Indian Bank Warns of Surge in LPG-Themed Phishing Scams Targeting Customers Indian Bank has issued a cybersecurity advisory alerting customers to a widespread fraud campaign exploiting concerns over LPG cylinder availability. Cybercriminals are sending deceptive messages via SMS, WhatsApp, and social media, impersonating major LPG providers Indane, Bharat Gas, and HP Gas to steal banking credentials and drain accounts. The scam employs urgent social engineering tactics, falsely warning recipients of pending KYC updates or unpaid bills to trigger panic. Messages like “Your LPG KYC is pending. Limited stock. Click here to update” or “Immediate payment required to avoid disconnection” redirect victims to fake websites designed to harvest UPI PINs, OTPs, and banking details. More advanced attacks involve malicious APK files sent via WhatsApp, which, once installed, grant attackers access to stored passwords and sensitive data. Some fraudsters also pose as bank officials, directing users to click links during WhatsApp calls. Authorities, including Delhi Police’s cybercrime units, have received multiple complaints through the national helpline (1930). Scammers are also running fake social media ads using official gas company logos to lure victims to fraudulent payment portals. Security researchers classify this as an event-driven phishing campaign, leveraging fears of LPG shortages to maximize success rates. Indian Bank’s advisory emphasizes verifying all requests through official LPG apps or helplines and reporting suspicious activity to cybercrime.gov.in. No legitimate provider or bank will request sensitive information via unsolicited links.

Indane, a state-owned gas provider in India, left a section of its website open to dealers and distributors despite though it is only intended to be accessed with a verified username and password. An anonymous security researcher who sought to protect his identity out of concern for retaliation from the Indian government discovered the material. It was found that customer data for 11,000 dealers, including names and addresses of customers, as well as the customers’ confidential Aadhaar numbers hidden in the link of each record were visible after the exposure.