When thumbprints aren’t safe: Scamsters clone fingerprints from tehsil records to siphon bank funds

Agra: In a chilling reminder that even biometric data may not be secure, Aligarh cybercrime police have busted a sophisticated banking fraud in which thumb impressions were allegedly cloned from publicly available tehsil records and used to withdraw money from victims' bank accounts. Police have arrested the alleged mastermind, Shivam Kumar, 30, a resident of Sagara village in Fatehpur district, in connection with the racket.Aligarh DSP (crime) Sarjana Singh said, "The accused had fraudulently withdrawn nearly Rs 35 lakh from multiple victims. Police are now probing the possibility of a larger network and examining whether biometric data visible in public documents was systematically misused."The accused is alleged to have exploited documents available on the stamp and registration department website. He allegedly downloaded registered property deed records from various tehsils, extracted Aadhaar numbers and scanned thumb impressions, and then created fake biometric replicas, or cloned fingerprints.Using these forged fingerprints, cops said the accused authenticated transactions on biometric devices and transferred funds from victims' bank accounts into his banking correspondent (BC) wallet using Aadhaar Enabled Payment System (AEPS) applications. The money was later withdrawn in cash from public service centres.During interrogation, the accused allegedly revealed that he learned the technique of creating cloned thumb impressions and carrying out AEPS-based withdrawals through online sources, including videos on the internet.Police said he had purchased an online rubber-stamp making machine for Rs 14,000, which he used to create cloned thumb impressions.The case came to light after Ramniwas, a resident of Hathras, registered a police complaint in 2023 alleging that Rs 5.8 lakh was fraudulently withdrawn from his account between Sept 2022 and March 2023. A case under IPC section 420 (cheating) and section 66D of the IT Act was registered against an unknown person. After a months-long investigation, the accused was arrested from the Khedki Daula area in Gurgaon on Tuesday.Investigators found that while the complainant's account was maintained at Canara Bank in Aligarh, fraudulent withdrawals were carried out from Fatehpur, indicating an inter-district operation.Police said 689 fingerprint clones, six mobile phones, 13 SIM cards, two biometric machines and a laptop were recovered from the accused, who has previous criminal cases, including cheating and other anti-social activities, registered in Fatehpur and Kanpur.