Ahmedabad firm loses ₹31 lakh in APK-linked cyber fraud

A Ahmedabad-based trader has alleged that his firm lost ₹31.67 lakh in a sophisticated cyber fraud after an unknown person sent a malicious APK file purportedly relating to an RTO e-challan through WhatsApp, police said.

Based on a complaint filed by Ashwinbhai Nanjibhai Patel (46), a resident of Nikol, the Cyber Crime Police Station, Ahmedabad City, has registered an FIR and initiated an investigation.

According to the complaint dated February 16, Patel runs Ami Enterprise, a partnership firm engaged in trading submersible pump parts at GIDC Naroda, Phase I. The firm maintains a joint cash credit (current) account with Yes Bank, linked to the mobile numbers of Patel and his partner, Sanjaykumar Shankarlal Patel.

On January 21, Sanjaykumar allegedly received an APK file in a WhatsApp group from an unknown number, claiming to enable users to check pending RTO e-challans. Believing it to be related to an old traffic challan, he opened the file. The application reportedly sought Aadhaar and PAN card details, prompting him to close it immediately.

However, on January 28, around 1 pm, Sanjaykumar’s WhatsApp application stopped functioning temporarily and resumed after approximately 30 minutes, allegedly after an automated ‘processing’ message regarding an OTP. The complainant suspects that during this period, unauthorised access was gained to the device.

Nine transactions in 20 minutes

Later that evening, between 7.58 pm and 8.18 pm, the firm’s Yes Bank cash credit account was debited through nine separate transactions, totalling ₹31.42 lakh. The individual transactions ranged from ₹55,000 to over ₹6.73 lakh. Notably, the complainant stated that no OTP was received on his registered mobile number during these withdrawals.

At 8.20 pm, an additional ₹25,000 was debited from Sanjaykumar’s personal Yes Bank savings account. Patel immediately contacted the national cybercrime helpline 1930 and lodged a complaint, receiving acknowledgement numbers for both the firm’s and his partner’s accounts. Despite the prompt complaint, the total amount of ₹31.67 lakh has not been recovered so far.

In his complaint, Patel alleges that the unknown individuals who circulated the APK file, along with the beneficiaries of the bank transactions and account holders who received the funds, acted in concert as part of a criminal conspiracy to cheat and defraud him.

The malicious APK file has since been deleted from the partner’s mobile phone. Police have begun examining the digital trail, including the WhatsApp source, transaction IDs and beneficiary accounts, to identify those involved.

Officials said efforts are under way to trace the flow of funds and freeze recipient accounts, while urging citizens to avoid downloading APK files or clicking on suspicious links received through messaging platforms.