Cybercrime alert! This fake 'Government' website collects personal data in pretext of offering loans

A website, impersonating as a Government website 'Pradhan Mantri Yojana Loan' with the url -  www.pradhanmantriyojanaloan.com - claims to provide loans under the 'Pradhan Mantri Yojana'  in exchange for personal identifiable information, such as Aadhaar card details, that can potentially be misused online. The website has numerous spelling and grammatical errors.

On the 'Contact Us' page of the website, there is a scanned image of a fake authority letter with the Government of India stamp. The scanned image is full of errors. It deceptively writes Government as 'GOVERMENT', Kendra as 'KANDR' and India as 'INDAI'. Other words have been misspelled too. The scanned image writes National Informatics Centre as 'National Informatic Center'. When scanned, the QR code in the image shows a random UPI phonepe string. See the image below:

Earlier, an associated android application called, the 'Pradhan Mantri Yojana Loan' was also available on Google Play Store, but the same has been removed now.

The contact number on the website is switched off. An email sent to the email id mentioned on the website, info@pradhanmantriyojanaloan.com, remained undelivered.

A recent tweet by PIB Fact Check confirms the website is a sham. See the tweet below:

:- ' ' 1 - 2 #PIBFactcheck:- # ' ' pic.twitter.com/TiQm0rthhp

- PIB Fact Check (@PIBFactCheck) February 23, 2021

The word Yojana has been misspelled too as 'Yojna' at several places on the website.

Research by CyberPeace Foundation along with Autobot Infosec found that the user's activity on the app is not protected and an intent-filter exists. "The presence of an intent-filter indicates that the activity is explicitly exported, i.e., it is found to be shared with other apps on the device and can therefore be accessed by these apps with ease. The possible presence of a backdoor-like service cannot be discounted," says the report.

The report further adds that the website has an IP with past records for phishing attacks and malicious activities.

Here's what happens when you apply for a loan on the website:

• After clicking the orange 'Apply Loan' button, it redirects the user to a page that asks for personal information like First Name, Middle Name, Last Name, Gender, Date of Birth, Husband Name/Wife Name, Father's name, Mother's name, Mobile, State, City, Pincode, loan amount, Aadhaar Card number and bank account details such as A/c Name, IFSC Code, A/c No, Branch Name etc. It also asks users to upload their passport size image, Ration Card and address proof.
• "The acceptable image size mentioned in the form is 175*175, but a dummy image of a larger size was also accepted. A random Aadhaar Card number with more than 12 digits too was accepted," says the report.
• After submitting, the user is taken to a new page that asks for an OTP sent to the mobile number that was provided while filling the application. No OTP is actually received on the mobile number shared. At the bottom of the page, it also shows that the details have been submitted.
• A ten-digit receipt number is assigned to each user. If you try to check the status of your loan application using the 10-digit recipt number, it says, 'Your application is submitted. Thank you!'.

Also Read: India has 7,684 variants of COVID-19 virus, says study

Also Read: Amazon ties up with Mahindra to deploy 10,000 EVs for delivery in India

Also Read: China pips US to emerge as India's biggest trade partner in 2020 despite border conflicts