As Diwali, the biggest festival of lights, joy and gifts, is approaching, there is a huge crowd of buyers in the markets across the country. People are busy buying clothes, gold and silver jewellery, new electronic gadgets and gifts for their loved ones. There is an atmosphere of festive joy and digital transactions everywhere, but under the cover of all this glitter and busyness, a very vicious gang of cyber criminals has become active. Taking advantage of this haste, happiness and superstition of festivals on unknown messages, cyber thugs are adopting very dangerous and technical methods to loot people's hard-earned money. This time, the biggest and deadly weapon of the fraudsters has become – fake APK (Android Package Kit – APK) files sent in the name of greeting cards and offers on WhatsApp and social media. Sensing this serious threat, the Cyber Cell of Gwalior district of Madhya Pradesh and the local police administration have issued a very important and strict advisory for the common citizens. Police officials have clearly warned that in this festive season, do not touch files attached with attractive offers, cashback claims and Diwali wishes from any unknown number, social media group or chat. Cyber experts say that this is not just a simple fraud, but a sophisticated malware attack that in the blink of an eye turns your smartphone into a spying device and wipes out the entire capital deposited in your bank account. In this latest advisory issued by Gwalior Police, special attention has been drawn to a very sensitive and serious aspect. In the coming days, there will be official holidays in banks for several consecutive days due to Diwali, Govardhan Puja, Bhaidooj and weekends. Cyber criminals are trying to take full advantage of the closure of banking branches and limited staff at customer care centers during holidays. The police have cautioned the citizens that if a financial cyber crime happens to a person during these holidays, then freezing your account (stopping transactions) with immediate effect can become an extremely challenging and complicated task due to bank branches being closed. Generally, in case of any cyber fraud, the first two to three hours are considered very important, which is called 'Golden Hour' in the language of cyber security. If the bank is immediately alerted during this period, the money is stopped before it is transferred to any other account. But during long weekends and festival holidays when the local nodal officer of the bank is not available, the victim has to navigate the technical maze of call centers and helplines. By then, cyber thugs have diverted the looted amount to dozens of fake accounts, cryptocurrency wallets or e-commerce gift vouchers, making recovery of the money almost impossible. Therefore, even a little carelessness at this time can spoil the color of the entire family festival. Deadly game of APK files in the name of e-greetings and huge discounts, the latest case has come to light in Gwalior. It has been an old formula of cyber criminals to trap people by luring them with huge discounts, no-cost EMI, free smartphone, lucky draw and huge cashback on online shopping platforms during the festive season. Fraudsters send links containing flashy advertisements through various messaging apps, bulk SMS and emails. As soon as a user clicks on these links, a fake e-commerce website or online lottery page opens in front of him. In many cases, people are given the promise of doubling the credit card limit without any charges or instant loan approval without any paper formalities. In this process, confidential data of the bank, card number and CVV is obtained on the pretext of filling the form. But if we look at the statistics of the last few years, the biggest loss has been caused by APK files downloaded in the name of good wishes. Last year too, thousands of such cases were reported during Diwali and this year too the danger is at its peak. Three days ago, Dharmendra Sharma, resident of Gola Ka Mandir police station area of Gwalior, became a victim of this dangerous fraud. An unknown file in the name of Diwali greetings and gift voucher had arrived on his mobile. As soon as Dharmendra downloaded that file thinking it was a normal greeting, Rs 13,000 were deducted from his bank account within a few minutes. On the complaint of the victim, a case has been registered on the Cyber Crime Portal and National Cyber Helpline. People often do not understand that normal photo or video files are in '.jpg' or '.mp4', whereas fraudsters fraudulently send files with '.apk' extension, which once installed takes out of control of the mobile. Hackers gain remote access to the phone as soon as it is downloaded, police told strict rules for protection. Technically speaking, an APK file is an application installer package for the Android operating system. When a user clicks on an unknown APK file on WhatsApp and allows it to be 'installed', he unknowingly breaks the security wall (firewall) of his phone. This malware starts working secretly in the background of the phone and hackers get complete remote access to that mobile. Its most dangerous aspect is that this virus steals the SMS permission of the user. Whenever fraudsters withdraw money from a bank account or UPI wallet, the security OTP (One Time Password) sent by the bank is forwarded directly to the hackers' servers even before it appears on the user's screen. The user does not realize until his entire account is emptied. Gwalior Police and cyber experts have appealed to citizens to strictly follow basic digital rules for their safety. The first and foremost condition is that do not download or install any file from any medium other than Google Play Store, WhatsApp group or third party website. If you see '.apk' written at the end of any message, delete it immediately and block the sender. Do not share your bank OTP, UPI PIN, ATM password and internet banking confidential information with any person or unknown customer care executive. Always remember that no bank or financial institution asks for password or PIN over phone calls. If for some reason fraud occurs, then without wasting time immediately call the National Cyber Helpline number 1930 or lodge a complaint on the official portal so that necessary technical steps can be taken in time.
