A 65-year-old retired Army soldier from Shirur in Pune district has lost ₹28.7 lakh after falling victim to a remote-access cyber fraud that began with a purported pension-verification message on WhatsApp.
According to Pune rural police, the incident occurred on the morning of September 11. The victim received a message from an unknown number containing a link to a file titled “Pension Card Verification Retired Personnel.” Believing the communication to be an official requirement related to his Army pension, he downloaded and opened the Android Package (APK) file.
Shortly afterwards he received a call from another number. The caller identified himself as a bank official and stated that he would assist in preparing a senior-citizen pension account. The caller instructed the victim to keep his mobile phone switched on. Multiple one-time passwords (OTPs) subsequently arrived on the victim’s phone; the caller directed him not to share those codes.
Later the same afternoon, the victim began receiving transaction alerts from his pension and savings accounts. Within three hours, nine unauthorised transfers totalling ₹28.7 lakh had been completed.
The matter was reported through the National Cyber Crime Reporting Portal with the assistance of the victim’s daughter. Shirur police have registered a first information report and have commenced investigation.
Police officers described the episode as a typical remote-access scam. Fraudsters commonly pose as representatives of banks, utility providers or government departments and create a sense of urgency around routine services such as pension verification, KYC updates or bill payments. Victims are persuaded to install unofficial APK files sent via messaging applications. Once installed and granted permissions, such applications can enable unauthorised access to the device and facilitate fraudulent transactions.
Authorities have advised citizens not to install applications received through WhatsApp, SMS or other unsolicited channels, particularly when the sender asks them to bypass official app stores or grant unusual permissions. Genuine service providers do not require customers to download unknown APK files in order to complete pension verification or similar routine procedures.
Anyone who receives such a message is urged to verify the communication independently through official channels and to report suspected fraud immediately on the National Cyber Crime Reporting Portal or by dialling 1930.
