How 1 transaction exposed India’s largest cyber scam

It was one innocuous transaction among lakhs conducted daily, that was detected by a digital payments company and which finally helped blow the lid off a web of fraudulent transactions worth over Rs 16,180-crore – bigger than the Punjab National Bank scam of January 2018 involving top diamantaires – that stumped the Thane police recently.

The mega-scam was officially revealed on October 9 by Thane’s Shrinagar Police Station which had lodged a FIR after a complaint was filed by Safexpay Technology Pvt Ltd, Thane.

The police investigators said that the Safexpay’s Payout Platform was allegedly hacked by certain unknown entities, and the subsequent probe has shown that at least Rs 16,180 crore has been siphoned off, including some monies transferred abroad.

Thane-based Safexpay’s Founder-CEO Ravi Gupta said that the scam came to light around April when four merchants from Delhi, Tamil Nadu, Madhya Pradesh, and Uttar Pradesh reported "suspicious" discrepancies between bank balances and system balances.

Meticulous internal probe by Safexpay’s financial operations teams found that of these four, one merchant’s login was compromised, and further it was found that the dubious transaction did not belong to them.

Safexpay, which is said to handle over 100,000 transactions daily, immediately reported the matter to the beneficiaries and banks concerned, plus initiated the process to halt further illegal transfers of the funds, in the so-called ‘golden period’.

This cybercrime resulted in a loss of Rs 25 crore, and shocked by the revelations, Safexpay promptly lodged a complaint with Thane Police Cybercrime Investigation Cell and also the National Cyber Crime portal on April 20, said Gupta.

The company followed it up with a detailed FIR at Shrinagar Police Station on June 16, 2023, along with detailed evidence and other material. Taking remedial measures during the ‘golden period’ helped Safexpay save around Rs 7 crore from the detected fraud of Rs 25 crore from its payout platform, said Gupta.

Safexpay roped in cyber experts, forensic auditors and others to conduct a comprehensive system analysis, how the hackers entered the systems and siphoned off the money, their modus operandi, and an analysis of the beneficiary accounts, and detailed reports were handed over to the Thane police. As it emerged, this was just the proverbial tip of the iceberg as the Thane Police investigations unravelled the deceptive transactions amounting to at least Rs 16,180 crore orchestrated by distinct entities utilising various fake bank accounts and totally unrelated to Safexpay.

Police said that the amount of Rs 25 crore siphoned off found its way into the HDFC Bank account of a Thane-based company, Riyal Enterprises that has five branches in Thane and Navi Mumbai. The investigations into Riyal Enterprises revealed that around 260 accounts in different names with various banks were allegedly used for carrying out the financial frauds.

"A detailed perusal of the bank statements of these 260 accounts pointed to an estimated misappropriation of a massive Rs 16,180 crore, a part of which has been transferred to foreign accounts," said the Thane police.

The Thane police have so far nabbed two persons, Amol Andhale alias Aman and Sameer alias Kedar Dinghe, and teams are on the lookout for the others including Sanjay Singh and Jitendra Pandey, reportedly the ‘kingpin’ of this mega-fraud and who boasts of a banking track record of over a decade.

Police suspect the involvement of many more persons involved in the huge racket of opening bank accounts with fake documents, and floating entities with bogus papers intended to cheat the banks and the government. Shaken by the fraud, Safexpay has now tightened its systems with "more monitoring by different teams, extra alerts (4/hour instead of 1/hour earlier) enabled for any suspicious transactions on the platform, vigil at the system levels", real-time monitoring plus the forensic probe, said an official.