Taking advantage of what is believed to be a flaw in the systems of city-based digital wallet company MobiKwik, around Rs 40 crore was allegedly siphoned off from the company's account over two days, September 11 and 12, through a flurry of UPI transfers.
Key Highlights
- A system glitch allowed ~₹40 crore unauthorized UPI transactions over 48 hours; six people arrested.
- About 2,500 bank accounts frozen; investigation ongoing into app error misreporting transaction status.
The fraud was discovered on Tuesday after six men were arrested, and their accounts contained Rs 9 lakh of the stolen money. Interestingly, this is the second time this has happened to MobiKwik. In October 2017, the company was allegedly defrauded of approximately Rs 19 crore, with the funds transferred to thousands of personal bank accounts. Investigators said the glitch occurred after the company updated its software earlier this month. It appeared to allow Mobikwik users to send much larger amounts of money than their wallet balances. The investigators stated that transactions went through even if users entered incorrect PINs.
According to police, the method by which scammers discovered this flaw is being investigated. Officials said they suspected insiders were involved. A MobiKwik employee reported the fraud on September 13, citing an audit that found suspicious transactions between September 11 and September 12.
According to cops, fraudulent transfers totaled Rs 40.2 crore during those two hours. "On September 11-12, nearly 5 lakh transactions occurred, and so far, 2,500 bank beneficiary accounts have been identified. We have managed to freeze Rs 8 crore of the total fraud amount. "This money was deposited in these bank accounts," a source confirmed.
Five of the arrested men are from Nuh. The other comes from Palwal. The accused have been identified as Rehan, Waqar Yunus, Wasim Akram, Mohd Amir, Mohd Ansar, and Mohd Sakil. All six have been placed in judicial custody.
Also Read: Fintech Platform Mobikwik's Q1 FY26 Losses Jump Sixfold
Police spokesperson Ashok Kumar stated that if any company employee is found to be involved in the scam, strict action will be taken against the individual. Meanwhile, Nuh police on Tuesday requested that anyone who received any unexplained cash transfers in their accounts report it by September 23.
"If anyone received transactions on September 11 and 12 due to technical security lapses or other reasons via the Mobikwik app, received unauthorised payments through the app and wishes to return them, or has any complaints about such transactions, they can visit the SP's office. People from Palwal district and other Mewat areas are welcome to join us." Nuh police issued a statement. They were charged under BNS sections 318(4) (cheating) and 314 (dishonest misappropriation of property). Cops are also working with banks to recover the funds and identify those who profited from the alleged fraud.
"The company is making all reasonable and necessary efforts to recover the funds. However, because the police investigation and recovery efforts are still ongoing, the impact cannot be determined at this time. Based on the preliminary data, as a risk mitigation measure, a FIR was filed for Rs 40 crore, of which the company has recovered approximately Rs 14 crore. Therefore, the estimated net impact is Rs 26 crore. "The company is taking aggressive collection efforts while pursuing legal action to recover the full amount over a period of time," a company spokesperson said.
