Fraud through hacking in online trading in commodities on MCX Exchange

The Police in its effort to crackdown on clandestine underground networks involved in fraud on the online trading network of various commodity brokers using User-Id and Password of their clients has succeeded in exposing a gang involved in such activities, and arresting the mastermind in the process.

The brief facts of the case are that Shri J.U. Singh, Director of Singh Commodity Pvt. Ltd. had made a complaint against unknown person for doing fraudulent trades in commodity future after hacking their computer. The complainant is the member of Multi Commodity Exchange of India Ltd. (MCX) and authorized to trade in commodity futures. On 20/09/2005, between 22.541 Hrs and 23.30 Hrs, some fraudulent trades were done in commodity futures after hacking the computer system of the complainant and thereby compromising the username and password of their account. This resulted in a loss of more than Rs 15 lacs to the complainant. At the receipt of the complaint a case FIR u/s 420/120-B IPC & 66 IT Act was registered by Police.

During investigation it was revealed that the complainant was a member of Multi Commodity Exchange (MCX) which traded in several commodities like metals, non-metals, petroleum products etc. online through a trading software called ODIN (open dealer integrated network). Members could connect to the exchange through either a VSAT / leased line / internet to the exchange. Once connected, the user was authenticated on basis of user id , member id and password.

Normally, in stock exchanges members were normally permitted to trade only through VSAT or leased line. For internet access the member had to maintain his own server which was connected to the stock exchange mostly through VSAT. The user was then authenticated on such a web server where firewall and other security measures had been implemented.

However, it was revealed during the investigation that, in the case of commodity exchanges , specially MCX the same user id which was logged in on VSAT could also be logged in through the internet also , a feature which the exchange had permitted as trading took place till 11.30 p.m. This vulnerability was found to be the root cause of hacking and subsequent misuse. The misused user id through which the fraudulent trades took place, was an id which was normally logged in by the complainants through VSAT but it was found that on all the occasions of apparent fraud , the accused person had logged in through the internet.

The details of the IP Address were collected from Reliance Infocomm, which revealed that the dynamic IP Address used was by the subscriber of the mobile number 9316973639 having name and address as Rajinder Kaur, 273-B, , Amritsar, Punjab. The call details of the number 93169736XX was obtained. A scrutiny of the details reveal that it is being used by a client of the complainant by the name of Karam Deep Singh who was based in Amritsar, Punjab.

Details of the counter parties for the transactions (counter parties were the associates of the accused Karam Deep to whom he had sold the commodities masquerading as the complainant) were collected and analyzed. It was revealed that the M/s Fortis Comdex was one of the brokers for the counter party.

The details of the IP Address from which the other ‘counter-patry’clients, namely coaccused Rajan Seth and Sushil Gupta had logged on the network to execute the fraudulent transaction were collected from M/s Fortis Comdex Ltd. An analysis of this information, revealed that the transaction in the name of Rajan Seth as well as Sushil Gupta had been done at the same time using the same internet connection through mobile No.93169736XX. The address of the Rajender Kaur, subscriber of the mobile no. 93169736XX was found to be fake. The same was being used by Karam Deep Singh.

Thus, the investigation was able to establish that the transactions on MCX had been done by using the stolen User ID and Password of the complainant, from Amritsar, Punjab thereby causing a loss of over Rs. 15 lacs to the complainant. During the course of investigation a special team of police conducted raids and apprehended the mastermind Karam Deep Singh.

The accused Karam Deep Singh age 30 years, Amritsar, Punjab disclosed that he alongwith co-accused Rajiv Seth and Sushil Gupta had executed these fraudulent transaction by logging on the network of MCX and M/s Fortis Comdex Ltd. and transferred the losses to the complainant and corresponding gain to themselves.

The accused KaramDeep Singh was running a business of Foreign Exchange and Commodities by the name of and had opened four different accounts, in different names through five different brokers which he used for carrying out transactions on MCX. He had thus created a network for transactions within MCX itself, to hide and bury his clandestine activities. The accounts of the accused persons have been freezed and Rs.8 lacs of the embezzled amount has been recovered.