Gujarat’s cybercrime branch registered a first-information report on Sunday over an alleged phishing kit marketed on Telegram channels that copied retail bank login screens, according to a police bulletin that did not name suspects.

What police allege

Investigators said the kit included HTML templates, SMS blast scripts, and instructions for buying virtual numbers to bypass one-time passwords. The FIR cites Indian Penal Code sections covering cheating by impersonation and provisions of the Information Technology Act related to identity theft tools. Police seized two laptops and a router from a Ahmedabad suburb during a search authorized by a local court, the bulletin stated.

According to the same release, the kit’s seller advertised “ready-to-deploy” pages in a Telegram group with more than 4,000 members. Officers infiltrated the group using undercover accounts before moving for physical searches. They cautioned that membership alone is not proof of criminal conduct.

Victim pattern

Complaints referenced in the FIR cluster around small merchants who clicked links promising GST refunds. Pages mirrored public-sector bank colours closely enough to fool users on mobile browsers. CERT-In had warned weeks earlier about a spike in look-alike domains hosted on offshore bulletproof hosting.

4,000-member Telegram group

Banks reiterated that they never ask for card PINs over chat apps. Gujarat police asked citizens to forward suspicious messages to the national cybercrime helpline and to preserve screenshots with timestamps for investigators.

Investigation status

Prosecutors have not filed charges against individuals; the FIR opens a formal probe that may include mutual legal assistance requests for hosting providers. Cyber labs in Gandhinagar will compare code snippets from the seized devices with samples from earlier Rajasthan cases to test whether the kit is part of a franchise sold across states.

For businesses, the case is a reminder that phishing economics now ride on commodity software sold like any other digital good. Gujarat’s move to treat kit distribution as a standalone offence, rather than waiting for victim loss thresholds, signals tighter enforcement as festive UPI volumes climb.

Technical indicators

Forensic analysts said the kit reused open-source JavaScript form validators with minor CSS tweaks to match bank colour palettes. Metadata in archived Telegram posts pointed to cryptocurrency payments for licence keys, complicating traditional banking trails. Investigators are coordinating with national agencies that track wallet clusters used in prior lottery scams.

Internet service providers received takedown requests for domains spawned by the kit’s automated subdomain generator. Because many hosts sit offshore, Gujarat police expect weeks of latency before pages go dark; meanwhile, banks push in-app warnings when customers cross to newly registered look-alike URLs.

Public guidance

Cybercrime helpline operators recorded a spike in callbacks after the FIR made local news. Citizens asked how to verify legitimate GST refund messages. Police advisories stress typing bank URLs manually and enabling transaction alerts for any debit above a self-chosen threshold.

On the ground Monday

Desk reporters phoned traders, officials, and front-line staff to cross-check the numbers in this story against primary statements rather than recycled social posts. Where institutions declined comment, we kept claims tied to published filings or dated press releases. Updates will run on the India homepage if new figures land before the evening publish window.

Readers weighing decisions—whether investing, travelling, or accessing public services—should treat this piece as context, not personalised advice. Markets move after print; policy drafts change in committee; weather and health risks shift quickly. We will amend the story if material corrections arrive with named sources.

Regional rural banks in Saurashtra reissued SMS templates warning customers that refund links will never arrive through unknown chat apps, reinforcing the police bulletin.