

Only then did Vijayvargiya reportedly realise that the profits shown on the trading portal may never have existed.

Cyber cell examining WhatsApp numbers and IP addresses

Vijayvargiya has submitted WhatsApp chats, bank statements, transaction screenshots and details of multiple beneficiary accounts to investigators.

The complaint was also registered through the National Cyber Crime Reporting Portal and the 1930 cybercrime helpline, enabling authorities to quickly initiate action.

The police say prompt reporting helped freeze nearly Rs 2 crore before the remaining funds could be completely dispersed.

Investigators are now tracing the IP addresses linked to the WhatsApp communications as well as the fake trading platform's URL to identify those behind the operation.

State Cyber Cell Deputy Superintendent of Police Sanjeev Nayan Sharma said the fraud involved a nationwide network of bank accounts operating through a layered transfer system.

He said the cyber team is currently focusing on the 77 first-layer accounts that directly received the victim's money and has already frozen nearly Rs 2 crore.

According to Sharma, investigators are also analysing three WhatsApp numbers, several bank accounts and the IP addresses associated with the suspected fake trading portal.

An FIR has been registered against unidentified accused under Section 318(4) of the Bharatiya Nyaya Sanhita (BNS), Section 319(2) of the Bharatiya Nyaya Sanhita (BNS) and Section 66D of the Information Technology Act. The FIR records the alleged financial loss at Rs 21,05,92,000, while investigators continue efforts to identify the accused, freeze additional accounts and recover the remaining funds.


Also Read |  Toll rates increased at 8 major plazas in Punjab and Haryana from today; check new rates here

Also Read | Fatehgarh Sahib murder: Sacrilege case accused Mewa Singh beheaded by unidentified assailants at his residence