Mumbai Police Arrest Madhya Pradesh Developer Over APKs Linked to 9,673 Cyber Fraud Victims
Mumbai Police have arrested a 36-year-old software developer from Madhya Pradesh on allegations that he developed and supplied malicious Android application packages to cyber fraudsters, in a case police say is linked to the defrauding of at least 9,673 people across India.
An Android application package, or APK, is a file used to install applications on Android phones. Such files can be shared through messaging apps and installed outside official app stores, a route that investigators say fraudsters use to deliver harmful software that can capture personal and banking details.
According to the police, the arrest was made during an investigation into a complaint filed by a 72-year-old resident of Mumbai. The complainant told the police that on August 13 he received a call from a person who identified himself as Dinesh Kumar, a relationship manager with Bank of India. The caller allegedly said a "Senior Citizen Card" needed to be generated and sent him a file named "Senior Citizen Card Verification.apk".
Police said the man downloaded the application and entered his personal and debit card details, after which ₹5.62 lakh was fraudulently transferred from his account. A case was registered at the Matunga police station.
Investigators traced the malicious file and identified the alleged developer, who was subsequently arrested. Police said he is a software developer who dropped out of a B.Tech course at a college in Indore in 2011.
According to the police, the accused allegedly hired servers, developed malicious APK files and sold them to cyber fraudsters for varying amounts. His alleged entry into the trade is said to have begun after a cyber fraudster contacted him, learnt that he was a developer and began purchasing such applications from him.
Technical analysis indicated that the accused had developed around 2,805 malicious APK files, which police say were used by cyber criminals operating in different parts of the country.
Police said these applications have been linked to fraud involving at least 9,673 victims nationwide. About 1,930 complaints have been filed on the cybercrime helpline in connection with the files — 1,074 from across India, 143 from Maharashtra and 36 from Mumbai, according to the police. The applications have also been linked to 88 registered cybercrime cases, including eight in Maharashtra and five in Mumbai.
Police said they seized a laptop, two mobile phones, three hard disks and a pen drive from the accused. A technical examination indicated that the seized material contained server infrastructure belonging to various companies, they added.
A case was registered at the Byculla police station under Sections 318(4) and 319(2) of the Bharatiya Nyaya Sanhita, along with Sections 66(C) and 66(D) of the Information Technology Act. The investigation was later taken over by the Property Cell of the Mumbai Crime Branch.
The Property Cell is continuing its investigation to identify the fraudsters who allegedly bought and used the APK files, trace the wider network operating across States and determine whether more victims are connected to the applications. Police said the number of victims could rise as the investigation progresses. The accused has not been named in this report, and an arrest does not by itself establish guilt; the allegations are yet to be tested in court.
Cybercrime officials have repeatedly advised the public to avoid installing application files received through links or messages from unknown senders, and to download software only from official app stores. They have also urged people not to share bank details, card numbers, one-time passwords or other personal information over phone calls, and to report suspected fraud on the national cybercrime helpline number 1930 or the cybercrime.gov.in portal.
