Leak in system: DJB site feature exposes millions to scammers

A feature on the Delhi Jal Board's website has created a vulnerability that potentially allows scammers easy access to tens of thousands of residents' personal information, which may have enabled frauds worth at least ₹10 crore in four months, according to police.

- Jignasa Sinha

NEW DELHI:

The DJB's "Know Your KNO" portal, designed to help citizens find their 10-digit water connection identifier, inadvertently functions as a data harvesting tool. Anyone can input a partial address—as few as 10 characters—and access detailed results showing residents' full names, addresses, mobile numbers, and unique connection numbers (KNOs). These KNO numbers can then be used to get bill details of individual customers.

With 2.9 million water connections across Delhi potentially exposed through this vulnerability, fraudsters pose as DJB officials and contact victims with urgent disconnection threats, using their personal and bill details to establish credibility before stealing money through malicious mobile applications or other means.

The scam now accounts for a significant share of all cybercrimes reported in Delhi, according to officers.

According to cyber officials, at least 5,000 complaints are received on National Cybercrime Reporting Portal each month in Delhi. Of these, more than 700 are complaints related to this fraud.