Torg Grabber Credential Stealing Scam via Telegram — How to Identify & Stay Safe

INDIA — By BharatSecure Threat Intelligence Team · Updated Jul 17, 2026

Severity: Critical | View Full Scam Details

Beware the Torg Grabber Credential Stealing Scam via Telegram in India 2026

Scammers on Telegram are increasingly targeting Indian users with a dangerous new trick called the Torg Grabber Credential Stealing Scam that puts your UPI and job-related data at critical risk.

What Is the Torg Grabber Credential Stealing Scam via Telegram?

The Torg Grabber scam involves fraudsters using the popular messaging app Telegram to steal sensitive login credentials from Indian internet users. This scam mainly targets people searching for free UPI hacks, job assistance tools, or software utilities online—especially those hoping for cost-free or quick solutions that seem too good to be true. With over 100 million Indian Telegram users, cybercriminals find it a fertile ground to spread these scams.

Scammers create Telegram channels posing as helpful tech hubs offering free apps or scripts that claim to boost UPI transaction limits, generate fake job alerts, or hack interfaces. Once users join these channels, they are encouraged to download files that actually contain malware carefully disguised to harvest passwords and OTPs used in UPI apps or job portals. This stolen data allows the suspects to compromise bank accounts linked with UPI, leading to financial losses.

The scam is reported across many states in India, especially in metro cities where reliance on digital payments and online job searches is high. Both CERT-In (Indian Computer Emergency Response Team) and the I4C (Indian Cyber Crime Coordination Centre) have issued general alerts about phishing scams exploiting messaging apps. Although no specific advisory names “Torg Grabber” yet, this scam falls under RBI and CERT-In’s warnings on credential theft and UPI fraud.

How This Scam Works — Step by Step

1. Finding the Channel: The victim searches on Telegram for phrases like “free UPI hacks”, “job assistance tools”, or “software cracks”. They join a channel advertising such utilities for free or minimal cost.

2. Enticing Posts: The channel posts screenshots and videos showing benefits such as instant UPI transaction boosts or quick job alerts to build trust and curiosity.

3. Download Prompt: Users are asked to download a file—appearing as an app, script, or PDF—with instructions to run it on their phone or PC.

4. Execution and Infection: When opened, the file silently installs malware or trojans that grab login credentials entered in UPI apps, job portals, or other platforms. Some versions even prompt users to enter OTPs or Aadhaar-linked data, which gets intercepted.

5. Credential Theft: Stolen credentials are immediately used by the accused to access victims’ UPI accounts or job websites, often transferring money or altering data.

6. Financial Loss: Victims notice unauthorized UPI debits or missing job applications, often too late to stop the fraud.

7. Channel Disappears: The Telegram channel admins vanish or rename the channel to restart the scam cycle with new users.

Real Warning Signs to Watch For

• Telegram channels promising “free UPI hacks” or “job shortcuts” without official backing
• Requests to download files from unknown sources instead of official app stores
• Pressure to act fast or threats of losing access if files aren’t downloaded immediately
• Asking for OTPs, Aadhaar details, or UPI PINs directly on Telegram or third-party sites
• Poor grammar, spelling mistakes, or suspicious URLs in shared files or posts
• Links asking to install software claiming it can bypass RBI/UPI transaction rules
• Channels disappearing suddenly after getting many new members

What Happens to Victims

Victims of this scam face serious financial and emotional consequences. Because the stolen credentials include UPI login details and OTPs, money can be fraudulently transferred out of linked bank accounts almost instantly. Unlike traditional bank fraud, UPI payments are often irreversible, causing permanent loss of funds. Some victims also report Delhi Police cybercrime cells noting that Aadhaar misuse linked to these scams complicates account recovery, as fraudsters try to simulate identity through SIM swaps or fake KYC.

Beyond money, victims experience stress from the loss of sensitive personal data, fearing further identity theft or misuses like job application fraud. Many victims feel helpless since the scam evolves quickly, and Telegram channels disappear before police can intervene.

What RBI and CERT-In Say

The Reserve Bank of India (RBI) repeatedly warns users not to share their UPI PINs or OTPs with anyone, including via messaging apps like Telegram or WhatsApp. RBI’s existing frameworks require banks to provide customers a grievance redressal system within 30 days, which can help in disputed transactions but do not guarantee refunds for credential theft where the victim shared passwords.

CERT-In advises that users must avoid downloading software or utilities from unofficial sources and remain alert to phishing attempts. They recommend reporting all incidents at the 1930 cybercrime helpline and registering complaints on cybercrime.gov.in for faster response from law enforcement.

The Ministry of Home Affairs’ I4C initiative emphasizes creating awareness on social media platforms like Telegram due to the rising number of phishing scams targeting the Indian public.

How to Protect Yourself

1. Avoid Telegram channels or groups promising free or hacked versions of apps related to UPI or jobs.
2. Never download executables, scripts, or PDFs from unknown Telegram links; always use official app stores.
3. Do not share your UPI PIN, OTP, Aadhaar number, or password with anyone under any circumstance.
4. Enable two-factor authentication on your UPI apps and job portals whenever possible.
5. Regularly check your linked bank account statements for unauthorized transactions.
6. Update your phone’s operating system and anti-virus apps to detect malicious software.
7. Report suspicious Telegram channels or messages to Telegram and to cybercrime authorities promptly.

What to Do If You've Been Targeted

• Immediately block the Telegram channel and stop engaging with any messages or files received.
• Change your UPI PIN and linked bank account passwords from official apps or banks’ websites.
• File a complaint with your bank’s fraud department as soon as possible.
• Report the incident online at cybercrime.gov.in and call the national cybercrime helpline at 1930 for guidance.
• Lodge a complaint with the local cybercrime police station if you suffer financial loss or data theft.
• Inform your mobile service provider if you suspect SIM swap fraud to secure your phone number.

Frequently Asked Questions

Q: Can the Torg Grabber scam steal money directly from my bank account?
A: The scam steals your UPI credentials and OTPs, which can be used by fraudsters to initiate unauthorized transactions from your linked bank account, leading to financial loss.

Q: Will my bank refund the stolen money if I fall victim to this scam?
A: RBI guidelines require banks to process genuine complaints, but if you share your UPI PIN or OTP willingly with scammers, banks may classify it as user negligence and refuse full reimbursement.

Q: How is this scam different from ordinary phishing scams?
A: Unlike standard phishing via email or SMS, this scam uses Telegram channels offering “free job or UPI hacks” and tricks users into downloading malware files, making it harder to detect and more targeted.

If you receive suspicious Telegram links or messages promising free tools, do not click or download. Verify with BharatSecure.app and report the fraud immediately at the 1930 cybercrime helpline.

Disclaimer: This article describes a pattern of fraud reported in public sources for public-safety awareness. It is not legal, financial, or medical advice. To request correction or removal of any content, write to hello@bharatsecure.app.