123456? How gangs are cracking weak passwords like these from stolen phones to siphon money

NEW DELHI: Using weak passwords can have severe consequences. Recently, police busted two gangs that used to transfer funds using stolen and snatched mobile phones. The gangs, which trained juveniles from Jharkhand in exploiting weak passwords, smuggled 12,000 phones to Bangladesh, Nepal and Bihar in the past one year. They amassed at least Rs 12 lakh. Four people from the two gangs were apprehended. They were identified as Vishal Kumar (24), Jaswant Ray (30), Ramesh Kumar (36) and Munni Lal Mahto (30).
On Jan 16, police received a complaint from a businessman who said that his phone was stolen from his pocket in Chandni Chowk. Subsequently, it was discovered that Rs 5.3 lakh was debited from his account. A case was registered. In a separate incident, another FIR was filed after a man reported losing Rs 2.5 lakh in Gulabi Bagh, following the theft of his phone.
To crack these cases with a similar modus operandi, DCP (North) Raja Banthia formed a team comprising inspector Rohit Saraswat and sub-inspector Prashant. The investigators discovered that a mobile recharge was made using the businessman's UPI ID, which turned out to be the main clue. "The mobile number was recharged by a person located in the Bara Hindu Rao area, where Vishal was subsequently apprehended," the officer said.
Vishal's interrogation revealed a nexus involved in couriering stolen mobile phones to Nepal via Munger. He obtained phones from snatchers and pickpockets, then used common and weak passwords like "123456" to access victims' UPI IDs. He transferred funds to different accounts and withdrew the money using a banned app, which is used for bitcoin trading.
Another officer explained, "After installing the SIM cards, Vishal used to access the victims' mobile phone numbers in the settings. He would then attempt to access their UPI using the first six digits, last six digits, or common numbers. Since he controlled the SIM card, he could readily obtain the OTP required for creating a UPI ID."
Police sources said that the thieves could obtain sensitive information from some mobile phones, as they had weak passwords. "In some instances, birthdays were used as UPI passwords. Such details were easily obtained by the gangs using the victims' ID cards saved in their mobile phones."
Vishal's associate in Munger used to send Jaswant to collect stolen phones every 15 days. Ramesh was caught while receiving a parcel containing stolen phones. Police recovered 171 phones from the three accused.
During the investigation of the second incident of theft and the money transfer from a doctor, it was found that the SIM card from the victim's mobile phone was installed in another device. Based on its location, a raid was conducted in Jyoti Nagar and Mahto was nabbed, whereas another suspect fled from the scene.
Further probe revealed that members of this gang were staying with several minor children who were being used to steal mobile phones from people's pockets and bags. They used to bring minor children from Sahibganj and train them to steal mobile phones. Over 100 phones were recovered in this case.