Follow us on Google News
A Malad-based businessman was duped of more than ₹21 lakh after falling prey to a WhatsApp-based cyber fraud, in which scammers posed as officials of the Regional Transport Office (RTO) and sent him a malicious file disguised as a traffic e-challan. Mumbai’s North Cyber Police have arrested a 25-year-old student from Surat, identifying him as a key link in a layered money-laundering network behind the scam.
Police said the accused, Hardik Ashokbhai Borda, a BCom student who also ran a small online business selling weighing machines, played a crucial role in routing the stolen money through multiple accounts to evade detection.
https://the420.in/fcrf-certified-grc-professional-program-governance-risk-compliance-training-india/
How the scam unfolded
According to investigators, the 42-year-old complainant had travelled to Gujarat in November 2025 to attend a family wedding. On November 17, while he was occupied with wedding-related engagements, he received a WhatsApp message from an unknown number. The message carried a file titled “RTO Challan”, which appeared to be an official traffic fine notification.
Assuming it to be a legitimate e-challan, the businessman clicked on the file to verify the details. Unknowingly, he installed a malicious APK (Android Package Kit) on his phone. The app immediately gave cybercriminals remote access to his device, including banking applications.
Within minutes, ₹11.33 lakh was siphoned from the businessman’s bank account, while ₹10.39 lakh was withdrawn from his wife’s account through a series of rapid transactions.
Fraud discovered days later
The victim remained unaware of the theft until December 1, when he visited his bank to update his passbook. Bank officials noticed suspicious withdrawals and alerted him to a possible cyber fraud. He then approached the North Cyber Police and also registered a complaint on the Cyber Helpline 1930.
A preliminary probe revealed that a total of ₹21.73 lakh had been fraudulently transferred on the same morning using multiple transactions designed to avoid triggering alerts.
Money trail leads to Surat
Technical analysis and bank transaction trails showed that around ₹8.5 lakh of the stolen amount was transferred directly into Borda’s bank account. Police said the accused later moved the money further using a credit card, pushing the funds into a second layer of accounts as part of the laundering process.
Based on digital evidence and transaction mapping, police tracked Borda to Surat, Gujarat, and placed him under arrest.
“This was a well-planned and multi-layered cyber fraud. The arrested accused acted as a key link in the money-laundering chain,” a senior cyber police officer said. “We are now tracing the second and third layers of the racket and do not rule out more arrests.”
What FCRF says: A growing national cybercrime pattern
The Future Crime Research Foundation (FCRF) has flagged this case as part of a nationwide surge in APK-based cyber frauds, where criminals impersonate government departments to exploit public trust.
According to FCRF’s analysis, fake e-challans, courier delivery alerts, electricity disconnection notices and bank KYC updates are now the most common social-engineering traps used by cybercriminals. These messages are deliberately designed to create panic, urgency and fear of legal action, pushing victims into clicking malicious links without verification.
FCRF has warned that such scams are increasingly well-organised and multi-layered, involving money mules, shell accounts and rapid fund transfers to frustrate recovery efforts.
Expert view: Prof. Triveni Singh on why victims lose everything
Former IPS officer and renowned cyber crime expert Triveni Singh, said APK-based attacks are particularly dangerous because they turn the victim’s smartphone into a remote-controlled device.
“Once an unverified APK is installed, the phone effectively stops belonging to the user,” Prof. Singh said. “The fraudster can see the screen, read OTPs, capture PINs, operate banking apps and move money in real time. By the time the victim realises something is wrong, the funds are already layered and dispersed.”
He added that businessmen and professionals are being deliberately targeted because they often keep higher balances and multiple banking apps on a single phone, making them lucrative victims.
How APK scams empty bank accounts
Cyber experts explain that APK-based frauds bypass the security checks of official app stores. Once installed, such apps typically demand permissions for SMS access, accessibility services, screen overlay and notifications—permissions many users grant without scrutiny.
“With accessibility permission, malware can auto-click buttons, read everything on the screen and silently execute high-value transactions,” an FCRF analyst said.
Police advisory
Mumbai Police have urged citizens to remain vigilant and never download APK files or click on suspicious links, even if they appear to come from official sources like the RTO, banks or courier companies.
Key safety tips:
- Download apps only from official app stores
- Keep ‘Install from Unknown Sources’ turned off
- Regularly review app permissions
- Immediately report suspected frauds to 1930 or the nearest cyber police station
As investigations continue, authorities say the case underlines how a single click can trigger catastrophic financial loss, and why public awareness remains the strongest defence against fast-evolving cybercrime.
