Case Library / Vishing (Voice Phishing) / India-Based IRS/USCIS Impersonation Call-Center Takedown (U.S. v. HGlobal et al., 61 Charged Parties)
Vishing (Voice Phishing) Documented incident

India-Based IRS/USCIS Impersonation Call-Center Takedown (U.S. v. HGlobal et al., 61 Charged Parties)

DOJ's first-of-its-kind nationwide takedown charged 61 individuals and entities, including five Ahmedabad, India call-center conglomerates, for an alleged 2012-2016 IRS/USCIS impersonation vishing scheme that threatened over 15,000 U.S. victims with arrest or deportation to obtain payments via prepaid cards and wires.

Share:

Social Engineering Examples·13 sources

What happened

On October 19, 2016, a federal grand jury in the Southern District of Texas returned a superseding indictment, unsealed October 27, 2016, charging 61 individuals and entities: 24 U.S.-based individuals, 32 India-based individuals, and 5 India-based call-center conglomerates. The charges included conspiracy, wire fraud, money laundering, false personation of a U.S. federal officer, and identity theft. The conglomerates, all based in Ahmedabad, Gujarat, allegedly ran a "telefraud" scheme in which callers impersonated IRS and USCIS officials, threatened victims across the U.S. with arrest, fines, or deportation, and directed them to pay via prepaid cards or wire transfers, which a U.S.-based network of "runners" then laundered using stolen identities. DHS-OIG, ICE Homeland Security Investigations, and TIGTA led the investigation; DOJ called it a "first-of-its-kind" nationwide takedown, arresting 20 U.S. defendants when the indictment was unsealed and seeking extradition of India-based defendants. Between 2017 and 2020, 24 U.S.-based defendants pleaded guilty and were sentenced, and HGlobal owner Hitesh Madhubhai Patel was extradited from Singapore in April 2019, pleaded guilty, and was sentenced in November 2020 to 20 years in prison.

How it worked

Five Ahmedabad, Gujarat call-center conglomerates (HGlobal; Call Mantra, d/b/a Robust Inc./Raytheon International; Worldwide Solution; Zoriion Communications Pvt. Ltd.; Sharma BPO Services) bought victim contact lists and personal identifying information from data brokers, then had agents place spoofed calls into the U.S. impersonating IRS agents (claiming back taxes owed) or USCIS/immigration officers (claiming faulty paperwork). Scripts threatened immediate arrest, imprisonment, fines, or deportation unless the victim paid on the spot. Compliant victims were walked through purchasing general-purpose reloadable (GPR)/prepaid stored-value cards (including iTunes and Reloadit-type cards) at retail stores and reading the card numbers over the phone, or wiring funds via MoneyGram/Western Union, or sending money orders/bank deposits. As soon as a victim paid, the call centers routed the funds to a parallel network of U.S.-based "runners" (crews in Illinois, Arizona, Texas, Alabama, and elsewhere) who immediately registered fresh prepaid cards using stolen PII from thousands of separate identity-theft victims, then converted the loaded cards into money orders deposited into bank accounts, or picked up wires under false names using fraudulent IDs, laundering the money before banks or victims could reverse the transaction. The five conglomerates cooperated with each other, sharing scripts, victim lead lists, and payment-processing infrastructure. The conspiracy ran from on or about January 2012/2013 through the October 2016 indictment.

The lure and the tell

Lure: an incoming call from a spoofed number that appeared to be from the IRS or a federal immigration call center, with a caller claiming to be a federal officer who cited the victim's real personal details (from purchased data-broker lead lists) and asserted the victim owed unpaid back taxes or had defective immigration paperwork. Tell: the U.S. government never initiates enforcement contact by phone with threats of immediate arrest/deportation, never demands payment via prepaid gift cards (iTunes, Reloadit, etc.) read over the phone, and never demands a single wire transfer or money order to resolve a "debt" under threat of same-day arrest; the artificial urgency and card-payment channel were the signature (and now widely publicized) tells of the scam.

Outcome

The October 19, 2016 superseding indictment, unsealed October 27, charged 61 individuals and entities: 24 U.S.-based individuals, 32 India-based individuals, and 5 India-based call-center conglomerates. Twenty U.S. defendants were arrested when the indictment was unsealed. Over the following years, 24 U.S.-based defendants pleaded guilty and were sentenced in the Southern District of Texas, with related proceedings in the District of Arizona and Northern District of Georgia. Separately, HGlobal owner Hitesh Madhubhai Patel fled India for Singapore in 2018, was apprehended there on a U.S. provisional arrest warrant on September 21, 2018, and was extradited from Singapore to the United States on April 18, 2019. He pleaded guilty in January 2020 and was sentenced on November 30, 2020, to 20 years in prison. Charges remained pending against other India-based defendants as of the last cited public updates.

Why it matters

This remains one of the largest and most thoroughly documented vishing/government-impersonation prosecutions in U.S. history and a template for how such scams are dismantled: it shows the full anatomy of a transnational telefraud operation (offshore call centers, data-broker-sourced victim lists, live scripted authority-impersonation calls, and a domestic runner network for near-instant laundering via prepaid cards and wires) and demonstrates that even offshore-based conspirators can face extradition and lengthy U.S. sentences. It is also a clear case study in the gap between headline-grabbing reported loss figures ("hundreds of millions," "$300M+") and lower, independently tracked regulator figures (TIGTA's ~$60-73M), a distinction useful for teaching how to read fraud-loss claims critically. The scam's core mechanics (spoofed caller ID, IRS/immigration threats, demand for gift-card/wire payment) remain the exact pattern still used in ongoing IRS-impersonation and government-impersonation vishing scams today.

Defenses

DOJ/DHS-OIG/HSI/TIGTA/IRS-CI joint multi-year investigation and coordinated nationwide arrest operation; extradition requests to India for numerous India-based defendants (separate from Hitesh Madhubhai Patel's Singapore extradition, see outcome); public-awareness messaging at the announcement press conference ("if you get this call, do not pay, it is not the U.S. government calling you"); TIGTA and IRS ongoing consumer-facing warnings about IRS-impersonation phone scams (IRS never initiates contact by threatening phone call demanding immediate payment via gift/prepaid cards or wire transfer); FTC/consumer guidance to hang up, verify independently via official agency phone numbers, and never pay government debts with gift cards or wires; card issuers and MoneyGram/Western Union AML-suspicious-activity monitoring cited by investigators as part of how the money trail was traced.

Sources
Cite this case

Social Engineering Examples. “India-Based IRS/USCIS Impersonation Call-Center Takedown (U.S. v. HGlobal et al., 61 Charged Parties)”. Accessed 3 November 2026. https://socialengineeringexamples.com/india-irs-uscis-vishing-call-center-takedown-2016

Attack Chain & Defense
1Reconnaissance and victim-list acquisition
What happened

per the DOJ indictment and defendants' own plea admissions, the Ahmedabad call-center conglomerates bought victim contact lists and personal identifying information (PII) from commercial data brokers and other sources, giving callers real names, addresses, and other personal details to cite on the call and sound authoritative.

The control that would have stopped it

consumer exposure to data-broker lead lists is very hard for an individual to control at the source; the realistic control is downstream, teaching that a caller knowing your name or address is not proof of legitimacy, rather than trying to eliminate the lead-list market itself.

2Telephony infrastructure and caller-ID spoofing setup
What happened

call centers used commercial telephony/VOIP infrastructure and caller-ID spoofing so calls appeared to originate from legitimate U.S. government numbers, consistent with the spoofing pattern TIGTA documented across IRS-impersonation scams of this era generally.

The control that would have stopped it

telecom carriers' caller-ID authentication frameworks (e.g. STIR/SHAKEN-style call-authentication standards) and consumer call-blocking/scam-labeling apps target spoofed-number delivery directly, and are the nearest practical control since the spoofing technique itself sits largely outside any individual victim's reach.

3Scripted authority-impersonation contact
What happened

agents, following prepared call scripts (per indictment and plea admissions), placed calls impersonating IRS agents (claiming back taxes owed) or USCIS/immigration officers (claiming defective paperwork), often opening with the victim's real personal details from the purchased lead lists to establish false credibility.

The control that would have stopped it

the public-awareness messaging DOJ, TIGTA, and IRS repeated at and after the takedown, that the U.S. government does not initiate enforcement contact by unsolicited phone call, is the direct countermeasure; hanging up and calling the agency back on its official published number, rather than trusting the inbound caller, neutralizes this stage.

4Threat-based pretext and urgency escalation
What happened

scripts threatened immediate arrest, imprisonment, fines, or deportation unless the victim paid before the call ended, a documented pattern across the indictment and TIGTA's consumer warnings, designed to prevent the victim from pausing to verify independently.

The control that would have stopped it

recognizing "pay immediately or be arrested" as a scam hallmark (per TIGTA/FTC guidance) and simply ending the call to verify independently breaks the artificial time pressure this stage depends on to prevent victims from thinking it through.

5Payment-channel instruction and extraction
What happened

compliant victims were walked through purchasing GPR/prepaid stored-value cards (including iTunes and Reloadit-type cards) and reading the card numbers over the phone, or wiring funds via MoneyGram/Western Union, or sending money orders/bank deposits.

The control that would have stopped it

the single most emphasized public warning in TIGTA/FTC materials, that no legitimate government agency demands payment via prepaid gift cards or a one-time wire transfer, targets this exact stage; several retailers have since added point-of-sale warnings when customers buy large amounts of gift cards for this reason.

6Stage 6
What happened

Rapid laundering via runner network and stolen-identity card registration: upon payment, call centers routed funds same-day to a U.S.-based runner network, who immediately registered fresh prepaid cards using stolen PII from separate identity-theft victims, then converted the loaded cards into money orders deposited into bank accounts or picked up wires under false identities, moving the money before it could be traced or reversed.

The control that would have stopped it

this stage is largely invisible to the original victim and hardest to interdict in real time; the realistic control sits with card issuers' and MoneyGram/Western Union's anti-money-laundering and suspicious-activity monitoring, which investigators credited with helping trace the money trail after the fact.

7Profit distribution and network sustainment (objective completion)
What happened

laundered proceeds were split between the India-based call-center operators and the U.S.-based runner crews (who kept a fee or percentage per transaction), funding continued operations that scaled the scheme to over 15,000 direct victims across a roughly four-year run before the 2016 takedown.

The control that would have stopped it

no consumer-facing control reaches this final stage; the terminal countermeasure is the coordinated multi-agency (DHS-OIG/ICE-HSI/TIGTA/DOJ) financial and telecom-record investigation and prosecution that ultimately identified, charged, and dismantled the network, since sustained laundering requires the conspiracy to keep operating undetected.

Quick Facts
Victim
Approximately 15,000+ U.S. residents deceived into paying the scam directly
(elderly and immigrant populations disproportionately targeted), plus tens of thousands of separate identity-theft victims whose stolen PII was used to register the laundering prepaid cards
Location
Call centers in Ahmedabad, Gujarat, India; U.S. runner networks in Illinois, Arizona, Texas, Alabama, Georgia, California, Florida, New Jersey, Indiana; prosecuted in U.S. District Court, Southern District of Texas
(Houston Division), with related sentencings in the District of Arizona and Northern District of Georgia
Date
2016-10-19
(grand jury returns superseding indictment; unsealed 2016-10-27); underlying scheme ran 2012/2013-2016; sentencings 2018-01-29 through 2020-11-30
Impact
ICE's October 2016 release attributed hundreds of millions of dollars in alleged losses to the organization and reported over 15,000 known U.S. victims and upwards of 50,000 identities allegedly misappropriated to register prepaid cards.
BasisallegedHundreds of millions is an allegation reported in ICE's release; TIGTA's tracked victim-reported totals are much lower
These were allegations, not judicial loss findings. A TIGTA report separately recorded approximately 12,027 victims reporting more than $60.7 million in losses as of September 30, 2017.
Status
Documented incident
Case Type
Real-World Incident
Sector
Consumer / General Public, Financial Services & Insurance, Government & Public Sector
Threat Actor
Organized Crime
Explore more

Related Cases

Browse by what this case has in common with others in the library.