Delhi Police bust ₹10-crore phishing network; 5 arrested after ₹2.21 lakh challan fraud
Synopsis
A ₹2.21 lakh traffic-challan complaint cracked open a ₹10-crore phishing empire. Delhi Police found a fake reward app — 'Wingo Cash' — silently turning ordinary users' phones into SMS relay devices for mass fraud. Over 41,000 people were paid ₹1–₹3 per redemption, unknowingly enabling scam messages that victimised hundreds across India.
Key Takeaways
Delhi Police busted a phishing network on 31 October 2026 linked to over ₹10 crore in fraud across 544 national complaints.
The probe began with a ₹2.21 lakh unauthorised credit card transaction triggered by a fake traffic-challan SMS link.
A reward app called 'Wingo Cash' covertly used victims' phones to relay 9–12 phishing SMS messages per redemption session.
More than 41,000 users were paid ₹1–₹3 each, while approximately ₹2 crore flowed through Shree Balaji Enterprises , Mumbai in just three days .
Five accused — Moti Singh Baghela , Harshpal , Vicky , Vishal Das Vaishnav , and Barjesh Kumar — were arrested after raids in Mumbai , Lucknow , Delhi , Rajasthan , and Punjab .
Recoveries include 59 debit cards, 52 passbooks, 15 phones and tablets, 8 QR-code scanners, and 14 company stamps.
Delhi Police's South-West District Cyber Police Station has dismantled an organised cyber fraud network that used phishing SMS messages to impersonate traffic challans, delivery verifications, and reward-point communications, officials said on Saturday, 31 October 2026. A complaint involving an alleged fraud of ₹2.21 lakh unravelled a web of deceit linked to 544 complaints filed across India, with total cheated amounts exceeding ₹10 crore.
How the Scam Operated
The case began when a complainant received an SMS containing a fraudulent link disguised as a traffic challan payment request. After clicking the link, an unauthorised transaction of ₹2.21 lakh was made from his credit card without his knowledge.
Technical analysis traced bulk SMS activity to around 3 November 2025, when approximately 3,300 suspicious messages were dispatched to recipients nationwide. Investigators eventually traced one of the numbers used to send messages to the handset of a school student, who had unknowingly installed an application called 'Wingo Cash' through a WhatsApp group.
The 'Wingo Cash' Relay Mechanism
According to the investigation, the application functioned as a covert SMS relay device. Whenever users redeemed rewards through 'Wingo Cash', their mobile screens were locked for roughly 30 seconds. During that window, the app silently generated and dispatched between 9 and 12 phishing SMS messages — containing fake traffic challan links, delivery-address verification requests, and reward-point lures — to unsuspecting recipients across the country.
Users were paid between ₹1 and ₹3 per redemption, unaware that their phones were serving as relay nodes in a large-scale phishing operation. This is a particularly insidious model: it turns ordinary citizens into unwitting instruments of financial crime.
Financial Trail and Key Arrests
The financial trail initially pointed to an account held with the National Bank of Kuwait, complicating immediate attribution. Investigators subsequently examined accounts used for reward payouts and traced transactions to a Shree Balaji Enterprises account in Mumbai. According to police, approximately ₹2 crore was funnelled through numerous small-value transactions to more than 41,000 users of the suspect application within just three days.
Based on technical and financial evidence, police conducted coordinated raids across Mumbai, Lucknow, Delhi, Rajasthan, and Punjab, leading to the arrest of five accused: Moti Singh Baghela, Harshpal, Vicky, Vishal Das Vaishnav, and Barjesh Kumar.
Recoveries and Scope of the Network
Police recovered a car, a gold chain, 15 mobile phones and tablets, 59 debit cards, 52 passbooks and cheque books, 14 stamps of firms and companies, five point-of-sale machines, and eight QR-code scanners from the accused.
The investigation further revealed a parallel network engaged in procuring company documents, current bank accounts, and other banking infrastructure on commission — a common enabler of large-scale cyber fraud operations in India. All 544 complaints registered on the National Cyber Crime Reporting Portal (NCRP), involving sums exceeding ₹10 crore, have been formally linked to this network.
What Happens Next
Further investigation is underway. Authorities are expected to probe the full extent of the banking infrastructure network and identify additional beneficiaries of the 'Wingo Cash' payout system. Cybersecurity experts have long warned about reward-app exploitation as an emerging vector for mass phishing — this case is reportedly one of the largest of its kind dismantled in Delhi this year.
Point of View
Operators effectively distributed both the cost and the legal risk across an unsuspecting public. The National Bank of Kuwait routing also signals a deliberate cross-border laundering layer that local enforcement cannot easily unravel alone. India's NCRP has received over 544 complaints in this single case, yet the portal's data-to-action pipeline remains opaque — the real accountability question is why a network generating 3,300 suspicious SMS blasts went undetected for months before a single ₹2.21 lakh complaint triggered the takedown.
NationPress
31 Oct 2026
Frequently Asked Questions
How did the Delhi Police phishing network operate?
The network used a fake reward application called 'Wingo Cash' to turn ordinary users' smartphones into covert SMS relay devices. Each time a user redeemed rewards, the app locked their screen for about 30 seconds and silently sent 9–12 phishing messages containing fake traffic challan, delivery verification, and reward-point links to other recipients.
How much money was involved in the Delhi cyber fraud case?
The total amount linked to the network exceeds ₹10 crore, spread across 544 complaints filed on the National Cyber Crime Reporting Portal (NCRP). The initial complaint that triggered the investigation involved an unauthorised transaction of ₹2.21 lakh from a victim's credit card.
Who were the five people arrested in the Delhi phishing case?
Delhi Police arrested Moti Singh Baghela, Harshpal, Vicky, Vishal Das Vaishnav, and Barjesh Kumar following raids in Mumbai, Lucknow, Delhi, Rajasthan, and Punjab. The arrests were based on technical and financial evidence traced through the network's payout accounts.
What is the 'Wingo Cash' app and how did it defraud users?
'Wingo Cash' was a reward application distributed via WhatsApp that paid users ₹1–₹3 per redemption session while covertly using their phones to send phishing SMS messages. Users were unaware their devices were functioning as relay nodes in a large-scale fraud operation; more than 41,000 users were reportedly part of this payout system.
How was the money trail uncovered in the Delhi phishing network case?
Investigators initially hit a dead end when the financial trail led to an account with the National Bank of Kuwait. They subsequently traced reward-payout transactions to a Shree Balaji Enterprises account in Mumbai, through which approximately ₹2 crore was distributed to over 41,000 users in just three days, providing the link needed to identify and arrest the accused.
