The costly lesson about phone passwords that some Delhi residents just learnt

The use of weak passwords can lead to dire repercussions, quite a few Delhi residents just realised the hard way. Recently, law enforcement officials dismantled two criminal gangs engaged in transferring funds using stolen and snatched mobile phones. These gangs, which trained minors to exploit weak passwords, managed to smuggle approximately 12,000 mobile devices to countries such as Bangladesh, Nepal, and Bihar over the past year, amassing at least Rs 12 lakh in the process. Four individuals from these gangs were apprehended: Vishal Kumar (24), Jaswant Ray (30), Ramesh Kumar (36), and Munni Lal Mahto (30), ToI’s Abhay reported on February 22.The investigation began on January 16, when police received a complaint from a businessman who reported that his phone had been stolen from his pocket in Chandni Chowk. It was later revealed that Rs 5.3 lakh had been withdrawn from his bank account. A case was subsequently registered. In a separate incident, another FIR was lodged when a man claimed he lost Rs 2.5 lakh in Gulabi Bagh after his phone was stolen. In light of the similar methods employed in these cases, DCP (North) Raja Banthia formed a specialized team consisting of inspector Rohit Saraswat and sub-inspector Prashant. The investigators found a significant lead when they traced a mobile recharge made using the businessman’s UPI ID.

“The recharge was carried out by an individual located in the Bara Hindu Rao area, where we later apprehended Vishal,” the officer stated. During interrogation, Vishal revealed a network involved in transporting stolen mobile phones to Nepal via Munger. He sourced phones from snatchers and pickpockets and employed common, weak passwords such as “123456” to gain access to victims’ UPI IDs. He then transferred funds to various accounts and withdrew the money using a prohibited app typically used for bitcoin transactions.

Another officer elaborated, “After inserting the SIM cards, Vishal would access the victims’ phone numbers through the settings. He would then attempt to access their UPI accounts using permutations of the first six and last six digits, or other common combinations. Since he controlled the SIM card, he could easily obtain the OTP required to create a UPI ID.”

According to police sources, the thieves could extract sensitive information from certain mobile phones due to weak password protection. “In some cases, the victims had used their birthdays as UPI passwords. This information was easily accessible to the gangs through ID cards stored on the victims’ devices.” Vishal’s associate in Munger regularly dispatched Jaswant to collect stolen phones every 15 days. Ramesh was apprehended while accepting a parcel filled with stolen phones. In total, police recovered 171 phones from the three suspects.

As the investigation continued into the second theft and subsequent money transfer involving a doctor, authorities discovered that the SIM card from the victim’s phone had been placed into another device. A raid in Jyoti Nagar led to the arrest of Mahto, while another suspect managed to escape. Further inquiries revealed that members of this gang were sheltering several minor children, who were being trained to steal mobile phones from unsuspecting individuals. These minors were brought in from Sahibganj and instructed on how to carry out the thefts. Over 100 phones were recovered as part of this ongoing investigation.