Banking Trojans Evolving: WhatsApp Worms, RelayNFC Fraud, and Your Legal Remedies in India

Recent threat intelligence from Latin America has revealed an alarming evolution in mobile financial cybercrime: banking trojans that not only propagate autonomously via WhatsApp worm modules but also utilize RelayNFC technology to execute contactless financial fraud. While this wave of attacks gained prominence across Brazil, the borderless nature of cyber threats means Indian mobile banking users face an identical risk profile.

India is the world’s largest WhatsApp market and a global leader in digital payments. As Near Field Communication (NFC) tap-and-pay adoption accelerates alongside Unified Payments Interface (UPI) integrations, understanding how these sophisticated vectors operate—and knowing the Indian legal and institutional framework available to combat them—is essential for consumers, corporate entities, and legal practitioners alike.

Understanding the Threat: WhatsApp Worms and RelayNFC

Traditional banking trojans relied heavily on social engineering via SMS (smishing) or malicious sideloaded APKs disguised as invoice PDFs or utility updates. The new generation observed in Brazil combines two potent attack vectors:

1. Automated Propagation via WhatsApp Worms

Once an unsuspecting user installs the malicious application (often masquerading as banking security software or a legitimate institutional update), the trojan requests access to Android’s Accessibility Services and Notification Listener permissions.

Using these elevated permissions, the malware reads the device’s contacts, intercepts active messaging sessions, and silently broadcasts malicious APK links or infected attachments to individual contacts and WhatsApp groups. Because the message originates from a trusted friend or colleague's genuine account, recipient trust is high, causing exponential infection rates.

2. RelayNFC Exploitation

The most dangerous technical breakthrough is the use of NFC relay mechanisms. When a victim attempts to perform a tap-to-pay transaction or holds their NFC-enabled credit/debit card near an infected smartphone:

The trojan captures the card’s high-frequency radio data through the infected device's NFC chip.
Instead of storing the data locally, the trojan establishes a real-time, encrypted proxy connection back to a command-and-control (C2) server.
An accomplice or automated terminal located anywhere else in the world relays that signal instantly to a point-of-sale (POS) machine or automated teller device, executing an unauthorized transaction as if the physical card were present.

This architecture circumvents conventional two-factor authentication (2FA) and location-based fraud triggers, leaving victims bewildered as funds disappear from accounts while the physical card remains in their wallet.

The Indian Cyber and Penal Law Framework

If such an attack compromises an individual or entity in India, multiple statutory protections and legal remedies are triggered under our codified laws.

1. Information Technology Act, 2000 (IT Act)

Section 43 (Penalty and Compensation for Damage to Computer System): Provides civil remedies for unauthorized access, downloading or copying data, and introducing computer contaminants or computer viruses.
Section 66 (Computer Related Offences): Criminalizes any act referred to in Section 43 committed dishonestly or fraudulently, punishable with imprisonment up to three years or a fine up to five lakh rupees.
Section 66C (Identity Theft): Applies directly to the unauthorized harvesting and relay of electronic signatures, card identifiers, or biometric/NFC credentials.
Section 66D (Cheating by Personation Using Computer Resource): Crucial for RelayNFC schemes, where the perpetrator impersonates the legitimate cardholder or payment device to effect fraudulent debit.

2. Bharatiya Nyaya Sanhita, 2023 (BNS)

Following the overhaul of India's criminal codes, offences previously registered under the Indian Penal Code (IPC) now fall under the Bharatiya Nyaya Sanhita, 2023:

Section 318 (Cheating): Covers fraudulent inducement of property and funds.
Section 319 (Cheating by Personation): Penalizes offenders who fraudulently misrepresent themselves—including digitally—as legitimate account holders.
Section 303 (Theft): Pertains to dishonest misappropriation of movable/digital assets without consent.
Section 61 (Criminal Conspiracy): Vital for prosecuting mule networks and international syndicates orchestrating coordinated trojan operations.

3. Evidentiary Standards under Bharatiya Sakshya Adhiniyam, 2023 (BSA)

Digital evidence, including system logs, WhatsApp transmission records, forensic extraction reports, and network traces, must comply with the provisions of Section 63 of the Bharatiya Sakshya Adhiniyam, 2023 (which replaces the erstwhile Section 65B of the Indian Evidence Act, 1872). Preserving immutable electronic logs and obtaining proper statutory certificates from system handlers is mandatory for trial admissibility.

Banking Liability: RBI Mandates on Unauthorised Electronic Transactions

Victims of trojan and RelayNFC fraud are not without civil financial recourse. The Reserve Bank of India’s (RBI) master circular on Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Banking Transactions establishes categorical principles:

Zero Liability of Customer: Applies where the unauthorized transaction occurs due to contributory fraud, negligence, or deficiency on the part of the bank, or where a third-party breach occurs and the customer notifies the bank within three working days of receiving transaction communication.
Limited Liability: If the customer reports the fraud between four to seven working days, their maximum financial exposure is capped based on account tier (ranging from ₹5,000 to ₹25,000).
Beyond Seven Days: Customer liability is determined in accordance with the individual bank's board-approved policy, subject to consumer forum and Banking Ombudsman scrutiny.

Important Legal Nuance: Banks often argue that installing an unverified APK constitutes customer negligence. However, legal representation before the Banking Ombudsman or National Consumer Disputes Redressal Commission (NCDRC) can establish that sophisticated trojans circumvent user awareness through deceptive system-level permissions, preventing unilateral liability shifting onto the consumer.

Action Plan for Victims in Mumbai, Thane, and Mira Road

If you suspect your device has been compromised by a banking trojan or you detect unauthorized contactless withdrawals, execute the following protocol immediately:

Step 1: Immediate Containment

Disconnect the phone from Wi-Fi and mobile data immediately to sever the C2 relay link.
Call your bank's emergency hotlines to block debit/credit cards, freeze net banking credentials, and disable UPI handles.

Step 2: Register on National Cyber Crime Reporting Portal (NCCRP)

Dial 1930 (Citizen Financial Cyber Fraud Reporting and Management System).
Log a formal complaint on cybercrime.gov.in within the golden hour to facilitate the administrative freeze of mule accounts.

Step 3: Formal Lodging with Local Jurisdictional Police

In the Mumbai Metropolitan Region (MMR), proceed to lodge an official complaint or FIR under the BNSS:

Mumbai Residents: Approach the Bandra-Kurla Complex (BKC) Cyber Crime Police Station or the dedicated Cyber Police Stations across regional zones (South, Central, West, East, North).
Thane Residents: Contact the Thane Cyber Crime Police Station located near the Police Commissionerate, Court Naka.
Mira Road & Bhayandar Residents: File a complaint with the Mira-Bhayandar Vasai-Virar (MBVV) Cyber Police Station located at Kashimira.

Ensure that you demand an official acknowledgment and retain copies of the complaint alongside Section 63 BSA compliant electronic statements.

Frequently Asked Questions (FAQs)

1. Can an NFC card be charged if it is inside my pocket or wallet?

Yes, if an infected phone or rogue NFC scanning device is held within close proximity (typically under 4 cm) of an unshielded contactless card, it can initiate an exchange. Utilizing RFID/NFC-blocking wallets or disabling contactless transactions via your banking mobile app when not in use mitigates this risk.

2. Can I hold my bank liable if a trojan facilitated an unauthorized withdrawal?

Yes, under RBI circulars, you have the right to claim zero or limited liability provided you notify your bank within three working days. Even if the bank repudiates the claim citing "negligence", this determination is challengeable before the RBI Ombudsman or appropriate Consumer Disputes Redressal Commissions.

3. Which police station handles cyber fraud in Mira Road?

Jurisdiction falls under the MBVV (Mira-Bhayandar Vasai-Virar) Police Commissionerate. Cyber fraud matters can be reported directly to the MBVV Cyber Police Station or initiated through your local police station (e.g., Naya Nagar, Mira Road, or Kashimira Police Station), which will register a Zero FIR if needed.

4. What constitutes valid electronic evidence under the new criminal laws?

Under Section 63 of the Bharatiya Sakshya Adhiniyam, 2023, digital materials—such as transaction SMS records, call detail records (CDRs), device audit logs, and communication history—must be submitted accompanied by a formal statutory certificate verifying the integrity and operating condition of the source device.

Protecting Your Legal and Financial Rights

As cyber syndicates evolve from crude phishing emails to sophisticated, self-propagating banking trojans and NFC relay networks, response speed and evidentiary precision dictate your financial recovery. Navigating institutional bureaucracy between commercial banks, cyber cells, and dispute tribunals requires dedicated legal oversight.

APS Law provides guidance across cyber law, banking recovery, and criminal proceedings for individuals and corporate entities across Mumbai, Thane, and Mira Road. If you or your enterprise has experienced unauthorized electronic financial transactions or data compromise, contact our team to schedule an initial legal consultation.