Verify a decision

{"actor":"system:backfill","investigation_id":"9d69e5d6-dc4c-4464-b07f-684de687bfcf","kind":"publish","page_slug":"mr-parveen-india-social-engineering-scam-ring","published_at":"2026-06-20T12:07:30.722Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Mr. Parveen India Social Engineering Scam Ring","sections":[{"content":"On June 19, 2026, blockchain investigator ZachXBT published an investigation into an India-based social engineering scam ring after being contacted by a user identified as Aman Kesar (@Amankesar11), who claimed that 5.73 BTC (approximately $475,000) had been 'unjustly frozen' at the cryptocurrency swap platform Changelly since March 2025. ZachXBT traced the transaction hash (fb931baac66bfc116deb10fa81417fb3da61e4362cd2997ee1eaa577e96272f3) and connected the associated address cluster to a pattern of social engineering thefts targeting American victims. The investigation was described by ZachXBT as 'a short story about Indian scammers who called the cops on themselves,' referencing the self-exposing nature of the complaint. Following public disclosure, the @Amankesar11 account and its posts were deleted.","heading":"Overview and Exposure","severity":"critical","sources":[{"credibility":2,"name":"ZachXBT Connects Changelly Freeze Case to $475K in Elderly Scam Proceeds — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/06/19/zachxbt-connects-changelly-freeze-case-to-475k-in-elderly-scam-proceeds/"},{"credibility":2,"name":"ZachXBT (@zachxbt) on X — original investigation post","type":"social_media","url":"https://x.com/zachxbt/status/2067938523986932005"},{"credibility":2,"name":"Indian Crypto Scammer Unwittingly Exposes $1M Syndicate to On-Chain Investigator — Castle Crypto","type":"news_article","url":"https://castlecrypto.gg/news/indian-crypto-scammer-unwittingly-exposes-1m-syndicate-to-on-chain-investigator/"}]},{"content":"ZachXBT's on-chain analysis identified Aman Kesar (@Amankesar11) as an alleged money mule operating under the direction of a superior referred to as 'Mr. Parveen,' described as being based in New Delhi, India. The full legal identity of 'Mr. Parveen' has not been publicly confirmed. The ring allegedly employs a network of mules who receive theft proceeds from American victims, consolidate funds, and attempt to convert them through cryptocurrency swap platforms. On-chain tracing revealed irregular inflows originating from multiple U.S.-based platforms — including Bitcoin Depot, Athena Bitcoin, Coinhub ATM, Cash App, Robinhood, Coinbase, and Strike — funneling to a single cluster of addresses associated with New Delhi. The broader theft cluster is linked with high confidence by ZachXBT to over $1 million in social engineering thefts since 2025.","heading":"Alleged Operation Structure and Key Actors","severity":"critical","sources":[{"credibility":2,"name":"ZachXBT Exposes Alleged Scam Mule After Self-Reported Frozen $475K Bitcoin Case — NullTX","type":"news_article","url":"https://nulltx.com/zachxbt-exposes-alleged-scam-mule-after-self-reported-frozen-475k-bitcoin-case/"},{"credibility":2,"name":"ZachXBT Exposes $1M Indian Scam Ring — Phemex News","type":"news_article","url":"https://phemex.com/news/article/zachxbt-uncovers-indian-scam-ring-involved-in-over-1-million-theft-90020"},{"credibility":2,"name":"ZachXBT Investigates User Who Asked for Help Recovering Frozen Bitcoin — Crypto Economy","type":"news_article","url":"https://crypto-economy.com/zachxbt-investigates-user-who-asked-for-help-recovering-frozen-bitcoin/"}]},{"content":"The operation is alleged to rely on social engineering — impersonating government agencies, financial institutions, or technology support entities — to extract funds from victims via U.S. cryptocurrency exchanges and Bitcoin ATM networks. Victims are predominantly elderly American individuals, a profile consistent with broader India-based call center fraud patterns documented by U.S. federal law enforcement. Stolen funds were routed through Bitcoin Depot, Athena Bitcoin, and Coinhub ATM kiosks (physical Bitcoin ATMs), as well as digital platforms including Cash App, Robinhood, Coinbase, and Strike, before consolidating toward addresses tied to the New Delhi cluster. The use of multiple collection nodes across different platforms is characteristic of organized mule networks designed to obscure fund provenance.","heading":"Fraud Methodology and Victim Profile","severity":"critical","sources":[{"credibility":2,"name":"ZachXBT Connects Changelly Freeze Case to $475K in Elderly Scam Proceeds — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/06/19/zachxbt-connects-changelly-freeze-case-to-475k-in-elderly-scam-proceeds/"},{"credibility":1,"name":"FBI — Scammers Target Older Adult Victims","type":"regulatory","url":"https://www.fbi.gov/news/stories/scammers-target-older-adult-victims"},{"credibility":2,"name":"ZachXBT Exposes Indian Bitcoin Crypto Mule — Cryip","type":"news_article","url":"https://cryip.co/zachxbt-exposes-indian-bitcoin-crypto-mule-frozen-scam-proceeds/"}]},{"content":"ZachXBT publicly disclosed the following blockchain identifiers associated with Aman Kesar and the alleged theft cluster: Bitcoin address bc1q5yjxzcvfswvyx9y6cvlc3xe4laqqnqsjp3f9t2, Tron address TQkEVXjtvSbigGa5fqFUpcYJnGvpKPPBEm, and the primary transaction hash fb931baac66bfc116deb10fa81417fb3da61e4362cd2997ee1eaa577e96272f3. These addresses reflect 5.7357 BTC frozen at Changelly on or around March 11, 2025, during an attempted BTC-to-USDT swap. Independent on-chain verification of the full $1 million theft cluster has not been publicly reproduced by a second analyst as of the time of this report.","heading":"On-Chain Identifiers","severity":"high","sources":[{"credibility":2,"name":"ZachXBT (@zachxbt) on X — original investigation post","type":"on_chain","url":"https://x.com/zachxbt/status/2067938523986932005"},{"credibility":2,"name":"ZachXBT Connects Changelly Freeze Case to $475K in Elderly Scam Proceeds — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/06/19/zachxbt-connects-changelly-freeze-case-to-475k-in-elderly-scam-proceeds/"}]},{"content":"A notable aspect of this case is the self-incriminating sequence of events initiated by Aman Kesar. The alleged mule contacted ZachXBT voluntarily seeking assistance, then provided a series of shifting explanations for the origin of the frozen funds: initially describing them as a personal loan, then as money sent by a boss, and finally claiming his boss had purchased Bitcoin during 2014-2015 through a U.S.-based contact. The verification documents Kesar submitted to prove ownership of the frozen funds included banking statements under different names and geographic jurisdictions, which ZachXBT interpreted as evidence of identity layering consistent with money mule operations. Additionally, in December 2025, Kesar filed an Indian police complaint (case reference 3207-P/2025) over the frozen funds — an action ZachXBT noted effectively drew law enforcement attention to the operation.","heading":"Inconsistent Accounts and Self-Incrimination","severity":"high","sources":[{"credibility":2,"name":"ZachXBT Exposes Alleged Scam Mule After Self-Reported Frozen $475K Bitcoin Case — NullTX","type":"news_article","url":"https://nulltx.com/zachxbt-exposes-alleged-scam-mule-after-self-reported-frozen-475k-bitcoin-case/"},{"credibility":2,"name":"Indian Crypto Scammer Unwittingly Exposes $1M Syndicate to On-Chain Investigator — Castle Crypto","type":"news_article","url":"https://castlecrypto.gg/news/indian-crypto-scammer-unwittingly-exposes-1m-syndicate-to-on-chain-investigator/"}]},{"content":"The Mr. Parveen ring operates within a well-documented pattern of India-based fraud operations targeting elderly Americans via cryptocurrency channels. The FBI's 2025 Internet Crime Report found that individuals aged 60 and older filed 13,685 complaints related to cryptocurrency investment scams, with losses totaling $2.76 billion, and were the most affected demographic in cryptocurrency ATM/kiosk scams with approximately $257 million in losses. In May 2026, the FBI announced it had cracked down on a separate India-linked scam network targeting elderly victims through impersonation of government authorities. A March 2026 operation dismantled an India call center responsible for a $50 million Social Security impersonation scheme. ZachXBT also noted concerns about Indian law enforcement credibility in addressing domestic crypto fraud, citing a documented case where officers reportedly confused a phishing site with the legitimate CoinDCX platform.","heading":"Broader Context: India-Based Crypto Fraud Against Elderly Americans","severity":"high","sources":[{"credibility":2,"name":"FBI 2025 Internet Crime Report: Elderly Targeted in Crypto Scams — KuCoin News","type":"regulatory","url":"https://www.kucoin.com/news/flash/fbi-2025-internet-crime-report-ai-fraud-rises-elderly-targeted-in-crypto-scams"},{"credibility":2,"name":"FBI Cracks Down on India-Linked Scam Network Targeting Elderly Victims — American Bazaar","type":"news_article","url":"https://americanbazaaronline.com/2026/05/21/fbi-cracks-down-on-india-linked-scam-network-targeting-victims-481254/"},{"credibility":2,"name":"FBI Shuts India Call Centers After $50M Social Security Scam — Hoodline","type":"news_article","url":"https://hoodline.com/2026/03/fake-feds-real-gold-as-fbi-busts-india-call-center-ring-bleeding-maryland-dry/"}]},{"content":"As of June 19, 2026, no U.S. law enforcement action (arrest, indictment, or DOJ/FBI press release) specifically naming 'Mr. Parveen' or Aman Kesar has been publicly identified. The 5.73 BTC remains frozen at Changelly and has not been returned. Changelly has not issued a public statement on the case. Kesar's Indian police complaint (case 3207-P/2025) was filed in December 2025 but no follow-up action or charge by Indian authorities has been reported. The absence of formal legal proceedings at this stage means that the full scope of the operation and the identities of all participants remain allegations based on on-chain analysis and ZachXBT's published investigation.","heading":"Law Enforcement and Regulatory Status","severity":"medium","sources":[{"credibility":2,"name":"ZachXBT Connects Changelly Freeze Case to $475K in Elderly Scam Proceeds — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/06/19/zachxbt-connects-changelly-freeze-case-to-475k-in-elderly-scam-proceeds/"},{"credibility":2,"name":"ZachXBT Exposes Indian Bitcoin Crypto Mule — Cryip","type":"news_article","url":"https://cryip.co/zachxbt-exposes-indian-bitcoin-crypto-mule-frozen-scam-proceeds/"}]}],"sources_used":[{"credibility":2,"name":"ZachXBT Connects Changelly Freeze Case to $475K in Elderly Scam Proceeds — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/06/19/zachxbt-connects-changelly-freeze-case-to-475k-in-elderly-scam-proceeds/"},{"credibility":2,"name":"ZachXBT Exposes $1M Indian Scam Ring — Phemex News","type":"news_article","url":"https://phemex.com/news/article/zachxbt-uncovers-indian-scam-ring-involved-in-over-1-million-theft-90020"},{"credibility":2,"name":"Indian Crypto Scammer Unwittingly Exposes $1M Syndicate to On-Chain Investigator — Castle Crypto","type":"news_article","url":"https://castlecrypto.gg/news/indian-crypto-scammer-unwittingly-exposes-1m-syndicate-to-on-chain-investigator/"},{"credibility":2,"name":"ZachXBT Exposes Alleged Scam Mule After Self-Reported Frozen $475K Bitcoin Case — NullTX","type":"news_article","url":"https://nulltx.com/zachxbt-exposes-alleged-scam-mule-after-self-reported-frozen-475k-bitcoin-case/"},{"credibility":2,"name":"ZachXBT (@zachxbt) on X — original investigation post","type":"social_media","url":"https://x.com/zachxbt/status/2067938523986932005"},{"credibility":2,"name":"ZachXBT Investigates User Who Asked for Help Recovering Frozen Bitcoin — Crypto Economy","type":"news_article","url":"https://crypto-economy.com/zachxbt-investigates-user-who-asked-for-help-recovering-frozen-bitcoin/"},{"credibility":2,"name":"ZachXBT Says Scammer Asked For Help After Changelly Froze 5.73 BTC — CryptoAdventure","type":"news_article","url":"https://cryptoadventure.com/zachxbt-says-scammer-asked-for-help-after-changelly-froze-5-73-btc/"},{"credibility":2,"name":"ZachXBT Exposes Indian Bitcoin Crypto Mule — Cryip","type":"news_article","url":"https://cryip.co/zachxbt-exposes-indian-bitcoin-crypto-mule-frozen-scam-proceeds/"},{"credibility":1,"name":"FBI — Scammers Target Older Adult Victims","type":"regulatory","url":"https://www.fbi.gov/news/stories/scammers-target-older-adult-victims"},{"credibility":2,"name":"FBI 2025 Internet Crime Report: Elderly Targeted in Crypto Scams — KuCoin News","type":"regulatory","url":"https://www.kucoin.com/news/flash/fbi-2025-internet-crime-report-ai-fraud-rises-elderly-targeted-in-crypto-scams"},{"credibility":2,"name":"FBI Cracks Down on India-Linked Scam Network Targeting Elderly Victims — American Bazaar","type":"news_article","url":"https://americanbazaaronline.com/2026/05/21/fbi-cracks-down-on-india-linked-scam-network-targeting-victims-481254/"},{"credibility":2,"name":"FBI Shuts India Call Centers After $50M Social Security Scam — Hoodline","type":"news_article","url":"https://hoodline.com/2026/03/fake-feds-real-gold-as-fbi-busts-india-call-center-ring-bleeding-maryland-dry/"}],"summary":"A New Delhi-based social engineering fraud operation, allegedly directed by an individual known only as 'Mr. Parveen,' was publicly exposed by blockchain investigator ZachXBT on June 19, 2026. The ring is accused of stealing over $1 million from American victims — predominantly elderly individuals — since 2025, using impersonation and account-takeover tactics across U.S. cryptocurrency exchanges, Bitcoin ATMs, Cash App, and Robinhood. The operation was inadvertently uncovered when an alleged money mule, Aman Kesar (@Amankesar11), contacted ZachXBT seeking help recovering 5.73 BTC frozen at Changelly, exposing the wider theft cluster through on-chain analysis.","timeline":[{"date":"2025-03-11","event":"5.7357 BTC (approximately $475,000) frozen at Changelly during an attempted BTC-to-USDT swap linked to the Aman Kesar address cluster.","source":"CryptoTimes / ZachXBT X post","source_url":"https://www.cryptotimes.io/2026/06/19/zachxbt-connects-changelly-freeze-case-to-475k-in-elderly-scam-proceeds/"},{"date":"2025-12-23","event":"Aman Kesar files Indian police report (case #3207-P/2025) regarding the frozen Changelly funds, a self-incriminating action that later surfaces during ZachXBT's investigation.","source":"Castle Crypto / NullTX","source_url":"https://castlecrypto.gg/news/indian-crypto-scammer-unwittingly-exposes-1m-syndicate-to-on-chain-investigator/"},{"date":"2026-06-19","event":"ZachXBT publicly exposes the India-based social engineering scam ring after Aman Kesar (@Amankesar11) contacts him seeking help with the frozen 5.73 BTC. ZachXBT publishes on-chain identifiers, the alleged mule relationship to 'Mr. Parveen,' and links the cluster to over $1 million in thefts from elderly American victims.","source":"ZachXBT on X / multiple crypto news outlets","source_url":"https://x.com/zachxbt/status/2067938523986932005"},{"date":"2026-06-19","event":"Following ZachXBT's public post, the @Amankesar11 X account and all associated posts are deleted.","source":"Crypto Economy / Cryip","source_url":"https://crypto-economy.com/zachxbt-investigates-user-who-asked-for-help-recovering-frozen-bitcoin/"}]},"v":1}