An Ahmedabad resident lost ₹9,77,800 in an alleged online fraud while trying to book accommodation for a Diwali holiday in Nagpur through Airbnb, after scammers posing as customer-support representatives allegedly gained access to his mobile phone and bank accounts.
The 75-year-old resident of Navrangpura, identified in the complaint as Nitin Kantilal Hathi, approached the cybercrime police after 17 transactions were made from his savings accounts. The complaint states that the fraudsters also changed the email address linked to his bank accounts and added another email ID.
According to the report, Hathi was attempting to book a room through the Airbnb application on October 19. He reportedly contacted a number described as Ahmedabad Airbnb customer care after he was unable to upload a photograph of his PAN card on the online booking form.
The people who responded allegedly continued the interaction through a video call and WhatsApp chat. They sent him an Android Package Kit, or APK, file named “Customer Support FUD.apk” and asked him to download it. The complainant also shared a screenshot of a message related to the Nagpur room reservation after being asked to provide it, while the WhatsApp calls and chats continued through the day.
A second APK file was subsequently sent from another unknown mobile number. The file was named “Bank of India pension card verification online”. The report states that opening it caused an application resembling a Bank of India app to be downloaded on the complainant’s phone. He deleted the application after becoming suspicious.
The following day, Hathi received a message stating that ₹11,800 had been debited from his Bank of India account. The available balance was shown as ₹32.95. He then contacted the bank and had the account blocked.
When he visited the bank, he reportedly learned that both savings accounts had been altered and that his original email address had been replaced or supplemented with another email ID. Examination of the account statements showed that 17 transactions had withdrawn a total of ₹9,77,800, according to the complaint.
The alleged fraud combined a travel booking request with a bank verification pretext. The attackers are reported to have used APK files to obtain access to the mobile device before carrying out transactions from the linked accounts. The incident has consequently raised concerns about the risks created when customer-support interactions move from an official platform to unknown phone numbers and messaging accounts.
The case has been registered with the cybercrime police station in Ahmedabad. The supplied report does not provide details of arrests, recovery of the money or further investigative action. The police investigation will determine how the device and banking credentials were accessed and where the transferred funds were sent.
