Delhi Police have arrested an 18-year-old student from Gorakhpur, Uttar Pradesh, for allegedly developing malicious Android applications used in a cyber fraud case involving ₹17 lakh stolen from a retired government employee in West Delhi. According to the supplied report, the victim was deceived into installing an application presented as a tool to update a pension-related life certificate.
The arrest followed a digital investigation that reportedly traced the technical infrastructure used in the alleged fraud to the student. Police are now examining seized electronic devices and pursuing other suspected members of the network.
How the Alleged Pension Certificate Scam Worked
Investigators said the victim was approached with the promise of assistance in generating an official life certificate online. Such certificates are commonly required by pensioners to continue receiving pension payments.
The victim was reportedly instructed to install an APK file on an Android phone. According to police, the malicious application enabled the perpetrators to obtain confidential information and transfer ₹17 lakh from the victim’s bank account.
An FIR was registered at the Hari Nagar Cyber Police Station in connection with the incident. The case prompted a technical investigation into the software and digital infrastructure allegedly used to carry out the transaction.
The incident highlights the risks associated with installing mobile applications received through unofficial channels, particularly when they are presented as tools for accessing government services.
Telegram Contact and Alleged Monthly Payments
According to the report, the arrested student, identified as Karan Kumar, came into contact with a man named Nishant Yadav through a Telegram channel around eight months before the arrest.
Investigators allege that Yadav engaged Kumar to develop customised APK files for phishing and unauthorised access to mobile data. The student was reportedly paid ₹50,000 per month for his technical work.
Police also stated that Yadav had provided him with an Apple MacBook to support the development activity. During a search of the student’s rented residence in Saket Nagar, officers seized a laptop and an iPhone.
The devices are undergoing forensic examination. Investigators are expected to review communications, payment records and other digital evidence that could help establish how the applications were created, distributed and used.
Malicious APK Files Under Investigation
The report states that the student learned coding and application development through publicly available YouTube tutorials. Investigators reportedly identified at least two APK files attributed to him, circulated under the names Root Force Live and Ginoshell.com.
The investigation also refers to a software tool called Digital Lutera in connection with the alleged operation.
Police are examining the source code, scripts and stored records recovered from the seized devices. The analysis is intended to establish how the applications functioned, what information they may have collected, where the data was sent and whether other people were affected.
The full scope of the alleged network and the roles of individual suspects remain matters for investigators to establish.
Police Pursue Other Suspected Associates
The investigation has reportedly expanded beyond the arrested student. Two other individuals, identified in the report as Dipesh Patel of Patna, Bihar, and Bhavesh Yadav of Delhi, have emerged as suspects.
Delhi Police teams are conducting searches to trace the two men and investigate their alleged involvement. Authorities are also working to identify the bank accounts that received the stolen money and determine whether additional victims may be linked to the same operation.
The student was reportedly taken into custody in the Ramgarhtal police station area of Gorakhpur and brought to Delhi on transit remand after being produced before a local court.
What Pensioners and Families Should Watch For
The case serves as a reminder to verify digital requests involving pensions, banking and government documentation. People should avoid installing APK files sent through unsolicited messages or unfamiliar websites, and should access official services through verified government portals.
Anyone who suspects that a phone or bank account has been compromised should contact their bank promptly and report the incident through official cybercrime reporting channels. Families can also help older relatives recognise suspicious requests for app installations, passwords, one-time passwords and banking details.
Businesses and individuals handling sensitive financial information can also benefit from appropriate financial investigation services when they need support understanding suspicious transactions or potential fraud.
Investigation Continues
The forensic examination of the seized devices and efforts to trace the other suspects are ongoing, according to the supplied report. Investigators are working to establish the alleged network’s structure, identify possible additional victims and trace the movement of the stolen funds.
The allegations against the arrested student and the other named individuals have not been established in court. Further details will depend on the outcome of the investigation and any subsequent legal proceedings.