18-year-old arrested for running AI-powered fake banking app fraud network
An 18-year-old school dropout in Uttar Pradesh was arrested for developing and selling AI-generated fake banking applications to cybercriminal networks, resulting in fraudulent transactions worth Rs 64.38 crore across India. The applications impersonated major banks and government services, and were used to steal banking credentials and OTPs from over 21,000 victims across the country.
What happened
An 18-year-old class 11 dropout from Kanpur, Uttar Pradesh named Rohit Virendrasinh Shakya was arrested by the Surat City Cyber Crime Cell for developing and supplying malicious mobile applications used in a nationwide fraud network. Using AI tools and Telegram channels, Shakya created fake banking and government applications that closely resembled genuine apps from banks such as SBI, PNB, Axis, ICICI, Union Bank, and UCO Bank, as well as services including BigBasket, Aadhaar, PM Kisan, and RTO challan payment portals.
Shakya developed two types of applications: a victim app that unsuspecting users installed on their devices, and an admin app that allowed fraudsters to remotely access OTPs, banking credentials, and other sensitive information. He operated a subscription service charging cybercriminals Rs 15,000 per month for access to these malicious apps, including regular updates, maintenance, and technical support. The applications were primarily supplied to organised cybercriminal groups in Jamtara, Jharkhand, as well as networks in Haryana and Rajasthan, with distribution coordinated through Telegram channels.
Reported impact
Shakya created 121 malicious APK files that were installed on 21,672 mobile phones across India. Of these, 2,928 devices were fully compromised, resulting in 54,094 fraudulent banking transactions totaling approximately Rs 64.38 crore. Most cases involved fake RTO challan payment apps, followed by fake SBI and PNB applications.
Index analysis
The investigation began in May 2026 after a Surat resident reported losing Rs 5 lakh in a cyber fraud. The victim received a malicious file over WhatsApp, installed it believing it to be the official PNB One app, and his device was immediately compromised with money transferred to a Union Bank account. The victim contacted the national cyber helpline 1930, which led Surat police to file an FIR and investigate.
Governance controls
Digital forensics conducted on two mobile phones and a laptop seized from Shakya revealed the full scale of the fraud operation. The Surat Police are continuing their investigation to identify other cybercriminal groups using Shakya's software and anyone else involved in the network.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.