CRIMEX DEMO — SYNTHETIC DATA
UPI collect-request impersonation
- Case
- CX-2026-0141
- Status
- open
- Category
- UPI / payment fraud
- Location
- Navrangpura, Ahmedabad
Original complaint
On 11 October 2026 at about 14:20, the complainant R. Mehta (synthetic) of Navrangpura, Ahmedabad received a call from +91 90000 41207. The caller said he was an officer from "Demo Bank" refunds department and that a refund of ₹2,300 was pending. He asked the complainant to approve a UPI collect request to receive the refund. The complainant approved a request from the handle refund.help@okdemo and ₹48,500 was debited, transaction reference UTR 6281 0042 7731. The caller then asked for an OTP, which the complainant did not share. A follow-up SMS came from the same number with a link to demo-refund-help.example.com.
Modules used
Investigation Intelligence · Cyber / Network Forensics
Findings
1. Collect request approved under refund pretext — SAMPLE · medium · extracted · unreviewed
Complaint states a collect request was approved believing it would credit a refund.
Inspect finding & source →Method: Sample extraction from complaint text · Ref: Complaint, lines 2–4
He asked the complainant to approve a UPI collect request to receive the refund.
2. Possible impersonation pattern — SAMPLE · medium · interpretation, unverified · unreviewed
Narrative resembles known refund-impersonation patterns. This is an interpretation to verify, not an established fact.
Inspect finding & source →Method: Sample pattern comparison (illustrative) · Ref: Complaint
The caller said he was an officer from "Demo Bank" refunds department
3. Link domain to be checked — SAMPLE · low · extracted · unreviewed
SMS link domain recorded as an indicator for lookup. Packet analysis not applicable — no capture attached.
Inspect finding & source →Method: Indicator extraction from complaint text · Ref: Complaint, final line
a link to demo-refund-help.example.com
Evidence references
payment-screenshot.png · image · 402.7 KB
e1 · Synthetic sample
Verification pending
bank-statement-oct.pdf · document · 183.8 KB
e2 · Synthetic sample
Verification pending
A hash does not establish authenticity. Event history is browser-local and is not a certified chain of custody.
Analyst notes
- Bank nodal officer request drafted; awaiting response on beneficiary account (synthetic). (13 Oct 2026, 11:00)
Limitations and pending analysis
- Demo build — all case data is synthetic.
- Findings shown are illustrative sample outputs, not results of real analysis.
- PCAP / PCAPNG capture — packet analysis cannot run without one
Review status
3 of 3 findings unreviewed.