1 click on loan ad, Rs 17 lakh extorted: fraud forces banker to leave Mumbai

On May 25, police arrested six Mumbai residents — Suresh Waghmare, Paresh Garival, Praveen Jadhav, Praveen Thorat, Ravi Jaiswal and Valmik Gupta — in what they claim was an elaborate instant loan extortion scam. Investigators say the 37-year-old man and his family were subjected to stalking, harassment and escalating public humiliation during the year-long scam, with the suspects even threatening to harm his son and toddler daughter.

According to the police, the man paid Rs 17.6 lakh between April 2025 and May 2026, with the suspects insisting he still owed Rs 10.08 lakh.

For the family, originally from Ranchi, the arrests ended a year of trauma. “I couldn’t concentrate at work. I didn’t visit my parents for nearly a year because I wanted to hide everything from them. Even when I went out for a walk, my phone never stopped ringing,” he says.

How it began

Ironically, he was working as a relationship manager with an international bank in Mumbai. How did a banker fall prey to such a scam? “It started on April 17 last year. I was watching some videos on the internet when an advertisement for a loan application appeared. I was curious to understand this loan process and I clicked on the link,” he says.

He says that as soon as he clicked the link, an Account Aggregator window appeared on his phone. “Before I could understand what was happening, the OTP was automatically fetched by the application, and Rs 23,150 was credited to my bank account. I was told later that the OTP gets automatically detected on Android phones. I didn’t know this,” he says.

He says he wanted to return the money as soon as he realised the loan app had credited it to his account but didn’t know how. “Nobody had contacted me or explained the process. Initially, I thought it was a technical error and searched online for ways to return the sum but found nothing. There was no official contact information available,” he says.

A week later, the first call allegedly came on April 23. “The caller identified himself as the recovery agent and demanded repayment. More calls followed. I received around 10-12 calls,” he says. “I asked them (recovery agents) if I could clear the loan. One of them sent me a UPI QR code and demanded immediate payment with interest.”

Out of fear, he allegedly paid Rs 34,750, but the calls didn’t stop. He was allegedly told the loan wasn’t fully cleared. “I was sent an APK file to install to make the final payment,” he says. Investigators say this was used to clone his mobile phone, enabling them to gain unauthorised access to his device and personal data.

Over the next few months, the cycle allegedly repeated itself. Lenders would refuse payment, send another link to a new app and make him pay. Debt swelled, desperation grew and, by the end of the year, he had borrowed from 19 different loan apps.

“Every time I repaid one loan, I was forced to borrow from another loan application to settle the previous dues. I began borrowing from my family to pay the extortion money, but could never tell them why,” he says.

Meanwhile, downloading these apps gave the suspects unauthorised access to the victim’s phone — his contacts, photographs and text messages. “They knew that my salary was credited on the 25th of every month. I still don’t know how they gained access to my banking information,” he says.

But why did he keep his ordeal a secret? “The fear of public humiliation,” he says. “I didn’t tell anybody because I somehow believed if I returned the money, it would end. I wish I hadn’t.”

Then, in June last year, the harassment escalated: threats turned into violence. The callers, he says, were both men and women.

“They began visiting my house, even when I was at work. They would knock on my neighbours’ doors and tell them that I had defaulted on loans. They would use my phone contacts to call my co-workers and relatives, urging them not to trust me. If I didn’t answer, they would call from another number,” he says. “They even threatened to abduct and rape my wife.”

On December 2 last year, three men allegedly arrived at his house and assaulted him in the presence of his wife and children. “When my son began to cry, I begged them to take it downstairs,” he says. The “recovery agents” would allegedly accost him at work too, once assaulting him right outside the bank, the banker said in his complaint.

The family eventually barricaded themselves at home, avoiding colleagues, friends and even relatives.

“The fear was so overwhelming that I thought of ending my life many times. It was one of the darkest phases of my life,” said the relationship manager. “We stopped stepping outside even to buy milk. We ordered food online and requested delivery personnel to leave it outside our door. I borrowed around Rs 5 lakh from my father, a senior revenue officer in Jharkhand, but never told him why. I made up excuses: that I’d switched jobs, that my salary had been delayed and even that my rent had gone up because we had moved homes.”

The trauma began affecting his children too. “Once, they clicked a photo of my son’s school van and sent it to me as a warning. To protect him, we decided to send our son to my father-in-law’s house in Patna. But they (the scamsters) told me they knew where my son was and threatened to kidnap him,” he says. “If I did not answer their calls, they would call my wife and abuse her. They also started sending me my wife’s morphed pictures.”

He claims he approached the police twice. “When I reached near the cyber police station in Bandra, three men were following me. They assaulted me. A senior citizen intervened and saved me,” he says. “The cyber police did not register an FIR and instead asked me to approach my local police station.”

A police officer from the Cyber Police Station said that while he didn’t recall the incident, “if the cheated sum is less than Rs 10 lakh, we usually advise the complainant to approach the local police station and also call the 1930 National Cyber Crime Helpline. Complaints lodged through the helpline are automatically forwarded to the jurisdictional police station for further action. If the cyber fraud involves Rs 10 lakh or more, we promptly register an FIR and initiate the legal process without any delay”.

The 37-year-old claims they also approached the MIDC police station. “We waited there for nearly an hour before a duty officer heard us. We narrated everything, but no FIR was registered. When my wife insisted, they accepted my written complaint, but nothing happened,” he says. A senior officer, who was in charge of the MIDC police station at the time and has since been transferred to the Crime Branch, said he doesn’t recall “having received any complaints directly”.

“Had the complaint come to me, I would have instructed the officers to register an FIR immediately,” the officer said.

The turning point came in May, during a call to his mother. “She asked why I hadn’t visited home in two years. She became emotional, and I couldn’t hide it. I broke down and told her,” he says.

That set off a chain of events. “My parents contacted my uncle, a brigadier in the Army. He spoke to a senior bureaucrat in Delhi, who got Deputy Commissioner of Police (Crime Branch) Raj Tilak Roushan involved,” he says.

How police laid a trap

Police authorities with the accused. (Photo: Special Arrangement)

Once the issue reached DCP Roushan, things moved quickly. “I met him on May 16,” he says. “That day, I felt hope that our ordeal would come to an end now.”

The Crime Branch didn’t want to alert the scamsters and planned an undercover operation to nab them. Around 8 am on May 25, a five-member team, including inspectors Dilip Tejankar and Jayesh Kulkarni, arrived at the victim’s residence. The policemen hid in the kitchen, instructing the victim to call the recovery agents home.

“As each recovery agent arrived, he welcomed him inside and offered him a glass of water. The moment he stepped in, the officers overpowered him,” says an investigator.

The operation that lasted 12 hours also saw an unusual twist: when one recovery agent didn’t come back for an hour, his associate waiting downstairs called the police control room alleging that his friend had been abducted, leading a police patrol van to be sent out. But this was quickly resolved when they learnt of the trap. “He called the Mumbai Police control room, saying his friend had been kidnapped and taken inside an apartment. He told them he was standing outside the building,” he says.

Police also allegedly discovered how the suspects had gained access to the victim’s personal contacts.

“Every time a loan was sanctioned, the lenders sent him a link and asked him to fill out a form. That link gave them access to his contact list and other data, which they used to reach relatives, colleagues and friends,” one investigator said.

Police say none of the loan apps involved are registered with the Reserve Bank of India and believe more people were involved in the alleged scam. “We have identified several of the apps and issued notices to their operators to appear before the investigating officers,” the investigator says.

For the family, the scars of the past year are hard to erase. “I wish I hadn’t kept silent. Silence only brings suffering,” says the 37-year-old relationship manager.

Last month, they decided to leave Mumbai for good. “We left behind everything — our furniture, refrigerator, washing machine, bed,’’ he says. “Our priority is to protect our family.”