What appeared to be a routine ₹2 courier address-update payment has led Delhi Police to a much larger suspected cyber-fraud network involving stolen identities, fraudulent fuel cards and an alleged financial trail of around ₹10 crore.
Police have arrested three men in connection with the investigation and are examining whether additional people and fraudulent accounts were involved.
The probe began after a Delhi resident reported losing nearly ₹4 lakh following the installation of an APK file presented as a courier-related address update.
A ₹2 Payment Was Followed by Nearly ₹4 Lakh in Unauthorised Transactions
According to the police investigation, Jitender Kumar Gupta received an APK file on May 7 that was presented as part of a courier address-update process.
After entering his banking information while making the small payment, two unauthorised transactions were allegedly carried out within a short period.
Around ₹1.98 lakh was withdrawn in one transaction and another ₹1.90 lakh in a second transaction, taking the immediate loss close to ₹4 lakh.
The subsequent investigation revealed that the stolen funds had allegedly taken an unusual route rather than simply being transferred to another conventional bank account.
Fuel Card Recharge Became a Key Investigative Lead
Police reportedly discovered that approximately ₹1.9 lakh from the victim's account had been used to recharge a prepaid smart fuel-card customer account.
That customer ID was associated with two trucks. Investigators then found that transactions worth approximately ₹15 lakh had been conducted through the related fuel cards.
This transaction pattern prompted police to examine the people and documents connected with the fuel-card accounts.
Telecom records, SIM information, point-of-sale data and enrolment documents were subsequently examined as investigators attempted to reconstruct the network.
Investigation Leads to Three Arrests
A team formed by Delhi Police eventually traced the suspected network to locations in the Mewat region and Rajasthan, including Nuh, Nagina, Pahadi and Bharatpur.
Police identified the arrested individuals as Nasir Hussain, 34, Sokeen, 27, and Ashish Arya, 33.
According to investigators, Nasir has been identified as an alleged key operator in the network. Police are examining a suspected financial trail of approximately ₹10 crore.
Nasir and Sokeen were reportedly arrested on September 28 after investigators traced their movements.
Video KYC Helped Investigators Connect the Suspects
Video KYC records associated with a fuel card reportedly provided an important lead.
Police traced the KYC process to Ashish Arya, a former retail business executive. Investigators allege that the fuel-card enrolment was completed without proper physical verification of the documents.
According to the police account, Arya told investigators that Sokeen was the individual whose video KYC he had conducted. Police are also examining allegations that payments were made to facilitate the enrolment.
The investigation is continuing to determine the extent of involvement of each person.
Stolen Identity Documents Were Allegedly Used for Fuel Cards
Police have reportedly identified more than 100 suspicious fuel cards, while questioning has indicated that approximately 150 to 200 cards may have been prepared.
Each card allegedly carried a limit of around ₹7.5 lakh.
Investigators suspect that identity and vehicle documents belonging to truck owners were obtained through a transport-related platform under the pretext of arranging bookings.
The documents were allegedly altered and subsequently used during fuel-card applications and KYC procedures.
Police further allege that photographs and addresses were manipulated with the assistance of AI-based tools.
Suspected Network Could Be Much Larger
The investigation has expanded considerably from the original courier scam complaint.
What initially appeared to be a small APK-based banking fraud has now led police to examine a network involving numerous fuel cards, allegedly misused identity documents and transactions worth millions of rupees.
The suspected ₹10 crore financial trail is still being investigated, and authorities are examining additional cards, accounts, operators and transactions to establish the full scope of the network.
A Small Payment Can Hide a Much Larger Risk
The case highlights how fraudsters can use seemingly minor payments to persuade victims to interact with malicious applications.
Users should avoid installing APK files received through unsolicited messages, particularly when a courier, delivery or government-related request is involved. Payment or address-update requests should be verified through the service provider's official website or application rather than an unfamiliar link.
For organisations examining suspicious transaction patterns, identity-related financial risks or complex money trails, Financial Investigation can be relevant to a broader review.
The Delhi Police investigation remains ongoing, and further arrests or details about the alleged network may emerge as investigators continue tracing the financial and digital evidence.