MUMBAI, November 9, 2026 — Mumbai Police have arrested a 33-year-old woman, identified as Pushpa Bind, for allegedly hijacking a 76-year-old businessman’s demat account and selling shares worth Rs 4.58 crore. The case, which unfolded in August, illustrates how fraudsters are combining social engineering with SIM-swap tactics to bypass the one-time passwords that guard Indian investment portfolios.
The Mechanics of the Takeover
The alleged fraud began on August 10, when Bind contacted the Gamdevi-based investor under the guise of offering investment advice, according to the Hindustan Times. She persuaded him to share his demat account credentials and password. With those details in hand, the critical barrier was the one-time password (OTP) sent to the victim’s registered email address. Investigators found that Bind acquired a duplicate SIM card linked to the mobile number associated with that email account, allowing her to intercept the OTPs and assume full control of the portfolio, Deputy Commissioner of Police (Cyber) Bajrang Bansode told reporters.
Portfolio Manipulation via Penny Stocks
Once inside the account, the fraudster did not simply withdraw cash. Instead, she sold the victim’s existing holdings — blue-chip shares worth Rs 4,58,34,579 — and redirected the proceeds into low-value penny stocks worth Rs 1,71,60,032, according to Rediff and NationPath India. Penny stocks are thinly traded and highly volatile; the manoeuvre effectively launders the value through instruments that can be manipulated or offloaded to connected counterparties. The salient point is that the portfolio’s composition was altered, not just depleted, a tactic that can delay detection while the fraudster extracts value.
The Role of OTP Interception
The case underscores a structural vulnerability in India’s financial authentication chain. Demat accounts typically rely on OTPs delivered to a registered email or mobile number as the final gatekeeper. By securing a SIM card tied to the victim’s mobile number — a process that exploits weaknesses in the telecom provider’s know-your-customer verification — the accused turned that gatekeeper into an open door. Moneycontrol reported that a link sent to the victim’s device may have been used to gain initial email access, compounding the breach. For all the noise about app-level security, the recovery mechanism remains the single point of failure.
Police Intervention and Asset Recovery
The victim discovered the unauthorised transactions on August 11, when he reviewed his portfolio, and filed a complaint at the South Region Cyber Police Station on August 26. Police moved to freeze shares valued at Rs 2,86,74,547 before they could be fully liquidated, according to multiple police statements cited by Outlook Money and NationPath India. The remaining amount has not been publicly accounted for. Bind was arrested on November 3.
Security Lessons for Retail Investors
Bind’s background is notable: she previously worked at well-known investment firms in Mumbai and has a history of arrests by the Santacruz, Azad Maidan, and Andheri police stations for cheating, impersonation, and offences under the Information Technology Act, police told the Hindustan Times and Moneycontrol. Investigators allege she received a 30 per cent commission on the unauthorised trades, suggesting a wider network. The South Cyber police are probing possible accomplices. For the ordinary investor, the lesson is blunt: credentials and passwords are only as secure as the email and mobile number they are tethered to. Enabling transaction alerts, securing the primary email with independent two-factor authentication, and never sharing login details — even with purported advisors — remain the only reliable defences.
Sources
- How A 76-Year-Old Investor’s Rs 4.58 Crore Share Portfolio Was Targeted In A Demat Fraud – Outlook Money
- Permanent account number
- How A Woman Hacked Demat Account, Sold Shares Worth Crores
- Mumbai Cyber Police Arrest Woman in Alleged ₹4.58 Crore Demat Account Fraud; Shares Worth ₹2.86 Crore Frozen
- Mumbai Woman Held for Allegedly Hacking Demat Account, Selling ₹4.58 Crore Shares To Buy Penny Stocks
- 76-yr-old loses ₹4.58 cr in demat fraud; trading firm staff held
Photo: Jamie Street / Unsplash (Unsplash License)
