A Bengaluru-based deemed-to-be university lost Rs 1.40 crore after an accused allegedly used a fake WhatsApp profile bearing the photograph of its president to direct an accountant to transfer money, the Karnataka Cyber Command said. Four people have been arrested in connection with the case, while a fifth accused is absconding.
The police identified the arrested accused as Annayya, 25, Buspalli Ravikumar Reddy, 26, Ambaraya, 39, and Syed Wajihuddin Quadri, 25. Annayya was arrested in Bengaluru’s K R Puram, while Reddy and Ambaraya, both from Andhra Pradesh, were arrested in Hyderabad during a police raid. Quadri, a Hyderabad resident, was arrested when he allegedly arrived to collect the money.
The police produced the four accused before a court and said efforts were underway to trace the fifth accused, identified as Sunny alias David. Investigators seized Rs 8.50 lakh in cash and four mobile phones during the operation.
The case was reported after university employee Santosh A S filed a complaint on September 9. According to the complaint, an unidentified person created a fake WhatsApp profile using the photograph of university president Dr Chenraj Roychand. On September 8, at around 10.03 am, the person allegedly contacted university accountant Vinay Bhushan and asked about the balance in the institution’s bank account. At around 11.34 am, the account holder allegedly received instructions to transfer Rs 1.40 crore and carried out the transaction believing the message was genuine.
The South Division Cyber Crime Police Station registered a case under provisions of the Information Technology Act and the Bharatiya Nyaya Sanhita. Investigators said the accused had allegedly monitored the university’s financial transactions for 15 to 20 days before initiating the transfer.
According to the police, the accused circulated a ZIP file presented as an important document to staff members. After it was opened, the investigators said, the accused gained access to institutional data by logging into WhatsApp Web through Chrome. Foreign IP addresses were also detected during the transactions.
A senior police official involved in the investigation said the accused allegedly used Trojan malware to access information and monitor the institution’s financial activity. The investigation is examining how the money was routed through bank accounts and the role of account holders involved in withdrawing or transferring it.
The police said Sunny allegedly instructed Annayya to persuade acquaintances to open bank accounts and obtain cheque books in exchange for money. Investigators alleged that the gang obtained the account details and used them to move the funds. Reddy and Ambaraya were allegedly stationed in Hyderabad, while Quadri was summoned to withdraw money through cheques and hand it over to Ambaraya.
Police said the seized Rs 8.50 lakh was allegedly linked to another online fraud case in Aurangabad, Maharashtra. Investigators also said the accused had used more than 60 mule bank accounts in 22 online fraud cases across several states.
The Karnataka Cyber Command advised institutions and individuals to independently verify urgent financial requests, even when they appear to come from senior officials or known contacts. It also warned against opening unknown ZIP files, clicking suspicious links or allowing others to use bank accounts for commissions. People who lose money to online fraud have been asked to contact the cybercrime helpline at 1930 immediately.
