Key Points

The incident has triggered calls for a deeper investigation into why such glitches are frequently occurring, putting millions of users at risk.

According to police, the glitch in the MobiKwik app allowed transactions to be recorded as successful even when users had insufficient balances in their bank accounts or wallets, or when incorrect passwords were entered.

The accused allegedly misused this flaw to transfer money to their bank accounts, causing heavy losses of around Rs 40 crore.

Industry experts said the MobiKwik case is not an isolated one. In August, Policybazaar Insurance Brokers Private Limited also lodged a complaint with Gurugram Police after fraudsters impersonated its employees, forged documents, and misused the company's ID cards and email IDs to cheat customers.

In that case, at least 11 customers were duped into paying amounts ranging from Rs 8,510 to Rs 35,000, with the total fraud amounting to Rs 2.08 lakh.

Experts warn that repeated cases of such technical flaws and fraudulent activities in fintech platforms could undermine consumer trust.

They have urged regulatory bodies and government agencies like the ED and CBI to carry out a thorough probe into why these vulnerabilities continue to surface and whether there are deeper systemic risks involved.

In Mobikwik case, police officials said that about 2,500 bank accounts were linked to the fraud, all of which have now been frozen.

Nearly Rs 8 crore has already been recovered. The six accused, identified as Rehan, Mohammad Sakil, Wakar Yunus, Wasim Akram, Mohammad Amir and Mohammad Ansar, were arrested from Gurgaon and sent to judicial custody after being produced in court.

The fraud came to light after MobiKwik filed a complaint with Gurugram Police on September 13. The company had detected suspicious transactions during an internal audit a day earlier.

Investigations revealed that some merchants registered on the platform, along with unknown individuals, misused the flaw to get funds credited despite failed transactions.

This resulted in wrongful gains for the accused and losses for the company. The police have registered a case under Sections 318(4) (cheating of a valuable security) and 314 (dishonest misappropriation of property) of the Bharatiya Nyaya Sanhita (BNS). Officers said the probe is still on and more people involved may be identified as the investigation progresses.

In an exchange filing, the company said that they are undertaking all possible and necessary efforts to recover the amount. However, since the police investigation and recovery efforts have just started, it's not yet possible to ascertain the impact.

"The company is taking aggressive collection efforts while pursuing legal course of action to recover the full amount over a period of time," it added.

Meanwhile, in a statement to IANS, the company's spokesperson confirms that this is not a cybersecurity incident, and no user or merchant credentials or other data have been compromised.

- IANS