What appeared to be a routine digital administrative notification has once again exposed the sophisticated and ruthless tactics employed by modern cybercriminal syndicates. In a disturbing case that highlights how deeply fraud has permeated digital networks, an HDFC Bank employee from Mumbai was arrested by cyber police in Rourkela, Odisha, for allegedly orchestrating a ₹5.99 lakh e-challan fraud—and using the stolen funds directly to clear his own mounting credit card bills.
The incident serves as a stark reminder that ordinary mobile notifications can serve as trojan horses for financial ruin, underscoring the urgent need for heightened digital vigilance across India.
Anatomy of the Scam: How a ₹500 Traffic Fine Turned Into a ₹6 Lakh Trap
The sophisticated cyber fraud began late at night on May 30, when a resident of Rourkela received an innocuous-looking message on WhatsApp around 10:30 PM. Styled to mimic official state transport communications, the message claimed that a traffic penalty had been registered against the victim’s vehicle. It instructed the recipient to clear a minor fine of just ₹500 through an attached link to avoid legal complications.
Trusting the legitimacy of what appeared to be an official government invoice, the victim clicked the link. Unbeknownst to him, the link initiated the automatic download of a malicious APK (Android Package Kit) file onto his smartphone.
Within moments of the file downloading, the malware granted remote access to the cybercriminals, bypassing standard device protections. The victim’s phone suddenly became unresponsive to manual inputs while rapidly receiving a barrage of automated One-Time Passwords (OTPs). Before the victim could regain control of his device, six unauthorized UPI transactions had been executed, draining approximately ₹5.99 lakh from his bank account in a matter of minutes.
Police Investigation Leads to Mumbai and an Insidious Inside Link
Distraught by the sudden loss of his savings, the victim immediately registered a formal complaint with the local cybercrime cell. Recognizing the severity of the digital intrusion, Rourkela Police launched a comprehensive, multi-state technical investigation, tracking digital trails, IP logs, and beneficiary bank accounts.
The breakthrough came when financial forensics tracked the siphoned funds to specific digital wallets and credit card settlement accounts used to clear personal debt. This financial footprint led investigators straight to Mumbai, where law enforcement teams executed a raid and arrested Chetan Sharad Kurhade (35)a resident of the Kalachowki area.
To the absolute shock of investigators, Kurhade was not an outsider but a working professional employed in the insurance division of a major private lender—HDFC Bank. According to police interrogations, Kurhade allegedly utilized the siphoned funds to pay off his own overdue credit card bills, treating the victim’s life savings as a personal financial bailout.
A Broader Network and Ongoing Manhunt
Following Kurhade’s arrest, Rourkela Police revealed that he was part of a larger, organized cyber fraud ring. Authorities are currently conducting widespread raids and technical surveillance to track down four remaining accomplices linked to the syndicate. Investigators are examining whether the gang has operated similar malware schemes across other states, targeting unsuspecting citizens with fake utility bills, tax refunds, and traffic challans.
How to Protect Yourself From E-Challan and APK Cyber Frauds
Law enforcement agencies and cybersecurity experts have repeatedly warned citizens to exercise extreme caution regarding unsolicited digital communications. To safeguard your finances against similar phishing and malware attacks, keep the following golden rules in mind:
Never Click Unknown Links: Government transport departments and traffic police never send direct APK download links via WhatsApp or SMS for challan payments.
Use Official Portals Only: Always verify traffic fines directly through official government portals such as the Ministry of Road Transport and Highways (MoRTH) Parivahan website.
Never Share OTPs: No bank official, police officer, or government representative will ever ask for an OTP over phone calls or messaging apps.
Immediate Reporting: If you fall victim to cyber fraud, immediately report the incident to the national cybercrime helpline at 1930 or log onto the official portal at cybercrime.gov.in within the crucial “golden hour” to maximize the chances of freezing fraudulent transactions.