New Delhi: Until recently, most of us thought fake currency was either a dark web problem or a back-alley printer job. But a new investigation by CloudSEK flips that assumption on its head. In a six-month deep dive, the cybersecurity firm’s STRIKE team uncovered a full-blown fake note syndicate running wide open on social media, with transactions worth ₹17.5 crore.
And this wasn’t hidden in some encrypted Telegram channel or dark forum. It was happening right in front of our eyes, on Facebook posts, Instagram reels, and even paid ads. CloudSEK’s report shows how criminals have turned social media into a showroom for counterfeit notes, complete with demonstrations, video calls, and even “customer reviews.”
Source: CloudSek
Counterfeit notes on your feed
Between January and June, CloudSEK’s XVigil platform detected over 4,500 posts pushing fake Indian currency. More than 750 Facebook and Instagram accounts were directly involved in selling these notes. These sellers even used Meta Ads to reach more people. The team flagged 410 unique phone numbers linked to the operation.
They weren’t even subtle. Hashtags like #A1notes and codewords like “second currency” were used to avoid detection, though poorly. One click, and you could find videos where sellers flashed wads of fake ₹500 and ₹2,000 notes, sometimes scrawled with their WhatsApp numbers to build “trust.”
Source: CloudSek
“We didn’t just find content, we identified the key perpetrators,” said Sourajeet Majumder, a security researcher at CloudSEK. The team didn’t stop at content detection. They stitched together facial recognition, GPS data, and open-source intelligence to name actual individuals running the racket. The suspects operated from areas like Jamade village in Dhule (Maharashtra) and parts of Pune.
How did this work?
The syndicate’s fake note playbook sounds like something straight out of a crime thriller, except it’s real:
- Promotion: Facebook groups, reels, Meta Ads, and even YouTube Shorts were used for outreach.
- Engagement: Sellers chatted over WhatsApp, sent proof images, and even did live video calls to show stacks of fake currency.
- Production: They used industrial-grade printers, Adobe Photoshop, and watermark paper to mimic the Mahatma Gandhi series notes.
- Payments: Buyers paid in cash, sometimes meeting in person, sometimes using couriers. Several transactions turned into scams, where buyers were either robbed or received nothing at all.
- Evading detection: The team used burner phones, fake identities, and social media aliases like Vivek Kumar, Karan Pawar, and Sachin Deeva.
Source: CloudSek
Where the money leads
The ₹17.5 crore value is only what CloudSEK could trace between January and June 2025. Given how open the operation was, it’s possible the real numbers are even higher. The fear now is not just the money, but the ripple effects.
The report warns that flooding the market with such counterfeit notes could lead to inflation, hurt small businesses, and even damage national security. There’s also a risk that organised crime networks could be behind this, with links possibly stretching beyond India’s borders.
The bigger question though, how did this go unnoticed for so long? The ease with which scammers weaponised Facebook and Instagram highlights a growing loophole. While these platforms crack down hard on hate speech and fake news, financial fraud often slips through.