Hyderabad: A 700-member strong group from Jharkhand and West Bengal made away with around `3 crore by finding a loophole in the IVR (Interactive Voice Response) system used by the customer care centre of ICICI Bank to collect the PIN numbers of debit cards before cloning the cards to withdraw money fraudulently.
The gang used the Redbus app to confirm the debit card numbers before collecting the PIN numbers and cloning the cards, said the Cyberabad police, who arrested 10 persons for the fraud and remanded them on Wednesday.
The accused persons were identified as Duryodhan Mandal, Viredra Kumar Mandal, Dhananjay Mandal, Prakash Kumar, Niranjan Mandal, Ganesh Kumar Mandal, Kamalesh Mandal, Rajendra Kumar and Pinku Kumar Mandal and Sanjay Kumar Mandal at Jamtara in Jharkhand, after a 21-day camp by the police teams.
The fraud reportedly took place between March 13 and March 30, when the ICICI Bank customer care number received around three lakh calls from around 900 mobile numbers specifically for balance enquiry. The mobile numbers were not registered with any account of the bank. The bank also received complaints from over 1,000 customers that money from their accounts had been illegally withdrawn.
Suspecting that the two complaints could be linked, ICICI Bank officials (Financial Crime Prevention Group) lodged a complaint with the Cyberabad cyber crime police in the last week of March.
During the investigation, it was found that the prime accused Duryodhan Mandal (23) of Jamtara had figured out how the data could be collected. He installed the Redbus mobile application on his phone and used the recharge option.
After entering the mobile number, Duryodhan proceeded to the payment option. He entered the first six numbers of an ICICI debit card based on the BIN (Bank Identification Number) and randomly entered the remaining numbers. When the ‘next’ button was pressed, it showed a ‘red mark’ asking to enter the correct number. When a correct number is entered, the application allows proceeding further to enter the expiry date and CVV number.
“With the debit card number, Duryodhan called customer care number to enquire the account balance and entered random four digit number to validate the IVR system. As the number was correct, he noted the PIN number and debit card number which were used to clone the original debit card and withdraw the money,” said Cyberabad police commissioner VC Sajjanar.
On successful execution, Duryodhan shared the process of committing the fraud with his friends and villagers, and almost 700 people have attempted to commit the offence.
