Delhi Police’s cyber cell detained five people accused of operating an SMS phishing network that imitated co-operative bank login pages, according to a statement issued late Tuesday after coordinated raids in Delhi and Uttar Pradesh.
Investigators alleged the group sent more than 400,000 text messages over six weeks, prompting about 1,200 victims to enter debit card credentials on cloned sites. Losses reported to police crossed ₹8.4 crore, mostly from account holders at district co-operative banks in Haryana, Rajasthan and Madhya Pradesh.
How the ring worked
Police said the accused bought bulk SMS gateways using forged KYC documents, then rotated short codes every 48 hours to evade telecom filters. Links resolved to HTTPS pages that mirrored legitimate net-banking layouts, including fake OTP fields that captured one-time passwords in real time.
Funds allegedly moved through a chain of mule accounts before cash-out at urban cooperative branches. Cyber cell officials said they coordinated with the Indian Computer Emergency Response Team to sinkhole seven domains still serving malware payloads.
Victim profile
Most complainants held balances under ₹2 lakh and lacked registered SIM swap locks, making them vulnerable to parallel SIM takeover attempts. Bank federations have urged members to disable international transactions by default—a control several victims told police they did not know existed.
Police emphasised that no co-operative bank core system was breached; the fraud relied entirely on credential harvesting. Recovery of stolen funds will depend on freezing orders executed within the first 72 hours; officers said about ₹1.1 crore has been provisionally attached.
Next steps
The accused were produced before a magistrate Wednesday morning; police sought transit remand to question additional handlers believed to be in Gujarat. A separate lookout notice targets two alleged developers who hosted the phishing kits on offshore virtual private servers.
For account holders, the practical advice remains unchanged: co-operative banks rarely send SMS links for KYC updates, and any urgent payment request should be verified by calling the printed helpline—not numbers embedded in the message.
Industry response
National co-operative banking associations circulated a template SMS warning members not to click links purporting to fix KYC expiry. Several banks enabled one-tap SMS reporting to a shared short code promoted on passbook covers.
Telecom operators said they blocked 12 sender IDs linked to the gang after police shared hashes, but smishing campaigns often respawn with new names within hours. TRAI’s DLT scrubbing rules require commercial templates, yet fraudsters exploit unregistered international routes.
Certification courses for rural branch managers now include a module on phishing walk-throughs after RBI supervision flagged gaps in 2025 examinations. Victims interviewed by police said branch staff had not proactively mentioned SIM locks or transaction alerts.
Prosecutors will rely on digital evidence chains preserved under the Bharatiya Nagarik Suraksha Sanhita procedures adopted in 2024; defence counsel may challenge server logs obtained without mutual legal assistance treaties for overseas hosts.
Retail payment aggregators tightened onboarding after police shared samples of forged shop establishment certificates used to obtain SMS headers. The Reserve Bank of India’s fraud monitoring cell added the phishing URLs to a shared deny list distributed to payment gateways every six hours.
Victim support helplines staffed by bank volunteers logged 340 calls on Wednesday morning, many from elderly account holders who had never used net banking before the scam SMS arrived. Counsellors walked them through branch visits to freeze accounts and issue fresh cheque books.