Retired Railway Employee Loses ₹10 Lakh After Downloading Fake Bank of India Life Certificate APK
Summarized by AI; it may make mistakes. Check important info
Summarized by AI; it may make mistakes. Check important info
A 66-year-old retired Indian Railways employee in Ahmedabad lost ₹10.1 lakh after cyber fraudsters tricked him into installing a malicious Android application disguised as a Bank of India life certificate update.
The victim, John Keshav Christian of Shahibaug, filed a complaint with the Cyber Cell of the Ahmedabad Crime Branch regarding the fraud, which took place between November 9 and November 10.
How the Trap Was Laid
Christian, who retired from the Indian Railways in 2020, maintains his pension account at the Bank of India’s Station Road branch. Around 8 pm on November 9, he spotted an Instagram post claiming to be from the bank, inviting pensioners to complete their mandatory annual life certificate updates online.
Assuming the advertisement was legitimate, Christian clicked the attached link and submitted sensitive information, including his debit card number and Pension Payment Order (PPO) details.
Before he could finish the online process, he received a WhatsApp message from an unknown mobile number displaying the Bank of India logo as its profile picture. The sender shared a malicious Android Package Kit (APK) file named 'Bank of India Life Certificate Update 2026'.
Remote Access and Unauthorised Transfers
Moments later, Christian received WhatsApp voice and video calls from a second number, which also used the bank’s name and logo as its display image. Posing as a bank official, the caller guided him through downloading the APK file and completing the verification steps over the phone.
Once Christian installed the app and entered the prompted credentials, the fraudsters gained remote access to his mobile device, allowing them to intercept one-time passwords (OTPs) needed to authorise financial transfers.
Discovery and Police Action
The theft came to light on November 10 when Christian received a call from his bank alerting him to recent debits from his account. Having authorised no such payments, he grew suspicious and immediately checked his passbook at a nearby ATM.
With assistance from his son, Spandan, Christian reviewed his full statement on the official Bank of India app and discovered three unauthorised transactions totalling ₹10.1 lakh:
- Two separate IMPS transfers of ₹3.5 lakh each
- One transaction of ₹3.1 lakh via Amazon Pay India
Spandan immediately dialled the national cybercrime helpline 1930 to register an online alert. Christian then visited the Ahmedabad Crime Branch Cyber Cell to lodge a formal complaint, handing over a pen drive containing the fraudulent APK file as digital evidence.
Police have registered an offence and initiated a formal investigation into the case.
