Mumbai. A Goregaon-based travel company was allegedly defrauded of around ₹26 lakh in a SIM swap fraud, leading to the arrest of three men from Jalandhar. Investigators found that money was transferred from the company’s bank account to other accounts before part of it was withdrawn in cash and a significant portion was allegedly used to purchase gold. Police managed to block ₹18 lakh of the transferred amount while tracing the money trail.
According to police, the travel company is a family-run business. On July 20, the mobile number linked to the company’s bank account suddenly stopped working. The company’s accountant contacted the telecom service provider and was told that the number had been issued under a corporate plan. He was asked to send an email to initiate the process for obtaining a replacement SIM.
Proposal for Conducting Cyber Crisis Drill, Tabletop Exercise (TTEx) & CCMP Readiness Exercise
The accountant completed the required process and was told that the new SIM would be activated within four hours. However, the number did not become operational. The sudden loss of mobile connectivity raised suspicion within the company. The following day, the management asked the accountant to check the bank account, where several transactions that had not been authorised by the company were detected.
The investigation found that around ₹25.6 lakh had been transferred through multiple transactions. A cybercrime complaint was subsequently registered, and investigators began tracing the movement of the money through the beneficiary accounts and subsequent transactions.
The probe identified Jalandhar residents Ricky Gill, 32, and Daljeet Singh, 26, among the beneficiaries of the transferred funds. Prompt action through the cybercrime helpline helped block ₹18 lakh. Of the remaining ₹7.5 lakh, some of the money was withdrawn in cash, while most of it was allegedly converted into gold.
Police said Daljeet travelled from Punjab to Mumbai and allegedly withdrew money there. The investigation also revealed the involvement of another accused, Gurukamal Singh. He allegedly placed orders for gold and collected the deliveries. Gurukamal was subsequently arrested.
Investigators are now examining the financial trail between the accused and the transactions related to the purchase of gold. Police are also trying to determine how the accused obtained information linked to the company’s mobile number and bank account. The possibility of an insider’s involvement is also being examined.
In a SIM swap fraud, criminals attempt to deactivate the victim’s existing SIM card and obtain a replacement SIM issued in the victim’s name. Once control of the mobile number is obtained, the fraudsters may gain access to calls, text messages and one-time passwords linked to banking and other services. This can allow them to attempt unauthorised digital transactions from the victim’s bank account.
Police said there was an early warning sign in this case. Telecom service providers send an alert to the existing SIM user before processing certain SIM deactivation or replacement requests. If the company’s employees had noticed the message related to the mobile number being deactivated or replaced, the suspicious activity could potentially have been detected earlier.
Police have advised companies not to treat a sudden loss of network connectivity on mobile numbers linked to bank accounts as merely a technical issue. Businesses should immediately contact both the bank and telecom service provider if a critical number stops working unexpectedly or if they receive an alert about a SIM replacement they did not initiate.
Keeping transaction alerts active on bank accounts and immediately reporting any unauthorised transaction can also help limit losses. Early reporting can give banks and investigators an opportunity to block or trace funds before they are withdrawn, transferred further or converted into other assets.
The investigation is continuing. Police are questioning the arrested accused to determine whether more people were involved in the alleged fraud and whether the same method was used to target other individuals or businesses. Investigators are also examining the complete money trail and the circumstances surrounding the SIM replacement to establish how the alleged fraud was carried out.
About the author — Suvedita Nath is a science student with a growing interest in cybercrime and digital safety. She writes on online activity, cyber threats, and technology-driven risks. Her work focuses on clarity, accuracy, and public awareness.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
