Nepal Police’s Cyber Bureau is struggling to trace the masterminds of a sophisticated email scam that involved the impersonation of senior police officials to extort money from victims.

Despite the arrest of two suspects last week, bureau officials say identifying the orchestrators of the scheme remains a challenge.

According to Superintendent of Police Deepak Raj Awasthi, the spokesperson for the Cyber Bureau, the arrested individuals—Manish Kumar Mehta and Indrajit Yadav, both from Sunsari—were not the primary architects of the scam but acted as ‘money mules’.

Money mules are individuals recruited to withdraw and transfer illicit funds on behalf of the main criminals.

“This type of fraud is often part of a larger chain, so tracking the main perpetrators is very difficult,” Awasthi said. “We can’t keep suspects in remand for more than 25 days… we are working to uncover the masterminds within that time frame.”

The arrest follows the Cyber Bureau’s January 16 warning, alerting the public about an ongoing wave of digital fraud where scammers impersonated high-ranking police officials.

The emails were signed under false names, including ‘Tek Prasad Rai’ with the title ‘Deputy Inspector General of Nepal Police,’ and falsely claimed association with the Central Investigation Bureau (CIB) and the National Cyber Security Centre.

Police say the fraudulent emails continued until the recent arrests. Towards the end of January, the fraudsters expanded their tactics, sending emails in the name of the director of the National Investigation Department.

The Kathmandu District Court initially granted a seven-day remand for the two suspects but Awasthi said that an extension would be necessary due to the complexity of the case.

The major obstacle for the bureau is tracing the digital footprints left by the fraudsters, officials say. One of the fraudulent email domains was found to be hosted in Germany, and the Cyber Bureau has reached out to the hosting company for information.

However, as of now, there has been no response. In cases like these, the Cyber Bureau has to communicate with the host company or the country of the email domain. “Some companies or countries do not cooperate due to privacy policies and security concerns, so it’s challenging for us to obtain critical data,” Awasthi said.

Another complication is that the bank account used to receive extorted funds belongs to an individual residing abroad. Investigators found that suspects had been using the ATM and mobile banking services linked to this account, which yet again obscured the identity of the actual perpetrators.

The fraud case in Nepal is part of a wider trend of ‘digital arrest’ fraud, which has surged across South Asia of late. In India, similar scams led to losses amounting to an estimated 1.2 billion Indian rupees in just the first quarter of 2024.

According to Awasthi, these types of frauds often operate through sophisticated networks, with different individuals handling separate aspects of the operation—some crafting fake emails, others laundering money, and others overseeing international logistics.

Since the arrests, no new complaints regarding similar fake emails have been registered at the Cyber Bureau, Awasthi said. “But we can’t say if it’s because the money mules have been apprehended or if victims are simply not coming forward,” he said.

For the Cyber Bureau, completely dismantling such fraud networks and catching the original masterminds often results in failure. “That’s why, alongside investigation, we prioritise prevention by educating the public about scams, as the same scams often resurface in a new ‘get up’,” Awasthi said.