The app paid for watching ads. Then one Wednesday in October, it stopped paying anyone.

Banshan was 34, a clerk in the administrative office of a school on the outskirts of Shillong, and he found out about the app the way most people in his neighborhood found out about it. His cousin showed him a screen.

The screen was green at the top, with a small balance counter that moved while they watched. The counter moved in rupees. Small rupees. The kind that, by themselves, were not worth talking about. But the counter moved every time a short advertisement video played, and his cousin had been letting it play for two weeks, and the number on the screen was no longer small.

His cousin had withdrawn money. Actual money. Into his actual bank account. He showed Banshan the SMS. The SMS was real.

This is the moment to picture. A kitchen in Shillong in the summer of 2022. Two cousins. A phone. A balance that goes up while you watch it. Banshan asked the question anyone would ask. He asked how.

The how was an app called Global Media. According to the Enforcement Directorate's findings, it was marketed as an online advertising platform that paid users for watching promotional videos. You signed up. You watched. You got paid. If you wanted to be paid more, you upgraded to a VIP membership plan. Higher plans paid higher daily returns. You could also earn commissions for bringing in other users. The pitch was passive income. The mechanism, the ED has since established, was a Ponzi.

Define that word the way Elena always defines it, because the word does work most readers do not let it do. A Ponzi scheme is not a bad investment. It is not a business that underperforms. It is a structure in which the money paid out to early users is the money paid in by later users. Nothing is produced. Nothing is earned. The advertisements, in this case, were the costume. The costume was good. It was good enough that Banshan's cousin had been paid, and Banshan's cousin was not lying.

That is the part most accounts of these cases get wrong. The early payouts are not a trick. They are real money. They are the fuel.

II. The Upgrade

Banshan started small. Most people did. He watched the videos. He got paid. The amount that arrived in his bank account was small but it was not zero, and zero is the number a fraud cannot survive in the early months.

Then came the upgrade.

The upgrade was where the app stopped being a curiosity and started being an investment. To unlock higher daily returns, you sent the app money. You could send it through UPI, the instant payment rail Indians use the way Americans use a debit card. You could send it through a bank transfer. Or you could send it through USDT.

USDT is Tether. It is a cryptocurrency token designed to hold a value of one US dollar. It moves on blockchains. In this case, according to the ED, a portion of it moved on TRON, a blockchain favored for low fees and fast transfers. About ₹2.45 crore (about $295K USD) of the total fraud proceeds came in this way, routed to user accounts on a cryptocurrency exchange based outside India.

This matters because of where the trail goes when you follow it. UPI leaves a record inside Indian banks. Bank transfers leave a record inside Indian banks. USDT on TRON leaves a record on a public blockchain, but the wallet on the other end belongs to an exchange domiciled somewhere the ED has to ask permission to reach.

Banshan did not know any of this. Banshan was told by a Telegram group administrator, whose phone number had a country code he did not recognize, how to install a wallet, how to buy USDT, how to send it. The administrator was patient. The administrator was helpful. The administrator's number, according to the ED's findings, was registered in Cambodia. Other administrators used numbers registered in Malaysia.

The Telegram channel was where the app lived in public. The thumbnails got the screenshots of payouts. The pinned messages got the upgrade tiers. The voice notes got the success stories. The footnote, if there had been one, would have said that the backend Gmail accounts running the app's operations were registered with a "Terms of service country" field set to Cambodia.

There was no footnote. There never is.

III. The Window

The app opened on June 3, 2022. It shut down on October 12, 2022.

Four months and nine days.

Read that slowly. The entire operational life of Global Media was the length of a school term. The ED has established that during this window, the operators collected approximately ₹45.33 crore (about $5.4M USD) in proceeds of crime.

The window is the tell. It is not a flaw in the design. It is the design. A Ponzi works until the money flowing in cannot cover the money owed out. The operator's job is to leave before that moment arrives. The earlier the operator leaves, the more of the pool he keeps. The later he leaves, the more he has to pay out before he goes. Four months is fast. Four months means the people running this knew what they were running.

For Banshan, the window looked like this. He upgraded in late August. He sent money he had been saving toward a down payment on a small piece of land. He sent it in pieces, because the larger VIP tiers required larger amounts, and he wanted to test each rung before climbing to the next. The first withdrawals after his upgrades worked. They always do.

He told two friends at the school. One of them joined. He told an uncle. The uncle joined.

This is the part that does the quiet damage. The Ponzi does not just take your money. It uses you to take other people's money. The referral commission is not a side feature. It is the recruitment engine. By the time the app shuts down, the mark is not only a victim. The mark is the person who, in good faith, brought the other victims in.

IV. October 12

The morning the app went dark was a Wednesday. Banshan opened the app on his phone the way he opened it every morning, before his first cup of tea, because the daily ad cycle reset at a particular hour and he liked to clear it before work.

The app opened. The balance was there. The withdrawal button did not respond.

He refreshed. He logged out and logged back in. He checked his connection. He went to the Telegram channel.

The Telegram channel was the place this should be reconstructed honestly. Nobody outside the operation has published a complete archive of what the channel looked like in its final hours. The ED's filings describe the channel's existence and its administrators' foreign numbers. They do not describe the last message. What is consistent with the pattern, and with what victims in similar Indian app-Ponzi cases have later told police, is this: the administrators went quiet, the channel was either locked or deleted, and the messages from users asking what was happening either disappeared or stopped getting answered.

Banshan called his cousin. His cousin had also tried to withdraw. His cousin's button also did not work. The two of them sat with their phones in their hands and did the only thing left to do, which was to keep refreshing a screen that was not going to change.

That part may be the saddest. The refresh. The hope inside the refresh.

V. What the ED Found, and What It Did Not

The Enforcement Directorate's Shillong Sub-Zonal Office opened its investigation under the Prevention of Money Laundering Act, 2002, after an FIR was filed at Madanriting Police Station in East Khasi Hills district. The PMLA is the law India uses to chase the money after a predicate crime has been alleged. It lets the ED attach property that it believes represents proceeds of crime, pending adjudication.

On May 9, 2026, the ED announced a provisional attachment of movable properties worth ₹1.06 crore (about $127K USD).

Place the two numbers next to each other.

Proceeds of crime, as established by the ED's investigation: approximately ₹45.33 crore (about $5.4M USD).

Attached so far: ₹1.06 crore (about $127K USD).

That is roughly two and a third percent.

The remaining ninety-seven and a half percent moved, according to the ED's findings, through layers of bank accounts, merchant IDs, payment gateway accounts described in the record as "mule entities," and cryptocurrency wallets. Some of it crossed a border. Some of it crossed a blockchain. Some of it, almost certainly, was paid back out to early users like Banshan's cousin, who is not a beneficiary in any legal sense and who lost his own money on his own upgrade in September.

The operators are unnamed in the public record. Their phone numbers were Cambodian and Malaysian. Their email backend was Cambodian. Whether they are in any of those places now is a question the ED has not publicly answered.

VI. The Machine Under the App

Strip the app off and what remains is a structure older than smartphones.

A promise of returns disconnected from any productive activity. A short operational window. Early payouts that work, because they are funded by later deposits. A recruitment incentive that turns marks into salespeople. A payment system that crosses jurisdictions faster than enforcement can follow. An exit before the math catches up.

The advertisements were the costume. The Telegram channel was the storefront. The VIP tiers were the funnel. The USDT on TRON was the door.

Banshan does not have a way to think about this in those terms. He has a way to think about it that is shorter. He saved money for years. He sent that money to an app his cousin showed him. The app paid him for a while. Then it stopped, and the people who ran it were never people he could find.

The ED's attachment will move through the legal process. Allegation is not adjudication. Recovery, in cases shaped like this one, is rarely full and rarely fast. The piece of land Banshan was saving toward is still there. The savings are not.

The next app will not be called Global Media. It will be called something else. It will be on a different channel. The country codes will be different. The token might not be USDT and the chain might not be TRON. The screen, though. The screen will look exactly the same.

A green balance at the top. A number that moves while you watch.