“This was unheard of in the region. In two days, around Rs 30 lakh was withdrawn from various accounts. All victims stated that they had not shared any One Time Password (OTP) with anyone, neither did they get any scam calls,” he shares.

What is skimming?

Skimming is a type of cybercrime which involves stealing sensitive information like credit card numbers, login details or other personal information from ATMs, etc, especially using illegal devices.

In Bengaluru city, the police faced repeated instances of skimming, largely because the ATMs here were unmanned. During the pandemic, the scamsters expanded their base, even targeting small towns. By arresting the two accused in this case, who resided in Delhi, the Karnataka Police were, in fact, able to bust an international gang.

Located 76 km from Bengaluru, the small town of Tumakuru houses many ancient monuments. The region is, in fact, known as ‘kalpataru nadu’ for its coconut production.

M V Sheshadri, who was then the district Cyber Crime, Economic Offences, and Narcotics (CEN) wing police inspector, said that just as Tumakuru was opening up after a lockdown, the agriculture-dependent district on November 2 saw at least 63 complaints of money being withdrawn from their bank accounts without their knowledge.

While the police tried to track the withdrawal locations, they were in for another surprise. The money was being withdrawn from ATM kiosks in Bengaluru, Delhi, Chennai and other towns in the country – Rs 1 lakh or less being withdrawn in each transaction.

Connecting the dots

The then superintendent of police (Tumakuru) Vamsi Krishna set up a special investigation team to look into the matter. A police officer said, “We asked the victims when the last withdrawal was made and where. The ATM withdrawals were done between October 31 and November 1, 2020. CCTV footage from the ATMs revealed a man – who appeared to be of African descent — entering an ATM kiosk in the Bheemasandra area. He stayed there for a couple of minutes. His second entry to the same ATM kiosk was exactly 30 hours later.”

Explaining how the criminal worked, Sheshadri, who is now retired, said, “The modus operandi is that a pinhole camera is attached on top of the keypad where the PIN is keyed in and a skimming device is attached to the card swiping slot. This device obtains the data of the debit card. The debit cards used back then relied on magnetic strip swipe technology.”

Constable’s crucial role

CCTV footage revealed that the suspect arrived in a car. Further analysis of the footage from multiple CCTVs helped the police find the car’s registration number. It was registered under the name of one Nitin Gupta but no other details were available. The investigation hit a wall. 

Then K U Harish, a 2017 batch police constable who had studied engineering, came up with the idea to shortlist the mobile phone numbers that were active in all the locations where the crime was reported.

“Harish was a great asset in the case. ‘Tower dumping’ gets us all the active phone numbers from an area of around 500 square metres. We matched them with similar information from Delhi, Chennai and Mumbai. It was all Harish’s idea. It was a mega data of crores of contact numbers. But it emerged that three phone numbers were active in all these locations. It was a massive lead in the investigation,” a police officer associated with the case said.

However, the police found that two of the numbers were switched off and the other was active once in a while. “We were monitoring the active number. While there were no leads for a while, in the first week of December 2020, the mobile phone turned active near Mulbagal in Kolar district, 166 km away from Tumakuru,” the officer said.

“We started to ‘follow’ the number. The people using that mobile number were always on the go. With two vehicles, we followed them over the next few days. The suspects reached Bengaluru, then Chennai and eventually arrived in Tambaram on the outskirts of Chennai city,” Sheshadri said.

“The suspect stayed in a house. Disguised as labourers, officers started collecting information from there. Africans are physically stronger than us. There were more than five people living in that house. So the next day, when the suspect left in his car, we managed to nab him from the street,” he added. The other accused was held soon after.

The accused were identified as Ivan Kabonge, 24, and Lawrence Makamu, 31, residents of Rajpur in New Delhi. Ivan is a native of Kenya while Makamu is from Uganda. They had arrived in India on student visas and overstayed in the country. They skimmed ATMs to make ends meet.

Tumakuru CEN police, during further probe, learnt that the accused used to buy expired debit cards and were cloning the debit cards by installing skimming machines in ATM kiosks. They would skim the debit cards in one state and withdraw the money in another state to make things complicated for investigators. Their arrest led to solving more than 65 cases registered in Karnataka, a police officer said.

Conviction and sentencing

Tumakuru CEN police filed a chargesheet before the court. On December 30, 2024, the Second Additional District and Sessions Court of Tumakuru convicted Ivan and Makamu and sentenced them to eight years’ imprisonment. 

Judge Anantha H said in the order, “It is the duty of every court to award proper sentences having regard to the nature of the offence and the manner in which it was executed or committed. The court must not only keep in view the rights of the victim of the crime but also the society at large while considering the imposition of appropriate punishment.”

Sheshadri said that later banks stopped using magnetic strips in ATM cards and switched to microchip technology to prevent skimming.   By Kiran Parashar, Indian Express