What the fuck is going on?
- Rakesh. - Yes sir.
Who did we give 730 million from the account?
- I don't know, sir. - What do you mean you don't know?
Bloody check it.
Idiot.
I checked the case details, sir.
Rather than someone's cleverness,
My-Stocks lost 730 million because of their own stupidity.
- I know that too. - So then?
So, I can't tell that to ma'am.
We'll crack the case if it's possible, sir.
Crack the impossible, Ashutosh.
Your unit was formed because of her.
Just reminding you.
Your grandpa wasn't keeping well.
And your uncle tricked him into giving his thumb impression.
That will be the foundation of our case.
- Okay. - Here's what you do.
Get your mom's marriage certificate,
and your birth certificate.
- Okay. - One minute.
- Yes, sir. - Get there quickly.
- Where? - At the director's office.
- Now? - Now!
Okay, sir.
I'll have the remaining documents sent to you.
- Okay. - Thank you.
Ashutosh, what's the update on their case?
Frankly speaking, ma'am,
I think it's an inside job.
Oh, really?
The previous team said it was done through hacking the emails.
This gentleman here says it's an insider job.
Is this an investigation or a joke?
Amit.
Your email account was used to send four emails to the Indian Orient Bank,
requesting transfer of funds.
190 million. 170 million.
Again 190 million, and 180 million.
But I didn't send these emails.
How did the bank transfer the money without authentication?
For convenience's sake,
we had stopped authentication for up to 200 million.
Which the hacker knew.
And that's why the money transferred each time was less than 200 million.
But if the money was debited, you must have received alerts.
Sir, the notifications would get deleted
from Mr Piyush's email as soon as they were sent.
His account was hacked.
Ma'am, when the team asked for Mr Piyush's laptop for investigation,
his IT head Mr Vishal formatted the machine.
Why?
Actually, ma'am, the laptop contained sensitive company data.
And we couldn't risk it getting leaked.
And where is the laptop now?
Tell us.
Aarti ma'am from HR was having issues with her laptop.
So I gave it to her.
And, ma'am, finally when we retrieved the laptop from Aarti madam,
there was no trace of evidence left.
For one month, I kept getting constant emails from the bank.
What about that?
Those constant emails were not from the bank.
They were from the hacker.
Those were spoofed emails.
And what are these 'spoofed' emails?
Explain that to madam, not me.
Ma'am, spoofed emails are like original emails.
The receiver can't tell whether it's been sent by hackers or the bank.
Then how did you find out?
Because the bank's server is in India,
the spoofed emails originated from Germany.
I see.
You found out all that,
but couldn't find out where the money was transferred.
The money was transferred to an anonymous account in the Netherlands.
The majority of money was converted to Bitcoins,
which is still parked in a wallet.
And the rest?
100 gift cards were bought of 1000 dollar denomination.
And, ma'am, they must have been sold on the dark web by now.
It's like this,
the court hearing is in two days.
If it's proved it was our mistake,
we won't get a single penny back.
Elections are around the corner.
We must bring the money back.
You made such tall claims to get the unit started.
Find a way then.
There is a way.
Mr Piyush received spoofed emails.
Meaning the bank's server is not DMARC compliant.
What is DMARC compliance?
DMARC compliance is an email authentication protocol.
If the bank's server was DMARC compliant,
then these spoofed emails would have never been delivered to Mr Piyush.
But how will we prove it?
By spoofing the bank's email.
Email spoofing.
Every email server has an in-built feature.
"On behalf of."
The feature exists because if a server is overloaded,
emails can be sent through a backup server.
On behalf of...the original server.
The attacker uses this vulnerability,
to add his server as the backup server in the DNS server.
And sends email through this server.
The bank is ready for out-of-court settlement.
Also willing to pay 50% back.
What should I do?
- Did you get it? - Refresh it.
Got it.
The bank's email has been spoofed.
So the bank is liable.
The choice is yours.
Do you want half your money back or all of it?
Really?
Your honour, Piyush's email was hacked.
The bank received emails from Piyush's account.
So My-Stocks is at fault here, not the bank.
Your honour, if my client hadn't been receiving constant emails from the bank,
then My-Stocks could have figured out the unauthorised transactions.
They could have averted any further damage.
But, your honour, the bank didn't send these emails.
Exactly, your honour.
That is my point, sir.
Those emails were not sent by the bank.
But they were sent from the bank's ID.
These were spoofed emails.
And the bank does business on trust.
If someone uses the bank's ID to send me an email,
I will trust him.
And these emails were spoofed, your honour,
because the bank's server is not DMARC compliant.
So in this case, it's the bank's liability and not my client.
Can you spoof the bank's email?
Absolutely.
Okay, do it and show me.
Send a spoof mail to my email from the bank's ID.
How long do you need?
Around two hours.
I give you three hours.
This session will resume after three hours.
We have only 15 minutes, Shakti. What's wrong?
Can't alter the DNS records, sir.
How did you do it yesterday?
Something has changed.
We need a little more time, your honour.
You asked for two hours,
I gave you three.
Either the email can be spoofed or not.
We couldn't do it, sir.
Since it couldn't be proved that the bank's email ID could be hacked,
my decision is...
The fraud was committed due to My-Stocks carelessness.
Therefore, the Indian Orient Bank is not liable to refund any money to My-Stocks.
Case closed.
What? Sir. Just because we couldn't crack one case,
they are shutting down the entire task force.
Sir, then the entire police department should be shut down.
I am sorry, Ashutosh.
Director ma'am is fuming.
You know I am helpless.
You know how difficult it was to start this task force.
You have to do something.
Believe me...
there is nothing I can do.
Get me two days, sir.
Please. Please hold her off for two days.
Sorry, guys. It's not your fault.
It was mine. When Piyush rejected the bank's deal,
they knew we could spoof the bank's email.
That's why those rascals,
got the DMARC compliance before the court hearing.
I should have told him to take the deal.
We have only two days to save this unit.
Sir...
When I failed my IAS exams three times,
I slipped into depression.
This unit helped me come out of it.
Sir...
selling 100 boxes of incense sticks is not as much fun,
as solving every detail of the case.
Not this time.
What?
Our unit will go on, sir.
Yes, sir. It will go on.
It will go on.
Let's get back to work.
Looking at the pattern of the money transfer,
someone from the company is involved.
CEO, IT Head
or Piyush himself.
It can be anyone.
But why would Piyush do something like this?
First, steal the money,
then claim a refund from the bank. Double the money.
Bitcoins are still parked in that wallet.
All the gift cards were sold on the dark web.
I can't track the seller.
But you can track the buyers.
Where were you?
Oh, come on. I am always around you.
Don't be a smart ass.
Hey... what's wrong?
I think we should track the gift card buyers.
But why?
We'll know if there is some kind of a connection.
How do you know there will be a connection?
I don't know, sir. Just an intuition.
The buyers who used the gift cards were random people.
From different countries.
How can one of them be the thief?
Then an idea hit me.
We must check their social media handles.
What the hell?
What...
It's him.
Juhi.
She was human resource manager in a multinational
and now she was sourcing for another husband.
She got lucky with Ashu sir.
But maybe she didn't know that.
Why do we always meet here?
There is no network here.
Next time you can pick a place.
Is something wrong?
My unit might shut down today.
What happened?
Nothing.
His phone is still unreachable.
Are you sure he will be here?
Hey...there he is.
Who is he with?
This is where sir meets with his date from 'Dobarashaadi.com'
Dobarashaadi.com?
When a second girl enters the picture,
it makes a man more interesting.
Listen. You didn't hear it from me.
When will you meet Amey?
Actually, I am busy this week--
Found him.
Who?
The one we were looking for, sir.
Svetlana Ivanov.
Works as an escort in Amsterdam.
Several Indians comment on her post, but...
I am more interested in one guy's comments.
Sir, when I worked on the Indian Orient Bank's IT security team,
I learned their emails are not DMARC compliant.
I thought what one can do with spoofed emails.
I got replies from four different companies,
whose emails were not two-factor authenticated.
I sent my resume to them...
and My-Stocks hired me.
How did you hack Piyush's email?
It wasn't easy, sir.
Took me a year to win his trust.
And...
while updating his laptop one day,
I found his password.
- I'll kill you... - Sir...sir...
- Sorry. - Bastard.
How do you know that Russian girl?
Sir, I love her.
We planned to settle down in Trinidad and Tobago.
She didn't have money for air tickets,
so I sent her a travel gift card.
And I was supposed to meet her in Amsterdam today.
She must be waiting for me.
Oh please...
That's where you slipped up.
We found the Russian girl through the gift card.
And found you from her social media comments.
Actually, there's a Trinidad and Tobago in Arthur Road Jail as well.
Free citizenship. Free food.
Free stay.
Lifetime vacation.
On behalf of the minister.
AC worth 70,000 for recovering 700 million.
Not a bad deal.
Sir, does this mean our unit is safe?
Here are some new cases.
Let's get back to work.
This was my home.
And no scumbag...
could throw me out.
- I'm sorry, Sir. - Saying sorry doesn't change anything.
One coffee is fine.
My email has been hacked.
And I feel something needs to be done.
Do you suspect anyone?
He's a tough nut, sir, this Vikram.
We'll disrupt this world together.
So be it.
These fake Al-Jahaan people had trapped Vikram.
There's not much we can do if Vikram doesn't trust us.
We have no proof.
Track his location.
He's moving out of the city, sir.
They disappeared from the map, sir.
What do you mean?