Mumbai CSMT cyber scam: Free wi-fi suspected in malware attack as bank official loses Rs 4.27 lakh

New Delhi, Aug 7 (SocialNews.XYZ) Mumbai Police launched an investigation into a suspected cyber fraud case in which a nationalised bank’s senior official allegedly lost Rs 4.27 lakh through unauthorised credit card transactions.

Investigators suspect that the fraud may have started after the victim’s personal secretary connected his mobile phone to the free public Wi-Fi network at Chhatrapati Shivaji Maharaj Terminus (CSMT) in Mumbai.

According to police, cybercriminals may have gained access to the personal secretary’s mobile phone and later used the compromised device to spread a malicious Android application package (APK) file disguised as a Regional Transport Office (RTO) traffic challan. The fake application was reportedly sent to several people in the phone’s contact list, including senior bank officials.

The MRA Marg police have registered a First Information Report (FIR) and are investigating whether the mobile device was infected through the public Wi-Fi network, a fake hotspot imitating the genuine network, or through another method used by cybercriminals.

Police said the complainant, 56-year-old Gobinda Biswas, a resident of Bhakti Park in Wadala and general manager at a nationalised bank office in Fort, received a message on July 18 from his personal secretary Narayan Swami. The message appeared to be an official RTO challan and contained an APK file.

Before sending the message, Swami had connected his mobile phone to the free Wi-Fi service available at CSMT, police said. After the device was allegedly compromised, the malicious file was automatically forwarded through messaging applications to more than 200 contacts saved on the phone.

Believing the message to be a genuine traffic challan, Biswas downloaded and installed the application. Police suspect that the malware then gained access to sensitive information stored on his device, including data that could have been misused for financial fraud.

Investigators believe the infected application continued spreading the malicious file to additional contacts. On July 21, Biswas noticed unusual activity on his phone and deleted the application. However, police suspect that the malware had already accessed important information before removal.

Police said Biswas did not receive any SMS alerts regarding the suspicious credit card transactions. The fraud came to light on August 3 when he received his credit card statement. The complaint stated that five unauthorised transactions amounting to Rs 4,27,264 were carried out within just 28 minutes on July 21.

The bank’s credit card department later attempted to contact the customer several times. After the transactions were found suspicious and communication could not be established, the credit card was blocked, police said.

Biswas subsequently filed a complaint on the National Cyber Crime Reporting Portal and approached MRA Marg police. An FIR was registered on August 4 in connection with the suspected cybercrime.

A Mumbai Police official said that the investigation is underway to identify the source of the malware and determine the exact method used by the accused to gain access to the mobile device.

Citizens should remain cautious while connecting to public Wi-Fi networks and should avoid installing applications received from unknown sources, Mumbai Police cautioned.

Cyber experts have repeatedly warned that attackers can use fake applications, phishing messages and unsafe public networks to steal personal and financial information. Police have advised citizens to verify links and applications before downloading them and to avoid sharing sensitive banking details through suspicious platforms.

Source: IANS