He was trying to resolve a delivery complaint. Instead, he allegedly lost ₹95,000.

A computer business owner from Ahmedabad reportedly lost the amount after contacting a fake customer care number he found through a Google search. What began as a routine service complaint allegedly turned into a case of financial cyber fraud.

The incident highlights a growing risk in our digital lives: the search for legitimate help can lead users straight into a cybercriminal's trap

How a Delivery Complaint Turned Into a Cyber Fraud Case

According to media reports, a computer business owner from Ahmedabad allegedly lost ₹95,000 while attempting to resolve a Rapido delivery complaint.

After searching Google for Rapido customer support, the businessman reportedly contacted a fraudulent number. The individual who answered allegedly instructed him to install an APK file named Customer Support.apk, keep his phone switched on, enable screen sharing and make a ₹1 payment through Google Pay.

Shortly afterwards, ₹95,000 was debited from his Axis Bank account. According to the complaint, the funds were transferred to an account held with Bank of Maharashtra. The businessman stated that he had not shared an OTP before the transaction.

The precise technical mechanism remains under investigation. Nevertheless, the reported sequence highlights a critical security concern: fraudsters can exploit trusted service interactions to create opportunities for device compromise and unauthorised financial activity.

Understanding the Attack Chain

Fake customer care fraud is a form of social engineering that combines impersonation with attempts to manipulate user behaviour, obtain access or facilitate unauthorised transactions. The attack chain typically involves several stages.

1. Initial Contact: Fraudulent Search Results. Fake customer care numbers can reach users through fraudulent online listings, paid advertisements and misleading or edited Google Maps entries. These may direct users to individuals impersonating legitimate customer support representatives.

   A number appearing in Google search results does not automatically mean it belongs to the official company.

2. Trust Exploitation. The attacker uses an existing complaint or service issue to establish credibility and encourage the victim to follow instructions. The promise of resolving a delivery issue, refund or payment dispute can make the interaction appear legitimate.

3. Malicious Application Delivery. The victim is persuaded to install an APK file presented as a legitimate support or verification tool. Depending on its capabilities and the permissions granted, a malicious application may attempt to access sensitive information or misuse device functionality.

4. Access and Manipulation. Requests for screen sharing, accessibility permissions or other forms of device access may expose sensitive information or create opportunities for unauthorised activity.

5. Financial Impact. An attacker may exploit compromised information, device functionality or manipulated user actions to facilitate fraudulent transactions.

The specific mechanism varies between incidents. However, the pattern is consistent: the attacker exploits the victim's trust to create an opportunity for financial loss.

Why This Matters Beyond Individual Financial Loss

This case demonstrates a broader cybersecurity challenge: the security of a digital transaction depends on more than authentication alone.

An OTP is an important security control, but it cannot independently protect against every form of social engineering, compromised device or misuse of access permissions.

Similarly, an application presented as customer support is not necessarily legitimate. The source of the application, its requested permissions and the actions it enables must all be considered.

For organisations, these attack techniques can have implications beyond individual accounts. Compromised employee devices, exposed credentials and unauthorised access may create pathways to corporate applications, business communications and sensitive information.

This is also why organisations need visibility into their external digital exposure. Internet-facing assets that are overlooked or insufficiently monitored can introduce additional security risks, reinforcing the importance of identifying and managing potential exposures as part of a layered cybersecurity strategy.

This reinforces the need to approach cybersecurity as a layered discipline encompassing identity security, endpoint protection, access governance, user awareness and incident response.

Strengthening Defences Against Fake Customer Care Fraud

Reducing exposure requires coordinated action from individuals, organisations and digital service providers.

For Individuals

1. Verify Customer Care Numbers Through Official Channels. Use the service provider's official application or website to find customer support details. Type the website address directly into your browser rather than relying on unfamiliar search results, advertisements or online listings.

2. Avoid Installing Unverified APK Files. Do not install application files received from unknown contacts, even when they are presented as customer support or verification tools.

3. Never Enable Screen Sharing for an Unverified Contact. Screen sharing and remote-access tools can expose sensitive information. Do not activate these features at the request of an unverified representative.

4. Question Unexpected Payment Instructions. A request to make a small payment does not establish that a customer support representative is genuine. Verify the request independently before proceeding.

5. Review Application Permissions. Be cautious when an application requests accessibility access, SMS access, screen-sharing capabilities or other permissions that are unnecessary for its stated purpose.

For Organisations

• Implement cybersecurity awareness programmes focused on social engineering, impersonation and fraudulent support requests.

• Enforce application installation policies and deploy appropriate mobile device security controls.

• Strengthen endpoint protection to help detect suspicious applications and activity.

• Improve identity and access management through appropriate authentication controls and least-privilege principles.

• Establish incident response procedures for suspected device compromise, credential exposure and financial fraud.

Security controls must be supported by clear processes and regular assessments. Awareness training should also evolve alongside the techniques used by attackers.

Incident Response: The First Hour Matters

If you suspect that you have installed a malicious application or experienced an unauthorised financial transaction, act immediately. The priority is to limit further exposure, secure financial accounts and report the incident.

• Step 1: Disconnect the Potentially Compromised Device. Turn on airplane mode or switch off mobile data and Wi-Fi to disconnect the phone from the network. Avoid using the device for banking or other sensitive activities until it has been assessed.

• Step 2: Contact Your Bank Immediately. Call your bank using its official contact number. Report the unauthorised transaction and request immediate action to secure your account, cards and UPI access.

• Step 3: Report the Fraud. Call India's national cybercrime helpline at 1930 and report the incident through the official National Cyber Crime Reporting Portal at cybercrime.gov.in.

  Prompt reporting can help authorities and financial institutions initiate appropriate action. The first hour matters, so do not delay reporting while attempting to investigate the incident yourself.

• Step 4: Remove the Suspicious Application. Once the device is safely disconnected, uninstall the unknown application and revoke any permissions granted to it, where possible. If you cannot establish that the device is secure, seek technical assistance before reconnecting it or using it for sensitive activities.

• Step 5: Secure Your Accounts from a Trusted Device. Using a separate, trusted device, change your UPI PIN, banking passwords and Google account password. Review account activity and secure any other accounts that may have been exposed.

Preserve relevant evidence, including suspicious messages, phone numbers, application details and transaction alerts. Avoid opening suspicious files again.

The Industry Imperative: Build Security into Everyday Decisions

This incident is a reminder that cyber risk does not always originate from a sophisticated technical exploit. It can emerge when legitimate user behaviour is manipulated through deception.

For the cybersecurity industry, the priority must be to strengthen the relationship between technical controls and human decision-making.

Organisations need security architectures that limit the impact of compromised devices, processes that enable rapid reporting, and employees equipped to recognise social engineering.

At TechOwl InfoSec, we believe effective cyber resilience requires a proactive, layered approach that combines threat awareness, access protection, continuous monitoring and incident readiness.

TechOwl Shield complements this approach by helping organisations understand what is exposed across their external digital footprint. By discovering and monitoring internet-facing assets, it supports the identification of potential exposures before they become entry points for attackers. While external attack surface management does not replace protections against social engineering or compromised devices, it adds an important layer of visibility to an organisation's overall security posture.

Trust should be verified. Access should be controlled. Every suspicious interaction should be treated as a potential security signal.

In an increasingly connected digital ecosystem, security is not defined solely by the strength of the technology deployed. It is also defined by how effectively people, processes and systems work together to prevent, detect and respond to threats.