The Mahape Fake Apple Raid Repeats a Dual-Shift Pattern

Navi Mumbai cyber police arrested four men on Thursday for a fake Apple support floor in Mahape. The rented office sat in Millennium Business Park and went after people in the United States who use Apple devices.

The night crew had been on since May 2026, police said, and a second alleged stock-trading floor was tied to the same owners. That split is the model this city has already raided.

Police Walked Into Trade Expert Services After Dark

Senior Inspector Vishal Patil of the Navi Mumbai Cyber police station said officers moved on a tip that an unlicensed floor was running at Trade Expert Services. They went in late Thursday evening and found nine agents on computers, reading scripts while they spoke to people in the United States.

The four men taken into custody were the manager and three team leaders, not the agents on the phones. Patil identified the manager as Parth Bharatbhai Patel, 27, a Ghansoli resident listed as a partner. Jobin Jacob Balumal, 28, from Powai, allegedly used the name John on those calls. Naeem Haroon Rashid Sheikh, 41, from Panvel, allegedly used the name Tom. Sameer Farid Sheikh, 31, from Thane, was named as another team leader.

Early reading of the computers put the take from several US citizens at about Rs 5 lakh, police said, and they expect that figure to rise. The nine agents came from Palghar, Kandivli, Nalasopara, Badlapur, Mira Bhayandar, Thane and Kurla. Police did not list those nine among the arrested four.

SEIZED FROM THE MAHAPE FLOOR

• Phones and SIMs: Six mobile phones and 255 Vodafone Idea company SIM cards.
• Call gear: Two servers, two CPUs, two SIM boxes and a laptop.
• Paper trail: Nine chequebooks and printed scripts used on US callers.

Patil said the floor was being run without a licence and was used to cheat US citizens by posing as Apple tech support.

The $499 Message That Opened the Call

Police said the owner, Mustafa Khan of Mumbra, would send a message to Apple devices in the United States claiming $499 had come out of a bank account. The note told the recipient to call a number if they had not made that payment. When they did, the call was routed to the Mahape floor.

Agents then posed as Apple staff, talked up “suspicious activity,” and said money had already been withdrawn. They told victims a virus named CHAMPI was on the device and pushed them to send dollars to wallets or to buy and hand over “Apple for Everything” gift cards to “remove” it. Fear, speed and tech talk did the rest, Patil said.

That sequence matches the basic tech-support trap US agencies have warned about for years, including the advice on how to spot, avoid, and report tech support scams: a real tech company does not text or call to say your machine is infected, and a real security alert does not tell you to dial the number on the screen.

THE CALL FROM $499 TO CHAMPI

1. The bait: A message claims $499 left the victim’s bank and lists a number to call.
2. The route: That callback lands on the Mahape floor, not at Apple.
3. The names: Agents use US cover names such as John and Tom.
4. The virus: They say CHAMPI is on the device and demand wallets or gift cards to clear it.

Patel told police he and Khan had run the Apple night shift since May 2026. Police said a person they named as Iggy, and Sheikh, then moved value to Khan as USDT on TRON QR codes and as those gift vouchers.

Why the Raid Seized 255 SIM Cards

Two SIM boxes and 255 carrier SIMs are not a help-desk kit. They are how a small rented room can look like a US phone tree, with many numbers in play and calls jumping across cards when one dies or gets flagged.

A July raid in Mahape’s Technocity building, also led with Patil on the case, started from SIM trails on the National Cyber Crime Reporting Portal. Nine SIMs in that earlier file were tied to 145 complaints about fake motor-insurance renewals. Eight of those nine cards were still in use when police walked in on 32 staff working as Ocean Enterprises, AI Ocean LLP and Life Deal. Three men were arrested there. The Apple floor’s 255 cards are the same class of tool, just at a larger count.

Scripts on paper sit next to that hardware for a reason. Everyone on the night line is supposed to say the same thing about Apple ID risk, malware and the fake fix. Jobin as John and Naeem as Tom were the voices. The boxes and the cards were the path that made those voices ring in California or Ohio as if they sat in Cupertino.

Mustafa Khan Is Not on the Arrest List

The four men in custody are a partner-manager and three team leaders. Police named Khan as the owner who sent the $499 texts, and they named his wife, Zareen, as the person who handled admin on both the day and night shifts. They also said the couple were running a call center for illegal stock-market trading. None of that puts Khan or Zareen on the Thursday arrest sheet.

WHAT WE KNOW

• The raid: Officers hit Trade Expert Services at Millennium Business Park, Mahape, late Thursday and found nine agents on the phones.
• The four held: Patel, Balumal, Naeem Sheikh and Sameer Sheikh, named by Patil with ages, towns and roles.
• The cash-out: USDT on TRON QR codes and “Apple for Everything” gift vouchers, plus transfers in US dollars to wallets.

WHAT IS UNCONFIRMED

• The full take: Police put the early US-victim total at about Rs 5 lakh and said it is likely to rise.
• The owners: Khan and Zareen were named in questioning; they were not listed among the four arrested.
• Iggy: Police used that name for a person who moved value to Khan; they did not give a full identity.

Zareen’s alleged admin brief covered both shifts, which is the tell. A floor that sells fake Apple help after dark and fake trades in other hours does not need two companies. It needs one office, two scripts and a person who keeps the roster.

Turbhe Ran This Dual Shift Last November

On November 18, 2025, crime branch and cyber teams raided a third-floor rental in Millennium Park, Building No. 3, Sector 3, Turbhe. They found 97 men and women on the books of names such as The Wealth Growth, The Capital Services, Sigma, Trade Knowledge Services and Stock Vision. Day staff sold Indians fake stock tips on WhatsApp. Night staff sold Americans a fake Microsoft virus screen and a helpline that was a VOIP number back to Turbhe.

Patil said each employee there was given a script on how to talk to people. Police checked 71 bank accounts used on victims and found 61 of them had moved Rs 12.29 crore. One tally put arrests at 20; another from the same week put the figure at 17. Seizures included 108 monitors, 21 CPUs, 38 phones, five laptops, five SSDs and a GSM server. ACP Ajay Lande said the group used malware and ransomware that locked machines on a fake Microsoft error with a number to call.

Mahape kept producing the same kind of room. In March, financial intelligence and cyber units hit DG Share Market Research in the Technocity Greenscape building and said 22 young staff had pulled at least Rs 1.02 crore through payment links and 18 other accounts, with two men arrested and a third wanted. In July, the insurance floor in Technocity’s A-Wing added the SIM-led case with 32 staff and three arrests.

NAVI MUMBAI IT-PARK RAIDS, SAME CLUSTER

Patil’s name sits on the Apple case, the July insurance case and the Turbhe dual-shift case. The parks are a few kilometres apart. The product on the night line is the only thing that changed, from Microsoft to Apple.

Apple Gift Cards Cannot Pay a Stranger

The Mahape scripts did not ask for a cheque to Cupertino. They asked for wallets and for cards branded as “Apple for Everything,” then for the codes. Apple’s own page on gift-card fraud is blunt: Apple gift cards can be used only to buy Apple products and services, and anyone who wants the numbers on the back is running a scam.

Once those codes are read out, the balance can be spent before the buyer reaches police or Apple. That is why the card is useful to a night floor in Mahape. It is sold in a US shop, paid in dollars, and emptied from another country before a bank can freeze a wire.

If you get an unsolicited or suspicious phone call from someone claiming to be from Apple or Apple Support, just hang up.

Apple Support, guidance on phony support calls

Apple also says it never asks for an Apple Account password or verification codes to give support, and it tells people not to pay anyone with Apple Gift Cards. Its page on phony support calls and other scams puts unsolicited “Apple Support” calls in the same bucket as fake pop-ups and phishing mail. The CHAMPI pitch in Mahape needed the opposite: stay on the line, believe the virus, and pay.

The $159 Million Tech-Support Bill for Older Adults

US complaint data explains why a night shift in Mahape would bother with Apple IDs at all. In a March 2025 release, the Federal Trade Commission said people in the United States reported losing more than $12.5 billion to fraud in 2024, up 25% from the year before. Imposter scams, the bucket that includes fake tech support, were the most common fraud type and accounted for $2.95 billion in reported losses.

Christopher Mufarrige, director of the FTC’s Bureau of Consumer Protection, said the data shows scammers’ tactics keep changing. The share of people who reported a fraud and also reported losing money jumped from 27% in 2023 to 38% in 2024. Bank transfers and cryptocurrency beat every other payment method combined, which fits a floor that asked for wallets and USDT as well as cards.

WHAT OLDER ADULTS REPORTED IN 2024

• Tech-support gap: People 60 and older were five times more likely than younger people to report losing money on a tech support scam, per the FTC’s December 2025 older-consumers report.
• The dollar figure: Older consumers reported $159 million in losses to tech support scams that year.
• Median bait: The median loss across all 2024 fraud reports was $497, two dollars under the $499 the Mahape texts claimed had already left the bank.

Phone calls were the second most common way people said a scammer first reached them in 2024, after email. A message about a $499 hit, followed by a calm voice named John, is built for that channel. Police said the Rs 5 lakh reading from the Mahape machines is likely to rise as the files are opened, and they named Mustafa Khan as the owner who sent those texts, though he was not among the four men booked on Thursday night.