Cybercriminals Are Stealing Money Without OTPs or UPI PINs.
Cybercriminals are deploying a dangerous new “accident alert” cyber fraud scam that exploits fear and urgency to steal money directly from victims’ bank accounts—without requiring OTPs, UPI PINs, or login credentials. Law enforcement agencies and cybersecurity experts warn that the scam is spreading rapidly, especially in rural and semi-urban areas, with unsuspecting users losing significant amounts within hours.
How the ‘Accident Alert’ Cyber Scam Works
The fraud begins with a panic-inducing phone call claiming that a close family member has met with a serious accident. The caller promises to send photos of the injured person via WhatsApp and abruptly disconnects. Shortly after, the victim receives what appears to be an image file, often disguised as a JPEG.
The moment the file is opened, malware silently installs itself on the smartphone, giving attackers remote access to the device. Victims usually see no immediate warning signs, making the scam particularly effective and difficult to detect.
Real Case: ₹50,000 Stolen Without Sharing Any Details
In a recent case from Kheda district, a farmer received an evening call claiming that a relative had been injured. Alarmed, he opened the file sent to him, briefly noticing an unusual scanner-like interface instead of a photo. Though he deleted the file and switched off his phone, the damage had already occurred.
Later that night, he discovered that nearly ₹50,000 had been withdrawn from his bank account via a UPI transaction. Investigations revealed that the malware had enabled unauthorised access to his banking apps. The victim subsequently reported the incident to the cybercrime helpline and local police.
The Technology Behind the Fraud
Cybersecurity experts explain that the scam relies on Remote Access Trojans (RATs) hidden inside image files. Once activated, the malware abuses accessibility permissions, allowing fraudsters to:
- Monitor screen activity in real time
- Read SMS and app notifications
- Access banking and UPI apps
- Initiate transactions silently
Unlike traditional phishing attacks, this method does not require victims to click links or share credentials, making it far more dangerous.
Why This Scam Is So Effective
The use of emotionally charged scenarios—such as accidents, hospital emergencies, or police cases—is intentional. Panic overrides rational thinking, leading victims to open unsolicited files without verification. In many cases, money is routed through multiple mule accounts, making recovery and tracing extremely difficult.
Authorities warn that infected devices may remain compromised even after the initial theft, leading to repeat unauthorised transactions days later, despite blocking cards or changing PINs.
How to Stay Safe from ‘Accident Alert’ Cyber Frauds
Police and cybersecurity officials recommend the following precautions:
- Never open unsolicited files or images received on WhatsApp or other messaging apps
- Always verify emergency claims by calling the concerned family member directly
- Keep smartphones updated with the latest security patches
- Install apps only from official app stores
- Regularly review and restrict accessibility permissions
- If your phone shows unusual behaviour (overheating, battery drain, pop-ups), disconnect from the internet immediately
If you suspect fraud, act quickly:
- Report the incident to the national cybercrime helpline
- Inform your bank immediately to freeze transactions
- Visit the nearest cybercrime police station
- Experts stress that early reporting significantly improves the chances of fund recovery.
As digital payments and mobile banking continue to expand across India, authorities emphasise that public awareness and caution remain the strongest defence against evolving cybercrime techniques built on fear, urgency, and deception.
