A ₹1.9-crore cyber fraud targeting Sage University in Bhopal was foiled on Thursday, 24 September 2026, after the Katara Hills police swiftly recovered a compromised WhatsApp account belonging to an accountant who had been allegedly tricked into initiating the transfer. The timely intervention prevented what could have been one of the largest single-instance digital payment frauds targeting a private educational institution in Madhya Pradesh this year.

How the Attack Unfolded

Rishabh Bhargava, an accountant at Sage University, received a WhatsApp message at around 2:30 pm purportedly from the university's Chairman and Managing Director (CMD) Sanjeev Agrawal. The message instructed him to urgently transfer ₹1.9 crore to a bank account registered in the name of Bound Builders OPC Private Limited.

Bhargava responded with 'Yes Sir' and proceeded to add the specified bank account as a beneficiary in the university's account. He subsequently noticed that his own WhatsApp account appeared to be operating without his control — a telltale sign that his account had been taken over — and immediately raised the alarm.

Police Response and Account Recovery

Bhargava contacted Katara Hills police station, triggering a rapid response from the station's cyber team. Police lodged a complaint with WhatsApp's support team and generated a recovery ticket. The applicant's email account was also deployed to expedite the support process. The compromised WhatsApp account was restored shortly afterwards, allowing Bhargava to regain full control and resume communications.

'Rishabh received a WhatsApp message from a number claiming to belong to the university's CMD and was asked to make a payment of ₹1.9 crore. He became suspicious after noticing unusual activity on his WhatsApp account and immediately approached the police,' said Katara Hills Station House Officer (SHO) Sunil Dube.

The Fraud Confirmed

Once Bhargava regained control of his account, he contacted senior colleagues at the university. They confirmed that CMD Sanjeev Agrawal had sent no such message and had not authorised any transfer. The message was entirely fabricated — a classic 'CEO fraud' or business email compromise tactic, adapted for WhatsApp.

This type of attack, where fraudsters impersonate senior executives to authorise large payments, has been rising sharply across Indian institutions. Notably, this is at least the third high-value WhatsApp impersonation fraud reported in Madhya Pradesh in recent months, according to reports.

Officers Behind the Operation

The operation was conducted under the supervision of DCP Zone-2 Vikas Kumar Lawania and Additional DCP Zone-2 Mini Tiwari, with ACP Baghsewania Umrao Singh overseeing field coordination. Constables Vipin Singh Rajawat and Jitendra Singh Dangi, who handle cyber-related work at Katara Hills police station, played a key role in recovering the compromised account.

Investigation and Advisory

Police are now investigating the identity of the individuals who allegedly impersonated the CMD and attempted to facilitate the transaction. SHO Dube issued a public advisory: 'The timely response helped prevent the ₹1.9-crore cyber fraud. People should independently verify any request for large financial transactions received through WhatsApp or other messaging platforms before acting on it.'

Cybersecurity experts broadly recommend using out-of-band verification — such as a direct phone call to the requester's known number — before processing any large transfer instruction received via messaging apps. The investigation remains ongoing.