A deputy branch manager at Kotak Mahindra Bank in Rajasthan’s Alwar allegedly suffered a ₹1.25 lakh credit card loss after clicking a fraudulent job link, highlighting the risks of malicious mobile applications and OTP theft.
A deputy branch manager at Kotak Mahindra Bank in Alwar has allegedly lost ₹1.25 lakh in a cyber fraud after clicking on a link promising a job opportunity and downloading a malicious Android application package (APK) file. Police have registered a case and are investigating the incident with assistance from technical experts.
The incident highlights how cybercriminals exploit job seekers’ interest in new employment opportunities to distribute malicious applications, compromise mobile devices and carry out unauthorised financial transactions.
Fake Job Offer Allegedly Led to Credit Card Fraud
According to the complaint, the victim, identified as Rahul Agarwal, received a message offering a job opportunity. He clicked on the link provided in the message, reportedly allowing the fraudsters to initiate the next stage of their operation.
The accused allegedly contacted Agarwal after he interacted with the link and are suspected of gaining access to his mobile phone. Investigators are also examining allegations that the fraudsters obtained one-time passwords (OTPs) by presenting them as necessary for job registration and related formalities.
Following these interactions, ₹1.25 lakh was reportedly debited from the victim’s credit card.
The precise technical method used to gain access to the device and facilitate the transactions has not been established publicly. These details will need to be verified as the police investigation progresses.
FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders
How Malicious APK Files Can Enable Financial Fraud
APK files are installation packages used to distribute applications on Android devices. Although APK files are not inherently malicious, applications obtained through unverified links can expose users to serious security risks.
A fraudulent application may request excessive permissions, collect sensitive information or abuse accessibility features to monitor activity and interact with other applications. Depending on the permissions granted and the malware involved, attackers may attempt to access messages, intercept authentication codes or facilitate unauthorised transactions.
Cybercriminals can also combine malicious software with social engineering. By convincing victims that an application is necessary to complete job registration, they may persuade them to install software they would otherwise avoid.
However, downloading an APK does not automatically give an attacker complete control of a phone. The outcome depends on the application’s capabilities, the permissions granted, the device’s security protections and the attacker’s methods.
Police Investigating the Alleged Fraud
Police have registered a case and are investigating the incident with technical experts’ assistance. Investigators will need to establish how the victim’s device may have been compromised, how the credit card transactions were authorised and whether the incident is connected to other reported cyber fraud cases.
The investigation may also examine digital communications, the suspicious link, the downloaded application and transaction records to identify the individuals responsible.
What This Means For You
Never install an application from an unsolicited job offer or an unfamiliar link. Verify recruitment opportunities through the employer’s official website, avoid sharing OTPs and banking credentials, and review application permissions carefully.
If money is debited fraudulently, contact your bank or card issuer immediately to report the transaction and request appropriate protective measures. In India, report cyber financial fraud promptly through the national cybercrime helpline 1930 or the official National Cyber Crime Reporting Portal.
The420 Insight
This incident demonstrates how employment-related social engineering can become a gateway to financial fraud. Even experienced professionals can be targeted when a convincing message creates a sense of opportunity or urgency. Strong device security, verified recruitment channels and strict protection of authentication codes remain essential safeguards against malicious APK-based attacks.
About the Author – Ananya Aradhya writes on cybercrime, fraud, scams, cybersecurity, digital safety, and emerging threats. Her work also covers major criminal cases, financial frauds, consumer scams, and stories that highlight risks affecting people in the real and digital world.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
