Cybercriminals in India have unleashed a sophisticated new phishing scheme, shifting their focus from traditional bank scams to everyday utility services. The latest wave of digital fraud targets Liquified Petroleum Gas (LPG) consumers, utilizing psychological pressure and technical deception to drain bank accounts within minutes.
The Anatomy of the LPG “KYC” Scam
The scam typically begins with an SMS or WhatsApp message that appears to be from a government agency or a major gas distributor like Indane, HP, or Bharat Gas. The message warns the recipient that their LPG connection is scheduled for immediate suspension due to “incomplete KYC (Know Your Customer) documentation.”
To prevent the service disruption, the user is urged to click a link provided in the message. This link directs the victim to a fraudulent website that mimics the official portal of a gas company. Once there, users are asked to download a small “KYC update app” (an APK file) or enter their bank details directly. In many cases, these malicious applications contain spyware or remote-access Trojans (RATs) that give hackers total control over the victim’s smartphone.
How Your Money Is Stolen
Once the malware is installed, the attackers can monitor everything on the device. When the victim attempts a small “processing fee” payment as prompted by the site, the hackers capture the banking credentials and intercept the One-Time Password (OTP) silently in the background. Before the victim realizes the app is fake, their linked bank accounts are emptied through unauthorized transactions.
Safety Measures to Protect Your Savings
Security experts and government officials have issued several guidelines to help citizens avoid falling prey to these utility-based scams:
- Verify the Source: Gas companies never send links via SMS to update KYC or demand personal banking details over the phone.
- Avoid Unofficial Apps: Never download APK files from links sent in messages. Only use official apps available on the Google Play Store or Apple App Store.
- Check URL Legitimacy: Look for “https://” and verify the spelling of the website domain. Scammers often use slightly altered names (e.g., “lpg-update-india.com” instead of the official portal).
- Reporting Fraud: If you have been targeted, immediately report the incident on the National Cyber Crime Reporting Portal at 1930 or visit cybercrime.gov.in.
As digital payments become the norm for utility bills, staying vigilant against unsolicited messages remains the most effective defense against the evolving tactics of cyber-criminals.
