Hyderabad Police have warned citizens of a ‘Hybrid Cyber Fraud’ where criminals steal phones after observing PINs. They then use social engineering and stored financial data to drain bank accounts, targeting senior citizens and daily commuters.
Hyderabad City Police Commissioner V C Sajjanar has issued a stern advisory cautioning the public against an emerging and dangerous modus operandi termed ‘Hybrid Cyber Fraud’, which combines conventional physical pickpocketing with sophisticated digital financial crimes to siphon off funds from victims’ bank accounts.
The Hyderabad City Police advised citizens never to disclose screen-lock PINs, banking passwords, or OTPs over phone calls, even if the caller identifies themselves as a bus conductor, driver, or good Samaritan promising to return a lost phone. Citizens are warned against storing photographs of debit/credit cards, CVVs, passbooks, and identity cards in phone galleries or note apps.
In a targeted crackdown against this organised racket, the Hyderabad Cyber Crime Wing has arrested three key members of an interstate syndicate and seized five mobile phones used in the commission of these offences. Preliminary investigations indicate that the syndicate systematically preyed upon senior citizens, daily commuters, and technologically vulnerable individuals in crowded public transit areas across the city, according to the police.
The Syndicate’s Modus Operandi
The police said that the syndicate executed its operations through a well-planned, multi-stage strategy. In the initial phase, spotters identified elderly commuters carrying smartphones in busy RTC buses, bus stations, railway platforms, and crowded junctions. Positioning themselves in proximity, the accused discreetly observed and memorised the victim’s screen-lock PIN, pattern, or password through shoulder-surfing, after which they created deliberate distractions in moving crowds to steal the device from pockets or bags, the police said in a release.
The police further said that in instances where the gang could not ascertain the screen-lock credentials beforehand, they staged deceptive social engineering dramas when the victim dialled their lost number. An accused would answer the call posing as an RTC bus conductor or driver, falsely claiming that the phone was found in the bus and would be safely handed over at an upcoming bus stop. Under the pretext of verifying genuine ownership or safely powering off the device, the fraudster would induce the distressed victim into disclosing their screen-lock PIN. In other scenarios, they claimed that another person was contesting ownership of the phone, insisting on the screen password as proof of legitimate ownership, the police added.
Technical Exploitation and Financial Theft
“Once unauthorised access to the device was secured–or in cases where phones were already unlocked–the technical handlers of the gang thoroughly scoured the phone’s gallery, WhatsApp media, file managers, and Notes applications. They extracted sensitive financial artefacts commonly stored by users, including photographs of debit and credit cards (along with visible CVVs), Aadhaar and PAN cards, bank passbook copies, and recorded PINs. Since the victim’s active SIM card was under the syndicate’s physical control, the accused accessed popular UPI applications such as PhonePe, Google Pay, and Paytm, as well as Mobile Banking portals. By intercepting incoming SMS verification codes and OTPs, they swiftly reset UPI PINs and Net Banking credentials, draining account balances, fixed deposits, and linked credit facilities within minutes,” the police further added.
Laundering the Stolen Funds
According to the police, to evade law enforcement tracking and an obscure the digital audit trail, the siphoned funds were not deposited directly into personal accounts; instead, the gang layered the proceeds through accounts created on online gaming platforms, digital entertainment wallets, and a multi-tier network of mule bank accounts procured on a commission basis before withdrawing the cash via ATMs. The investigation underscores that the gang functioned as a structured corporate syndicate, with designated sub-units responsible for target scouting, physical theft, social engineering calls, technical exploitation of banking credentials, and financial laundering.
How to Protect Yourself
‘In the event of a mobile theft, victims must immediately contact their telecom service provider to block the SIM card within minutes to prevent OTP interception, contact their respective banks to freeze digital banking and UPI services, and register the handset’s IMEI number on the Central Government’s official CEIR portal (www.ceir.gov.in) to disable the device. Any unauthorised financial transactions must be reported immediately to the National Cyber Crime Helpline 1930 or registered on www.cybercrime.gov.in,” the police said.
Furthermore, educated youth were urged by the police to actively sensitise the elderly members of their families to remain vigilant against shoulder-surfing and hybrid cyber frauds during public transit. (ANI)
(Except for the headline, this story has not been edited by Asianet Newsable English staff and is published from a syndicated feed.)