Woman’s Swiggy Account Hacked, Unauthorized Orders Worth Rs 97,000 Placed: Investigating Hacker Tactics

Delhi Police has apprehended two individuals, Aniket Kalra (25) and Himanshu Kumar (23), from Gurugram, Haryana, for allegedly duping individuals through the hacking of Swiggy accounts. 

The accused employed an Interactive Voice Response (IVR) system to compromise Swiggy accounts, allowing them to place unauthorized orders and sell grocery products at discounted rates. 

The woman, who reported a loss of Rs 97,197 from her Lazy Pay account linked with Swiggy, initiated the investigation.

Swiggy, in response, confirmed the association of the fraudulent activities with Lazypay as a payment instrument. 

The company is actively enhancing security measures, including the automatic delinking of user wallets and Buy Now Pay Later (BNPL) accounts on new device logins or contact number changes.

The arrests came after the complainant received an IVR call informing her of unauthorized access attempts to her Swiggy account. Subsequently, fraudulent orders were placed through her Lazypay account. 

An analysis revealed that the orders were delivered in Gurugram, and the calling number was linked to an application-based generated number connected with an IVR system.

During interrogation, Aniket disclosed his previous employment as a delivery boy for Zomato and Swiggy. He admitted to purchasing grocery items at lower prices online and reselling them in the market. Ansh, from Punjab, collaborated with Aniket in executing the IVR-based calling system to hack Swiggy accounts and orchestrate fraudulent transactions.

Aniket linked phone numbers under fake ownership with victims’ Swiggy accounts, placing orders delivered to random addresses in Gurugram to avoid detection. Himanshu, who owns a medical shop in Gurugram, facilitated the transfer of cheated amounts to various UPI IDs and accounts, posing as legitimate transactions.

Deputy Commissioner of Police (South) Ankit Chauhan stated that further investigation is ongoing to trace co-accused individuals and link the case to others. 

The elaborate scheme underscores the challenges platforms like Swiggy face in securing user accounts from increasingly sophisticated cyber fraud tactics.