Gurugram Cyber Police have arrested a mobile phone repair technician for allegedly installing a malicious application on a customer’s handset and using the compromised device in a cyber fraud involving ₹1.99 lakh.
The accused, identified as Rohit, was arrested from Jalandhar in Punjab on October 14 by a team from Cyber Crime Police Station West, Gurugram.
Police allege that Rohit gained access to the complainant’s phone while repairing it and installed a malicious APK file on the device.
The malware was allegedly later used to facilitate unauthorised financial transactions.
FCRF Launches CP-FRM to Build India’s Next Generation of Fraud Risk Professionals
Repair Access Allegedly Used to Install Malicious APK
The case dates back to July 2024.
According to police, the complainant had handed over his mobile phone for repair before discovering that ₹1.99 lakh had been fraudulently withdrawn from his account.
An FIR was registered on July 8, 2024, after the victim approached authorities.
During the investigation, police traced the alleged compromise back to the period when the handset was being repaired.
Investigators allege that Rohit misused physical access to the device to install a malicious APK file.
An APK is the installation file used to add applications to Android phones.
Normally, users download trusted applications through the Google Play Store. But an APK obtained from outside official app stores can contain altered or malicious software.
Such applications can potentially request access to text messages, notifications, contacts, accessibility functions and other sensitive phone features.
If a user grants powerful permissions, malicious software may be able to read banking alerts or intercept information needed to carry out fraud.
Police have not publicly disclosed the exact permissions allegedly obtained by the application in this case or precisely how the ₹1.99 lakh was transferred.
Technician Arrested From Punjab After Investigation
Police said Rohit is a resident of Kurar village in Haryana’s Jind district.
Investigators traced him to Jalandhar, where he was arrested on October 14.
A mobile phone and two SIM cards were recovered from his possession, according to police.
His arrest takes the total number of accused apprehended in connection with the case to two.
Authorities are continuing to investigate whether other people were involved and how the stolen money moved after leaving the victim’s account.
The case highlights a cybersecurity risk that receives less attention than phishing links or scam calls: physical access to an unlocked device.
Most cyber safety advice focuses on suspicious links, OTPs and unknown callers.
But a person who physically possesses an unlocked phone may be able to install applications, change settings or grant permissions without the owner immediately realising what has happened.
That risk becomes particularly important during phone repairs.
Why Repair Shops Can Become a Security Risk
A smartphone now contains much more than photographs and contacts.
Banking applications, email accounts, authentication apps, identity documents and saved passwords may all be accessible from the same device.
If a repair technician is given an unlocked phone, the person may temporarily have access to information that would otherwise be protected by the owner’s password.
Malicious applications can also be disguised to look harmless.
An app might not appear prominently on the home screen, while still running in the background or using accessibility permissions to monitor activity.
Android includes security controls designed to limit installation from unknown sources, but users can manually override those protections.
That makes it important to check a phone carefully after it returns from repair.
Users should review recently installed applications, permissions and accessibility settings if they suspect unauthorised changes.
Banking and email passwords should also be changed if the phone was handed over in an unlocked state or if the repair required access to the operating system.
Second Arrest Expands Probe Into Fraud
Police have not yet disclosed the identity or alleged role of the first person arrested in the case.
The second arrest suggests investigators are examining whether the suspected phone compromise was part of a wider fraud rather than an isolated misuse of a repaired handset.
The investigation will now have to establish who controlled the malicious application, who received the stolen funds and whether the same method was used against other customers.
It will also need to determine whether Rohit knowingly installed malware for financial fraud or whether other individuals directed the operation.
The allegations have not yet been proved in court.
What this means for you:
Before giving a phone for repair, back up your data, log out of sensitive financial apps where possible and avoid sharing your main unlock code unnecessarily. After repair, check for unfamiliar apps, changed permissions and unusual banking activity.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
