Mumbai's South Region Cyber Police have arrested a 33-year-old woman in connection with an alleged cyber fraud involving the unauthorised sale of shares worth approximately ₹4.58 crore from an investor's demat account.
The accused, identified in media reports as Pushpa Bind, was arrested on November 3, 2026. Police allege that she gained unauthorised access to a 76-year-old businessperson's demat account and sold high-value shares without the account holder's permission. The proceeds were allegedly used to purchase low-priced penny stocks.
Editorial Insight
Key Highlights
Important points readers should notice.
Issue/Event: Alleged unauthorised demat account access and share transactions worth ₹4.58 crore.
Location: India
Authority/Organisation: Mumbai Police – South Region Cyber Police.
Action Taken: A woman was arrested and shares worth approximately ₹2.86 crore were frozen.
Impact: The case highlights cybersecurity risks involving SIM misuse, email access and OTP-based financial authentication.
According to the investigation details reported by police, shares valued at ₹4,58,34,579 were sold from the victim's account. Approximately ₹1,71,60,032 was subsequently used to purchase penny stocks. Mumbai Police managed to freeze shares valued at ₹2,86,74,547 during the investigation.
The alleged fraud took place on August 10, 2026, between approximately 11 AM and 3 PM. Investigators are examining how the accused allegedly obtained access to the investor's account credentials and bypassed the security process.
Police said the investigation revealed that the one-time passwords (OTPs) required for accessing the demat account were being delivered to the investor's registered email address. The accused allegedly obtained a SIM card linked to the mobile number associated with that email account, enabling her to access the email and receive the OTPs.
Editorial Analysis
Why This Matters
Demat accounts hold investors' securities electronically and are central to India's stock market ecosystem. Unauthorised access can expose an investor's entire portfolio to financial manipulation. This case is particularly concerning because the alleged method involved more than simply obtaining a trading password. Investigators believe that access to the email account and its OTP authentication process was also exploited. The incident highlights the importance of protecting registered mobile numbers, email accounts and account-recovery systems alongside trading credentials. It also raises questions about how quickly suspicious transactions can be detected and stopped before investors suffer further losses. For retail investors, the case is a reminder that account security must extend beyond the trading application itself.
Using the alleged access, the accused was able to enter the demat account, sell the investor's existing shareholdings and purchase penny stocks without authorisation.
The incident came to light after the investor noticed suspicious transactions and reported the matter to the South Region Cyber Police Station. Investigators subsequently registered a case and began tracing the digital access, transactions and individuals potentially connected with the alleged fraud.
Police have also examined the accused's previous criminal record. Reports citing investigators state that four earlier cases had been registered against her at Santacruz, Azad Maidan and Andheri police stations. These earlier cases are separate matters and should not be treated as proof of guilt in the present investigation.
The police are continuing to investigate whether other individuals were involved in the alleged transactions and whether additional investors may have been targeted through a similar method.
The case has raised concerns about the security of demat and trading accounts, particularly the risks associated with compromised email accounts, SIM-card misuse and unauthorised access to OTPs.
Mumbai Police have advised investors not to share trading credentials, passwords, OTPs or email recovery access with anyone. Investors who notice suspicious activity should immediately contact their stockbroker or depository participant, secure their accounts and report suspected cybercrime.
The case also highlights why investors should treat unexpected trading alerts, password-reset notifications and unfamiliar account-access requests as potential warning signs.
The allegations against the arrested woman remain subject to investigation and judicial proceedings. Her arrest does not establish guilt.
