A cybercrime and police report, an intransigent Cleartrip, a dogged policeman, and a refund

Six months ago, I wanted to change my ticket to Kolkata on the Cleartrip (www.cleartrip.com) site. The ticket was bought with ClearChoice Plus, so rescheduling was routine. But the system showed “No flights found for this search.”

I tried many alternate dates but the result was the same. Surely something was wrong with the Cleartrip site. 

How can I reach Customer Care? Well, I Tweeted to Cleartrip's official account (@Cleartrip). Within minutes, I received a Tweet from Cleartrip stating that someone would call me.

And the call came, in around 20 minutes from a number +91 9061051770, who introduced himself as a Cleartrip employee and offered me to help. Since my Tweet to Cleartrip was the only public communication, and it did not contain any personal information except the Trip ID, I assumed it to be a genuine call.

The person on the other end was articulate and patient, and he offered to help. He said he was able to log in for sure, and asked me to try again – which did not work. So he asked me to share the OTP, which I did (yes I did, and I should not have – but that is a small part of the entire story).

 Well I was told it would be escalated to the customer support team and should be resolved in an hour, I need to log off from all devices and then log in. There were offers to help me reschedule on the phone, which I refused (thankfully).

 In late evening when I checked, I found that my booking was not available. The amount involved was INR 7,220.

I immediately Tweeted to Cleartrip about this. I received a response, that someone would call me. And then it unraveled that it was a fraud. The money has been transferred to a Wallet linked to the email refundsetihadairlines@gmail.com. This is not mine.

 I requested the Cleartrip team to immediately block the fraud Wallet, and update me on the action taken. They promised an update in the next 48 hours.

 I filed a complaint with the Cyber Crime Portal - https://cybercrime.gov.in/ (Acknowledgement No – 21603240010569) immediately.

 The promised 48 hours passed, but it helped me to settle my thoughts. And three questions arose:

1.       I understand that the caller came to know the case from the Tweet, but how did he get my number?

2.       How was the email linked to my Wallet changed but I did not get any notification?

3.       What is Cleartrip doing about blocking the Wallet, and if the money already spent are they tracking in whose name the spend has been made?

So the question arose, is this a case of fraud where someone from inside Cleartrip shared my phone number after I made the Tweet on the issues faced in changing the dates? Also since, 5 days passed instead of 2, and no money was in my Wallet, I understood that Cleartrip has not held up the fraud Wallet. That is when I wanted to make Cleartrip too as a part of the case.

I however did not follow the typical path of the privileged Indians – find out some senior folks in Clertrip and try a solution. I wanted to go the hard way, as that is the only option that is available to a majority of the countrymen. And I believe that unless the likes of us, who have the voice, do not raise the voice by trying to solve all our challenges through contacts, the system will never change.

I updated my complaint with the potential internal fraud of Cleartrip, and their lack of cooperation on the Wallet status.

 Cleartrip finally responded stating  “

I am very sorry to inform you that we were unable to arrange a refund in the original payment mode for the cancellations that were attempted and the wallet amount was refunded. We understand that this must be very frustrating for you, and we are here to help you in any way that we can.

After checking with the technical team, we were informed that Cleartrip (CT) is not at fault here. It appears that an outsider might have hacked your account, and we suggest that you complain to Cybercell. We can only imagine how distressing this situation must be for you, and we apologize for any inconvenience caused.

The cancellations were attempted through the website/application using the email address Confirmetihadairlinestickets@Gmail.Com, but the addressed mail was not that of a passenger, and the person who attempted the cancellations might have logged into the account using credentials that are only handled by the passenger, not the agency.

Please know that we are here to support you in any way we can, and we appreciate your understanding in this matter. We hope that you can resolve this issue soon.”

 Essentially Cleartrip was washing their hands off. But this was not to be – the game had just begun. I responded to Cleartrip:

The following questions remain: 1. How did the hacker come to know about my phone number? 2. What has happened to the money that was transferred to the wallet of " Confirmetihadairlinestickets@Gmail.Com" I will be initiating appropriate steps.”

 In the meantime, I received an update from the Cyber Crime Portal to visit the local Police Station, with a phone number to contact. The person on the other side said he was at the Whitefield Reginal Cyber Cell, and I needed to personally go to HAL Police Station, which has my jurisdiction. Then started a series of visits to HAL Police Station. When I went there first, I found that there was a desk dedicated to this, with a thick file with tens of complaints, and a large number of people sharing their situations. It has reached epidemic proportions.

I filled up a form and came back. I received a call late in the evening – someone named Imran Khan from the Police Station was feeding the data into the system based on my complaint and wanted clarity. I had some challenges explaining what is a Wallet, as most frauds are money taken from the bank accounts. The next day I visited the station, met with Imran Khan, and collected my copy of the Guarantee of Service to Citizens (GSC), which is a detail of the complaint (No PO1416240600382) for tracking. It is not a FIR, but a documentation specifically for the Cyber Crimes as there are too many cases of them.

 I made a couple of visits to the PS and also spoke to Imran on the phone. Here are my experiences with the Police:

1.       They are courteous – both at PS as well on call. The Station is very well organized.

2.       The process is very well laid out. I also shared a format with them to help with the process.

3.       There are many complaints, and some of them are large in terms of money value. Normally a case of mine which is a few thousand rupees will not get any traction, but I insisted on following it up to ensure some people are woken up and ideally prosecuted.

4.       The training of the police team is limited. Beyond money taken from banks, other crimes are largely not understood.

5.       At least members at the PS are very young. Not sure about the status higher up in the hierarchy.

6.       The facilities available are abysmal – I was shown updates on Excel in Smart Phones. Surely we need to spend here.

7.       Work happens if one follows up. For that, we need to break both our fear as well reticence of visiting a Police Station.

 While this was one, I received an email from Cleartrip Customer Support that my refund had been processed, but even after two weeks, I have not received any refund. And then it dawned on me that it was another faux pas on their part – the same Wallet Transfer to the fraud account was classified as a refund for the closure of the case. I of course added this to the complaint as a closure without any resolution.

 The case was not progressing. Police called up Customer Care of Cleartip, they initially updated that the refund has been made and later said they are working on this. I also wrote to the Customer Care office, a physical letter to have evidence of non-action. I Tweeted tagging the senior members of Cyber Cell of Bengaluru and also wrote to them. And I kept the Cleartrip updated on all these, always saying – “I will not be stopping unless they share information on the wallet and details of who used it with me and the investigating team”.

Suddenly there was an email from the Legal Counsel of Cleartrip stating I can take my independent action, essentially stating they did what they did and not to disturb me further. This got my goat, and I sent out a comprehensive status with this statement at the top, to all the relevant email IDs I had. Guess what? I received a communication that I would get the money back, INR 6,239. INR 981 was deducted as the ticket was canceled by the fraudster.

 So is it a time to celebrate? Not really, but given that I made the mistake of sharing the OTP in the first place getting back 85% of the loss is a good achievement. But I don’t want to stop here – the fraudster has not been caught, and Cleartrip has not shared the details with the police on who used the Wallet money. But there are some great learnings, and that is why I write this:

1.       Anyone can be a victim of fraud. I am usually very careful, but there was a slip once with some assumptions of authenticity – can happen to anyone.

2.       Social media is full of how smart people avoid fraud, but the police data shows that hundreds of crores of rupees are being lost by ordinary people. So there are many victims, many are among us, and you too can be one. This is not one space where one should act better than others – rather in case there is an incident with you, talk about it and warn others.

3.       When it happens, don’t say that you won’t complain because you are too busy. Most of us are quick to save a few bucks, so we are not busy – but rather scared to approach law enforcement agencies. Remember tomorrow you or I can be a victim of a much bigger fraud where all our savings may be wiped off.

4.       Avoid using contacts. This is a disease of underdeveloped countries – the ones with voice use shortcuts, and the rest have no option. Take the hard route, take some actions, and push the system. Believe me, there is both validation and satisfaction.

5.       Police try their best, but they don’t have resources. So we need to follow up to prioritize our case. Customer Care is measured on the closure of cases rather than satisfaction and hence should be made aware that one is not backing down.

 Hope many will do a similar shaking up of the movers in the country and make India a better place. In a way, this is also patriotism. And way better than desktop umbrage which we are all so adept at.