Two Men Arrested for Hacking Nainital Bank Server and stealing Rs 16.71 Crore

In a major breakthrough, Noida Police on Monday arrested two men for allegedly hacking the server of Nainital Bank’s Noida Sector 62 branch and fraudulently transferring ₹16.71 crore to 84 different bank accounts. The cyber theft took place over five days, between June 16 and June 20, 2024.

The accused have been identified as Umealakei Emeka, alias Alex, a 53-year-old Nigerian national residing in a high-rise apartment in Greater Noida’s Sigma 4, and Savej alias Sanu, a 26-year-old resident of Ghaziabad. With these arrests, the total number of accused apprehended in the case has now risen to seven.

According to Assistant Commissioner of Police (Cybercrime) Vivek Ranjan Rai, Emeka is believed to be the mastermind behind the fraud. Police investigations revealed that the siphoned funds were transferred to 84 bank accounts, many of which were either fake or rented. Of these, six accounts remained active, and money was still being withdrawn when police began monitoring them. This led to the arrest of Savej, who allegedly worked under Emeka’s instructions for a 4% share in the profits.

During a raid at Emeka’s residence, police recovered 56.34 grams of methylenedioxy-N-methamphetamine (MDMA) – a banned party drug – worth ₹20 lakh. Two other men, identified as Amit Gupta (28) and Deepak Gupta (39), both residents of Sangam Vihar in Delhi, were also found at Emeka’s residence attempting to purchase MDMA. Both were arrested on the spot and smaller quantities of the drug were recovered from them.

Police stated that Emeka, who came to India in 2003 and married a woman from Manipur in 2007, has three children. He allegedly collaborated with other Nigerian nationals to carry out the sophisticated bank server hack and routed the stolen money to various accounts. Of the total amount, transactions worth ₹1.40 crore have been directly linked to Emeka.

The fraud came to light on June 17, 2024, when Nainital Bank officials noticed a ₹3 crore discrepancy during routine account reconciliation. Cybercriminals managed to hack the bank’s RTGS (Real Time Gross Settlement) channel and transferred the entire amount to various accounts in 84 transactions. Initially suspecting a technical glitch, they waited for 24 hours. However, another ₹2 crore shortfall was found the next day.

This prompted the RTGS team to investigate the transactions within the Core Banking System (CBS) and the Structured Financial Messaging System (SFMS) server. During the investigation, flaws were identified in both the CBS and the SFMS. Initially, the RTGS team considered it a case of delayed RTGS messages and decided to wait until the next day for further examination. On June 18, the team found that the balance sheet still did not match, despite the settlement report in SFMS aligning with the CBS of the banks. This raised suspicions of more profound issues, and some unusual activities were observed during this period.

Realizing the seriousness, the matter was escalated and reported to the police on June 19 by the bank’s IT manager, Sumit Kumar Shrivastava. A formal complaint was filed on July 10 under Section 420 of the Indian Penal Code (cheating and dishonesty) and Section 66C of the Information Technology Act (fraudulent use of electronic signatures). As the investigation progressed, additional charges were added under IPC sections 468 (forgery), 120B (criminal conspiracy), and 201 (destruction of evidence).

Earlier in the probe, police arrested Harsh Bansal (29), his brother Shubham Bansal, both from Dadri in Greater Noida, and Kuldeep Kumar (39) from Ghaziabad, for their alleged roles in providing or operating the bank accounts used in the scam.

So far, authorities have managed to freeze ₹3.80 crore out of the total ₹16.71 crore siphoned off. Police also recovered ₹50,000 in cash, eight cheque books, seven bank passbooks, seven mobile phones, a laptop, two internet modems, nine SIM cards, three debit cards, two passports, a driving license, and a total of 39.58 grams of MDMA from Emeka’s possession. A mobile phone was seized from Savej, while 8.08 and 8.68 grams of MDMA were recovered from Amit and Deepak respectively.

Due to the recovery of illegal substances, the Narcotic Drugs and Psychotropic Substances (NDPS) Act has also been invoked against Emeka and the two Delhi-based suspects. The case continues to unfold, with police tracking the remaining funds and other individuals possibly involved in this high-profile cybercrime.