Stolen Phones Used To Empty Bank Accounts In New ‘Hybrid Cyber Fraud’

Hyderabad police have warned citizens about a new form of ‘hybrid cyber fraud’ in which organised gangs combine mobile phone theft with cybercrime to empty victims’ bank accounts. Hyderabad Police Commissioner V.C. Sajjanar said senior citizens and people with limited technological awareness were being specifically targeted.

The Hyderabad Cybercrime Wing arrested three accused in connection with such offences and seized five mobile phones. Police said the gangs operate through a systematic, multistage network.

The criminals first identify elderly or unsuspecting smartphone users at bus stands, railway stations, crowded RTC buses and other public places. Standing behind their targets, they carefully observe how victims unlock their phones using patterns, PINs or passwords. They then create a distraction and steal the phones from pockets or bags.

If the stolen phone remains locked and the criminals do not know the password, they resort to social engineering. When victims call their lost phones, the accused answer while posing as bus conductors or drivers, claiming that the device was found on a bus and that they would return it at the next stop. They then persuade victims to reveal the screen password under the pretext of verifying ownership. In another tactic, they claim that someone else has also claimed the phone and ask the victim to disclose the password to prove ownership.

Once the phone is unlocked, the fraudsters search the Gallery, Notes, messages and WhatsApp chats for sensitive information. They look for photographs of debit and credit cards, Aadhaar and PAN cards, bank passbook details, and PINs stored in notes.

With the stolen SIM still active, the accused access UPI and banking applications such as PhonePe, Google Pay and Paytm. Using OTPs received on the SIM, they reset net banking passwords and UPI PINs and quickly transfer money from the victims’ accounts.

Sajjanar said the stolen funds are not directly deposited into the criminals’ personal accounts. Instead, they are routed through online gaming platforms, digital wallets and mule accounts obtained by offering commissions before being withdrawn.

The Commissioner added that the operation was not merely conventional theft but a structured cybercrime network, with separate members assigned to identify targets, steal phones, obtain screen passwords, conduct technical operations and move the stolen funds.

Sajjanar advised citizens never to share screen-lock PINs, passwords or banking OTPs. Photographs of debit and credit cards, CVV numbers, net-banking passwords, bank passbook copies, Aadhaar and PAN documents should not be stored in phone galleries or Notes apps.

If a phone is lost, citizens should immediately contact their telecom service provider and block the SIM. They should also ask their bank to temporarily freeze net banking, mobile banking and UPI services. The device’s IMEI should be blocked through the government’s CEIR portal. In case of financial loss, victims should immediately call 1930 or report the fraud through the National Cyber Crime Reporting Portal.

Sajjanar also urged youngsters to educate senior citizens in their families about the emerging fraud and ensure that they remain cautious while using their phones during travel.