Hyderabad Police Arrest 3 in Interstate Hybrid Cyber Fraud Racket

The Hyderabad Cyber Crime Wing arrested three key members of an interstate syndicate involved in a new modus operandi termed "Hybrid Cyber Fraud," which combines physical pickpocketing with digital financial theft. Officers seized five mobile phones used in the crimes.

Following the crackdown, Hyderabad City Police Commissioner V C Sajjanar issued an advisory cautioning the public against the racket. Preliminary investigations revealed that the gang systematically targeted senior citizens, daily commuters, and technologically vulnerable passengers in crowded public transit areas across Hyderabad, including state RTC buses, bus stations, railway platforms, and busy junctions.

According to the police, the syndicate operated through a structured, multi-stage process. Spotters first identified elderly commuters carrying smartphones in crowded transit areas. By positioning themselves close to targets, the accused memorised screen-lock PINs, patterns, or passwords through shoulder-surfing before creating deliberate distractions in moving crowds to steal the devices.

In cases where the gang could not observe the screen credentials beforehand, they staged deceptive phone calls when victims dialled their stolen numbers. An accused would answer posing as an RTC bus conductor or driver, claiming the phone was found and would be returned at an upcoming stop. The fraudster would then induce the victim to reveal the screen-lock PIN under the pretext of verifying ownership or turning off the device. In other instances, they claimed another person was disputing ownership of the phone to demand the password.

Once access to the device was gained, technical handlers searched the phone's gallery, WhatsApp media, file managers, and Notes apps to extract sensitive financial records. These included photos of debit and credit cards with visible CVVs, Aadhaar and PAN cards, bank passbooks, and stored PINs.

With physical possession of the victim's active SIM card, the gang accessed UPI applications like PhonePe, Google Pay, and Paytm, as well as mobile banking portals. By intercepting incoming OTPs and SMS verification codes, they reset UPI PINs and Net Banking credentials, draining account balances, fixed deposits, and linked credit facilities within minutes.

To obscure digital trails, the stolen funds were routed through accounts on online gaming platforms, digital entertainment wallets, and mule bank accounts before being withdrawn as cash from ATMs.

Police advised citizens never to disclose screen-lock PINs, passwords, or OTPs over phone calls and warned against storing financial documents in phone galleries. In case of mobile theft, victims should immediately block their SIM cards, freeze banking services, register handset IMEI numbers on the CEIR portal, and report unauthorized transactions via the 1930 cyber crime helpline.