Bengaluru police have arrested four individuals for allegedly defrauding the company behind the payment platform Cred Rs 12 crore. The police told TOI that the ones arrested included an Axis Bank relationship manager who was also accused of being involved in the theft. The arrests were made following a complaint from a Dreamplug Paytech Solutions Private Limited (Cred’s parent company) executive, Narasimha Vasanth Sastry, and CEN East police are currently investigating the case.
Those arrested include Vaibhav Pithadiya, a relationship manager at an Axis Bank branch in Rajkot; Parmar Neha Ben Vipulbhai, a banking agent from Surat; Shailesh, an insurance agent from Rajkot and Pithadiya’s colleague; and Shubham, a commission agent also from Rajkot.
How the accused used Cred’s bank accounts to steal from the company
Last month, Dreamplug executives uncovered the scam after detecting suspicious transactions in the company’s accounts. The online payment aggregator, with offices in Mumbai and Bengaluru, reported that Rs 12.2 crore had been fraudulently withdrawn from two of its Axis Bank accounts—a current account and a nodal account—both opened in 2021.
Axis Bank had issued a corporate ID and four user IDs to Dreamplug, of which the company only activated two. The company said the remaining two IDs were left unused.
However, the investigation revealed that the accused gained unauthorised access to Dreamplug’s bank accounts by manipulating account details with Axis Bank.
They reportedly exploited two critical vulnerabilities: first, by submitting fake documents, including forged signatures, seals, and board resolutions, and second, by requesting changes to the registered mobile number and email ID associated with the accounts.
Between October and November, 37 fraudulent transactions were carried out. While an attempt was made to transfer Rs 15.2 crore, only Rs 12.2 crore was successfully withdrawn.
The first request to change account details was made on July 22 at an Axis Bank branch in Ankleshwar, Gujarat, followed by a second request on October 12 at another branch in Abrama, Surat.
The police told TOI that both requests, submitted via suspicious personal email IDs, should have raised concerns as Dreamplug operates out of Bengaluru.
Despite this, Axis Bank processed the changes, enabling the fraudsters to intercept OTPs sent to the updated contact details and authorise transactions to multiple accounts nationwide.
The police said the fraudulent emails and mobile numbers used in the scheme included vrvithal098@gmail.com, utsavmaterial76@gmail.com, 9662369909, and 8469158856.
The police also cited the company’s executives to inform TOI that the accused used this access to drain the accounts and transfer the funds into various recipient accounts.
