The Indian Express ·
Retired soldier in Pune clicks ‘pension verification’ link, loses Rs 28 lakh
The senior citizen from Shirur fell victim to a remote-access cyber fraud after downloading an APK file sent by an unknown WhatsApp number.
One WhatsApp message about pension verification, one click, and a string of OTPs later, a 65-year-old retired Army soldier from Shirur in Pune district saw Rs 28 lakh drained from his bank accounts over just a few hours, the police said.
The message led the senior citizen to download an APK file—used to install applications on Android phones—triggering what the police suspect was a remote-access cyber fraud.
On the morning of September 11, the retired soldier received a WhatsApp message from an unknown number, followed by a link to a file titled “Pension Card Verification Retired Personnel”. Believing it to be related to his Army pension, he downloaded and opened the APK file.
In remote-access scams, fraudsters trick victims into installing such apps by posing as bank officials, electricity or gas service providers, government departments, or other trusted entities. Once installed and granted permissions, such apps can potentially allow fraudsters to view or control the device, access sensitive information, and facilitate fraudulent transactions.
“Soon after opening the file, the victim received a call from another number. The caller claimed to be from a bank and told him that he would help prepare his senior-citizen pension account. The caller asked him to keep his phone switched on. Subsequently, the victim received multiple OTPs on his mobile phone. The caller told him not to disclose the OTPs,” said an officer from Pune rural police.
Later that afternoon, however, he began receiving messages about transactions from his pension and savings account. Within three hours, the complainant lost Rs 28.7 lakh from his account in nine transactions. He then informed his daughter, who helped him report the fraud through the National Cyber Crime Reporting Portal. The Shirur case police have registered an FIR in connection with the fraud.
A sense of urgency around routine services
Remote-access fraud does not necessarily begin with a bank-related message. Fraudsters commonly create a sense of urgency around routine services and ask victims to download an APK or click a link. A message may claim that a gas connection needs KYC, an electricity bill is overdue, or the power connection will be disconnected. It may also claim action is required with regard to government documents or pensions.
The fraudster may then call the victim and pose as an employee of the relevant company or department. The victim can be persuaded to install an app, enter details, or grant permissions. The fraudster may also ask for an OTP, claiming it is required for verification, while using the compromised device or banking credentials to facilitate transactions.
The police have advised people not to install applications received through WhatsApp, SMS or other unsolicited messages, particularly when the sender asks them to bypass normal app stores or grant unusual permissions.
Genuine service providers do not require customers to install unknown APK files sent through messaging platforms to settle routine bills or complete verification.