Rs 116 Crore Cyber Scam Busted in Varanasi: Gang Used ‘XePay’ APK to Steal OTPs

 

A major cyber fraud network allegedly involved in transactions worth Rs 116.86 crore has been busted in Varanasi, with police arresting four people, including the alleged mastermind, Nitish Kumar Pandey of Sasaram in Bihar.

The operation was carried out jointly by the Cyber Crime Cell and Varanasi Police following an investigation into a network that allegedly used bank accounts opened in other people's names to facilitate cyber fraud, investment scams and betting-related transactions.

Bank Accounts Taken on Commission

According to investigators, the gang allegedly approached individuals with offers of commissions in exchange for allowing bank accounts to be opened or operated in their names.

These accounts were subsequently allegedly used to receive and transfer money linked to cyber fraud, investment schemes and betting applications.

Police said the network created a chain of bank accounts to move the proceeds, making it difficult to trace the source and destination of the money.

How the Gang Intercepted OTPs

Investigators also uncovered the alleged use of an Android application package (APK) called ‘XePay’.

According to police, the accused used the APK to activate SMS forwarding on mobile phones. This allegedly enabled them to intercept one-time passwords (OTPs) sent by banks.

By gaining access to OTPs, the accused could allegedly obtain the authentication required to operate the linked bank accounts and carry out financial transactions.

Police said the money generated through the alleged fraud was then routed through multiple accounts.

143 Cybercrime Complaints Linked

The investigation found links between the network and 143 complaints registered on the National Cyber Crime Reporting Portal (NCRP).

Police identified 41 bank accounts allegedly associated with the gang. The combined fraud linked to the accounts is estimated at approximately Rs 116.86 crore.

The scale of the alleged transactions has prompted investigators to examine the wider network and identify other individuals whose accounts may have been used.

Police Seize Phones, Cards and QR Scanners

During the operation, authorities seized several items allegedly connected with the cyber fraud operation.

The recovered material included:

• 7 mobile phones
• 1 laptop
• 19 chequebooks
• 40 debit cards
• 48 QR scanners
• 2 vehicles

Four people have been arrested in connection with the case, with Nitish Kumar Pandey identified as the alleged mastermind.

The police investigation is continuing to determine the full extent of the network, trace the flow of funds and identify other people who may have been involved.

The case also highlights how cybercriminal networks increasingly rely on mule bank accounts, digital payment systems and mobile-based OTP interception to move and access illegally obtained funds.