A mystery built around the date 25 August spread across Indian Instagram, and the payoff was on Telegram: pay ₹500, see the reveal.

Since then the internet has been quoting a total. The trouble is that it is quoting several.

Three numbers, one event

The figures circulating for the same alleged scheme are ₹3 crore, ₹8.3 crore and ₹10 crore.

Those are not rounding differences. The largest is more than three times the smallest, and every one of them is presented as fact.

The multiplication does not hold

The most-shared framing pairs two specific inputs: 1.66 lakh people, at ₹500 each.

Multiply them. 1,66,000 × 500 = ₹8.3 crore.

So the videos quoting ₹8.3 crore are at least internally consistent with their own inputs. The ones quoting ₹3 crore alongside the same 1.66 lakh figure are not — ₹3 crore at ₹500 a head implies about 60,000 people, not 1.66 lakh.

That is a headline disagreeing with its own subtitle, and it is checkable on a phone in five seconds.

Where the participant count comes from

This is the weaker link, and it deserves saying plainly.

Nobody has published a payment record. The 1.66 lakh figure appears to derive from a channel's member count, and a member count is not a payment count. People join to look. People join because a video told them to. People join to screenshot it and make their own video.

Treating subscribers as buyers assumes a conversion rate of 100%, which no product in history has achieved.

What we cannot confirm

All of it, essentially.

There is no police statement. No cyber cell has announced a case. No victim has been named. No arrest has been reported. No mainstream Indian outlet has covered it. Every figure in circulation traces back to user-generated video, and several of those videos cite each other.

We are not saying nothing happened. Something plainly spread, and the mechanism described — mystery, urgency, a small fee for the reveal — is real and works. We are saying that the amount, the participant count and the outcome are all unverified, and that the confidence with which they are being repeated is not supported by anything published.

The mechanism needs no malware

Worth being clear about what this is, if it is what it appears to be.

There is no exploit here. No malicious app, no credential theft, no SEO poisoning, no side-loaded implant. Somebody manufactured curiosity, attached a date to it, moved the audience to a platform with no refunds, and charged a sum small enough that nobody complains to the police.

₹500 is the design. It is large enough to be worth collecting at scale and small enough that the loss is not worth a complaint — which is also why a case may never be registered, and why the true total may never be known by anyone except the operator.

The warning videos are part of the distribution

This is the uncomfortable bit.

A video that says "1.66 lakh people paid ₹500, do not fall for it" is an advertisement with a disclaimer attached. It certifies that the thing is popular, tells the audience where it happened, and supplies a number that makes it sound like everyone else already went.

Some of those videos are made by people genuinely warning others. The effect on reach is the same either way, and this article is not exempt from that — which is why it contains no channel name, no link and no instruction on where to find any of it.

What to do

  • Never pay for a reveal. The content behind a paid mystery is worth what it cost to produce, which is nothing.
  • If you paid, do not chase it. The second wave of these is a "recovery" service that charges again.
  • Report it anyway at cybercrime.gov.in or 1930, even for ₹500. Small unreported losses are exactly why the pattern keeps working.
  • Check the arithmetic before resharing a number. Count times price equals total. When it does not, neither figure is reliable.
  • Assume a member count is not a customer count. This is the single most repeated error in viral scam reporting.

What is not established

  • Whether any of the totals are accurate. None is sourced.
  • How many people actually paid, as distinct from joined.
  • Who ran it, and whether it was one operator or several copying each other.
  • Whether any complaint has been registered anywhere. None reported.
  • What the "reveal" even was. No consistent account exists.