With upfront UPI payments, wine shop listings on Google are being used to defraud customers.

English Wine Shop in Noida’s sector 18, as its name indicates, is a place where you can buy liquor. It has a large, red signboard. From the outside, you can see the shop has brightly lit interiors. There are glass cabinets and refrigerators that look like they’re both well-used and well-maintained.

If you look up English Wine Shop on Google Maps, you’ll find its correct location in Noida, but the photo accompanying the listing shows dimly-lit interiors that look distinctly fancy. There’s also a phone number prominently positioned on the image.

Check the number shown on Google Maps on the caller identification app Truecaller, and it’ll be listed as spam. The same number — 9450697443 — has been listed for a number of locations (one which is in the middle of the Maharaja Agrasen Marg and a little more than four kilometres away from English Wine Shop in sector 18).

This is why if you ask the attendant at English Wine Shop about the shop’s phone number, his counter question is, “Were you also scammed?”

The phone number listed for English Wine Shop is one of many that are being used to run scams in cities like Delhi and Mumbai. These numbers are manned by people who claim to stock a wide range of alcohol and deliver to locations across the city. When Newslaundry posed as a customer, we were told all major brands were available and there was no delivery fee.

The only requirement was that the payment had to be made at the time of placing an order, using either a unified payments interface (UPI) or a credit or debit card. When we listed the alcohol we wanted, the amount that we were billed did not match the current market price of the alcohol we’d ordered.

For some, the payment upfront and the mismatch in the price of the alcohol are warning signs. However, for many, the fact that the shop’s number is listed on Google lends it credibility and makes them vulnerable to being scammed.

Fraud, home delivered

In August 2019, an Air India pilot was duped of Rs 38,000 when she ordered liquor online in Mumbai and was asked to make an advance payment because the shop did not accept cash on delivery. The pilot told the shop attendant her debit card details and shared two one-time passwords (OTP).

In December 2021, the Indian Express reported that a senior official from the Securities and Exchange Board of India (SEBI) had been duped of Rs 2.53 lakh while trying to buy wine online, also in Mumbai.

Speaking to Newslaundry, a Mumbai-based accountant, who had fallen for a similar scam during the lockdown in 2021, said that paying at the time of ordering wasn’t unusual when it came to alcohol. Consequently, many didn’t find it suspicious that they’re being asked to pay before they received their order. The accountant lost Rs 2,000 after ordering alcohol from a wine shop they found on Google. They didn’t file a police complaint since the amount was small. “The place looked genuine as it had a proper logo with the contact information,” said the accountant.

This scam has since spread to other cities. For example, a Google search with the keywords 'liquor delivery Delhi' offers a list of results of which some are clearly suspect.

One is called Liquor Store and is near Majnu ka Tila. Their business details include a website (delhiliquor.com) that appears to be based in Ohio, in the United States of America.

The reviews on Google for Liquor Store include words of warning: “This shop owner is a fraud. He took Rs 7000 from me through Google Pay. And then asking for my card number and details. I have lodged a complain against him. Don't ever trust him if he asks you to pay before delivery. He ask to ‘add to machine’ through Google Pay and cheat you,” wrote a reviewer named Ashish Pathak.

A Twitter user (@drunkenpandaman) had explained in a thread dated 2019 how these scams operate.

The first step is to put up a fake listing on Google, promising home delivery of alcohol. Next, anyone calling would be asked for payment upfront. Once that payment has been made, the scammers would stop receiving any calls and the customer would be left high and dry, without alcohol and having been robbed of the bill amount.

Spot the scammer

Whenever such cases are reported, the general public is advised to exercise caution and be alert, but it is worth wondering whether banks need to exercise greater scrutiny through their know-your-customer (KYC) processes.

While some funnel payments using stolen Paytm accounts (thus adding identity theft to their list of violations), many use bank accounts linked to their own real names. Is the KYC process for such digital payment providers porous? Unlike the insurance provided by banks against malicious outflow of funds from one's account, are consumers adequately protected by UPI companies?

While Paytm and some UPI companies do have KYC processes in place, there are ways around them. One workaround for scammers is that wallets can send and receive money without having to connect to a bank account or fulfilling the terms under the KYC process.

Real businesses listed on Google Maps have a KYC process that they need to undertake with Google. Once that is done, they are able to list an official phone number that can be accessed using the “Call” button in the Google Maps application or on the website.

A business doesn’t have to incur any costs or fees to complete the KYC process. So if this hasn’t been done by a vendor, that should be a red flag for potential customers.

Another sign of a dubious enterprise is numbers being photoshopped on photographs in a listing.

The obviously-manipulated image suggests the contact number has been inserted without the Google verification process being completed. Google masks phone numbers mentioned in titles and descriptions in an effort to prevent unverified listings from bypassing the verification process. So if photos of the shop include a superimposed phone number, chances are the number is suspect.

AI to the rescue, but not yet

Scammers seem to bypass the Google verification process by adding phone numbers on images, and have continued this to thrive over the years. No tech solutions seem to be in place to prevent this although Google already has a consumer level AI product that could be helpful.

Google Cloud’s Vision AI is designed to detect and classify objects in images, using OCR technology.

OCR stands for optical character recognition, an algorithm that detects texts and patterns in an image.

Google Cloud’s Vision service has the ability to implement scam detection on map listings in a short period of time. Yet, not enough security measures are in place as far as images in map listings are concerned.

For tech enthusiasts who would like to implement their own scam detection algorithms, this public repository demonstrates how Vision AI can be used together with the Google Places API to identify all suspicious wine shop listings in a given city, in under 3 minutes.

The scope of this technology goes far beyond the scam of manipulating images on map listings. AI has the potential to safeguard internet users, provided it’s used to that end.

Play it safe

According to a report in The Hindu, cyber crime in India rose by 11.8% in 2020, with fraud making up 60.2% of the reported cyber crimes. Statistics suggest only 1 out of every 8 cases of cyber crime were solved in 2021.

Cyber security expert Rakshit Tandon said tracking those behind scams becomes a challenge because of the logistics of coordinating between different jurisdictional agencies. He said those who have fallen prey to online scams should register their complaints immediately so that banks can freeze accounts to prevent siphoning of funds and the police can track the perpetrators.

He also advised against downloading and installing applications that are not verified by the Google and iOS app stores as they could contain malware. One should also not click on links that are posted online by unverified sources. Lastly, Tandon encouraged ensuring two-factor authentication for all regularly-used applications on one’s devices.

“Don’t share your grievances or details in any form on social media as it gives hackers and scammers an opportunity to use the information against you,” warned Tandon.

The central helpline number against cyber crime is 1930.