Hyderabad: A sophisticated cyber fraud targeting water consumers has raised alarm across Hyderabad, with fraudsters allegedly impersonating the Hyderabad Metropolitan Water Supply and Sewerage Board (HMWSSB) and tricking residents into installing malicious applications that give criminals access to their mobile phones and banking information.
According to multiple complaints shared by consumers, victims are receiving WhatsApp messages from unknown numbers displaying the HMWSSB logo as their profile picture. The message typically claims that the recipient’s water connection will be disconnected the same night unless immediate payment is made and asks the consumer to urgently contact a mobile number provided in the message.
Fearing disruption of their water supply, many consumers reportedly call the number, only to be drawn into a carefully planned cyber scam.
How the Scam Works
Victims say that the caller identifies himself as an HMWSSB representative and claims that an outstanding bill must be paid immediately to avoid disconnection of the water connection.
The fraudsters then instruct consumers to install a mobile application, usually in APK format, claiming it is required to process the payment or update account details. Consumers using iPhones are reportedly told to switch to an Android device for the payment process.
Cybersecurity experts warn that APK files obtained outside the Google Play Store can contain malicious software capable of compromising the entire device.
Once installed, the application allegedly grants remote access or screen-sharing capabilities to the fraudsters. Victims are then guided through a fake payment process or website where they are asked to enter debit card or credit card details.
In many reported cases, the transaction initially shows as failed or declined, leading the victim to believe that no money has been deducted. However, fraudsters by then have already obtained card details and can observe incoming SMS alerts and OTPs through the compromised device.
Within minutes, unauthorized transactions are reportedly carried out, and victims discover that large amounts of money have been withdrawn from their bank accounts.
Growing Number of Complaints
Residents across Hyderabad have increasingly reported receiving such WhatsApp messages, particularly around the due dates of water bills. Several victims claim that the messages contain accurate consumer-related information, including:
- Consumer Account Numbers (CAN)
- Registered mobile numbers
- Billing references
- Payment due information
The apparent availability of such information has triggered serious concerns among consumers regarding how cybercriminals obtained access to customer data.
Questions Being Raised Over Data Access
The scam has sparked widespread discussion among citizens and cybersecurity professionals about the source of consumer information being used by the fraudsters.
Many consumers are questioning how scammers appear to know:
- HMWSSB customer account numbers
- Registered mobile numbers
- Billing cycles
- Due dates of payments
At present, there is no official evidence suggesting the involvement of any HMWSSB employee or internal data leak. However, cybersecurity experts say investigators will likely examine multiple possibilities, including unauthorized access to customer databases, third-party service provider breaches, phishing campaigns, previously leaked datasets, or illegal data-sharing networks operating in the cybercrime ecosystem.
Officials have urged the public not to jump to conclusions until investigations are completed.
Police and Cybercrime Authorities Investigating
Cybercrime authorities are reportedly examining complaints related to fake HMWSSB payment messages and malicious APK-based fraud.
Investigators are expected to focus on:
- Origins of the WhatsApp messages
- Bank accounts receiving stolen funds
- Distribution of malicious APK files
- Possible data compromise sources
- Call records and digital footprints of suspects
Cybercrime experts note that APK-based scams have become increasingly common because they allow criminals to bypass traditional banking security measures by directly observing a victim’s screen activity.
Warning Signs Consumers Should Watch For
Authorities and cybersecurity experts advise consumers to remain alert if they receive:
- Threatening messages claiming immediate disconnection of services
- Requests to call personal mobile numbers
- Instructions to install APK files
- Requests for card details over phone calls
- Links that are not from official government websites
- Demands for urgent payment under pressure
Consumers are advised to verify any outstanding bill directly through official HMWSSB channels, the official website, authorized payment platforms or customer service numbers.
Public Urged to Stay Vigilant
Cybersecurity professionals warn that scams involving utility bills, electricity connections, water services and government departments are becoming increasingly sophisticated. The use of official logos, accurate customer information, and urgent language often convinces victims that the messages are genuine.
Citizens are strongly advised never to install APK files received through WhatsApp, never share banking credentials with callers, and immediately report suspicious messages to cybercrime authorities.
As investigations continue, the incident has once again highlighted the growing threat posed by digital fraud networks and the importance of safeguarding consumer data in an increasingly connected world.
