Mumbai Police’s cyber unit, working with the Ministry of Home Affairs’ Indian Cyber Crime Coordination Centre, seized servers in a Navi Mumbai colocation facility that hosted fake Goods and Services Tax refund portals used in SMS phishing lures, officials said Friday.
Investigators said the infrastructure supported a campaign similar to chains documented earlier this year, in which taxpayers received messages claiming an approved refund required “verification” on a look-alike gst.gov.in domain. Victims who entered credentials or downloaded attachments risked remote-access malware, according to prior analysis by security firm Seqrite.
How the takedown unfolded
Officers said the gang routed traffic through compromised cloud accounts and rotated domains every few days to evade DNS blocklists. After GST Network officials flagged a spike in fraudulent ARN references, Mumbai cyber police obtained warrants to image three servers and pull logs for upstream affiliates.
No charges were announced pending forensic review, but police displayed GSM gateways and laptops they said were used to test deliverability across carriers—a playbook reminiscent of an October Surat SIM-box bust that targeted income-tax refund spoofs.
Taxpayer defences
The Central Board of Indirect Taxes and Customs has repeatedly warned that genuine summons and notices carry verifiable Document Identification Numbers searchable on the CBIC portal. Tax authorities do not demand OTPs, UPI payments, or personal bank details over WhatsApp.
Businesses should verify any notice inside their authenticated GST dashboard and report suspicious DINs immediately, the board said in earlier advisories.
Broader campaign
Seqrite’s July report tied GST-themed emails to Remcos remote-access trojans, underscoring that refund lures are not isolated SMS scams but part of a persistent financially motivated cluster targeting Indian SMEs.
Cybercrime helpline 1930 and the national portal cybercrime.gov.in remain the recommended reporting channels; banks may freeze mule accounts faster when investigators receive prompt complaints with message screenshots, Mumbai police said.
Small-business exposure
Accountants said micro retailers are especially vulnerable because they interact with GST notices infrequently and may trust SMS alerts that mimic official ARN formats. Training sessions in Mumbai’s wholesale markets this week focused on verifying refunds only inside authenticated portals.
Cloud providers are tightening know-your-customer checks on bulk VPS purchases after investigators traced several phishing hosts to compromised reseller accounts.
Cross-state coordination
The Indian Cyber Crime Coordination Centre has been pushing state units to share URL blocklists in near real time; Gujarat’s earlier SIM-box case provided domain indicators that Mumbai teams said they reused to accelerate takedowns.