Ahmedabad businessman duped into downloading malicious ‘banking app’ to cancel pension card offer, loses Rs 9.22 lakh

Ahmedabad: A phone call offering a “senior citizen pension card” ended up costing a 63-year-old businessman Rs 9.22 lakh after cybercrooks allegedly tricked him into installing a malicious mobile application that gave them access to his banking details.

The victim, a Vasna resident who runs an airconditioner business near Gujarat University, approached the Cybercrime police after discovering that fraudsters had siphoned money from his bank account by posing as representatives of a private bank.

According to the complaint, the businessman received a call on June 1 from a person claiming to be associated with a private bank. The caller asked whether he was interested in obtaining a senior citizen pension card. When the businessman declined, the caller allegedly warned him to cancel the card offer formally or he could face issues with his bank account and fixed deposits.

As part of the cancellation process, the caller allegedly sent the victim a WhatsApp message from another mobile number, which had the bank’s logo as its display photo. The message contained an APK file with the bank’s name and “pension card” in the name.

Believing the communication to be genuine, the businessman allegedly downloaded the application and joined a video call with the fraudster, who guided him through the installation process. During the interaction, he was allegedly asked to provide personal information, including Aadhaar and PAN card details.

The next day, multiple SMS alerts began arriving on his phone regarding Aadhaar updates, debit card PIN changes, and netbanking activities. Alarmed, he checked his bank account and found that two fixed deposits worth more than Rs 8.9 lakh had been prematurely broken, and the amount transferred to his savings account.

Police said the money was then moved through a series of transactions to multiple bank accounts and payment gateways. The total loss was calculated at Rs 9.22 lakh.

The victim immediately contacted the national cybercrime helpline 1930 before filing a formal complaint with Cybercrime police.

Investigators suspect the APK file contained malware that enabled the fraudsters to remotely access the victim’s mobile phone, capture banking credentials and intercept one-time passwords. A case has been registered against unidentified persons for cheating, identity theft and unauthorised access to digital systems. Police have launched an investigation to trace the beneficiaries of the transactions.