Hyderabad Police Arrest Three in Hybrid Cyber Fraud Gang Targeting Phone Users
The Hyderabad Cybercrime Wing arrested three people and seized five mobile phones in connection with an emerging network of "hybrid cyber fraud," in which organised gangs combine physical mobile phone theft with cybercrime to drain bank accounts across Hyderabad.
Hyderabad Police Commissioner V.C. Sajjanar issued a warning to citizens, stating that senior citizens and people with limited technical awareness are being specifically targeted by these syndicates at bus stands, railway stations, crowded RTC buses, and other public places.
According to the police, the gangs operate through a structured multistage system. Members initially identify elderly or unsuspecting smartphone users in crowded transit hubs, standing behind them to observe their unlock patterns, PINs, or screen passwords. They then distract the targets and steal the phones from their pockets or bags.
When a stolen phone is locked and the gang does not know the password, they turn to social engineering. When victims call their missing numbers, the accused answer while posing as bus conductors or drivers, falsely claiming they found the device on a bus and will return it at the next stop. Under the pretext of verifying ownership, they persuade the victims to disclose their screen passwords. In other instances, they claim someone else has also laid claim to the device and demand the password as proof of ownership.
Once inside the phone, the fraudsters scan the Gallery, Notes app, SMS messages, and WhatsApp chats for sensitive data, including photographs of debit and credit cards, bank passbooks, Aadhaar and PAN cards, and recorded PINs. With the victim's SIM card still active inside the device, the gang accesses UPI and mobile banking platforms, including Google Pay, PhonePe, and Paytm. They reset net banking passwords and UPI PINs using incoming OTPs and rapidly siphon money out of the accounts.
Sajjanar explained that the stolen funds are not deposited directly into the criminals' personal accounts. Instead, the money is routed through online gaming platforms, digital wallets, and rented mule accounts secured via commissions before being withdrawn.
Police advised citizens never to share screen passwords or banking OTPs, and warned against keeping photos of identity cards, debit cards, CVV numbers, or passbooks stored on mobile phones. If a phone is lost or stolen, citizens should immediately contact their telecom operator to block the SIM card, request their banks to freeze net banking and UPI services, block the device's IMEI via the central CEIR portal, and report the incident by dialling 1930.
