₹40 crore gone in 48 hours: MobiKwik users reportedly drained wallets after update glitch

A critical software glitch in MobiKwik’s systems allegedly allowed users to siphon off ₹40 crore in just two days via a blitz of nearly 5 lakh UPI transactions.

According to a TOI report, the breach—believed to have occurred on September 11 and 12—was discovered following an internal audit and led to the arrest of six men from Nuh and Palwal, whose accounts held ₹9 lakh of the stolen money.

The issue reportedly began after a recent software update, which investigators believe disabled key security checks. The system allowed transactions even when users had insufficient wallet balances or entered incorrect UPI PINs.

“We don’t know yet how the scamsters learned about the flaw. Insider involvement is being probed,” a police source was quoted as saying in the report. Authorities confirmed that ₹8 crore had been frozen across various bank accounts, and 2,500 beneficiaries had been identified.

The six arrested—Rehan, Waqar Yunus, Wasim Akram, Mohd Amir, Mohd Ansar, and Mohd Sakil—have been sent to judicial custody. Police said more arrests could follow.

In a public statement, Nuh police urged residents who received unexplained transfers via the MobiKwik app on those dates to come forward by September 23. “People from Palwal and Mewat districts can also report to the SP’s office,” the statement said.

Police spokesperson Ashok Kumar told TOI that “strict action will be taken” if any MobiKwik employee is found complicit.

This marks the second such breach for the company. In 2017, MobiKwik was similarly defrauded of ₹19 crore through mass transfers to personal accounts.

A company spokesperson, quoted in the report, said “₹14 crore has been recovered so far” and pegged the net loss at ₹26 crore. “The company is pursuing aggressive recovery efforts and legal action,” the spokesperson added.

The case has been filed under sections 318(4) (cheating) and 314 (dishonest misappropriation of property) of the Bharatiya Nyaya Sanhita. Police continue to coordinate with banks to trace additional recipients and recover stolen funds.