BR Patil | Photo credit: file photo
The Special Investigation Team (SIT) probing voter fraud in the Aland Assembly constituency made the first arrest in the case on Wednesday.
A man running two portals that provided phone numbers and OTPs to a Kalaburagi-based private firm to open untraceable accounts on Election Commission (EC) portals through which forged Form 7s were created in 2023 to wipe out genuine Aland voters has been arrested.
Bapi Adya was picked up from a village in Nadia district on the India-Bangladesh border in West Bengal on Wednesday evening. He was produced before the First Additional Chief Metropolitan Magistrate (ACMM) in Bengaluru on Thursday and remanded in police custody for 12 days.
Bapi Adya allegedly runs two portals that provide phone numbers and OTPs sent to those numbers to transact online at ₹10 per such credential.
These portals, the sources said, appear to have links with a similar portal in the United States and their servers are also suspected to be based abroad. The police found several digital devices on the arrested person’s chest.
The mystery of the OTP
In the Aland case, 5,994 out of 6,018 applications in Form 7 (to delete names of voters from the roll) were found to be forged in February 2023 during ground verification following a complaint by Congress candidate BR Patil.
These applications were made to the names of the electors of Aland to have more names removed from the list without any of them knowing. The Hindu reported the case on 7 September 2025.
These fake Form 7s were created through 72 accounts created on EC platforms — Voter Helpline App (VHA), National Volers’ Services Portal (NVSP) and Garuda App, the details of which were shared by the EC with investigators. However, no one has yet responded to further requests for specific technical data.
These 72 accounts were created using 72 mobile numbers in 18 states. While records show that these numbers were sent with OTP from the EC portal while creating login ID and passwords, none of the 72 who used these mobile numbers knew about it. How the private firm that submitted the fake Form 7 zeroed out those 72 phone numbers and how they got hold of the one-time passwords without the owners knowing is still a mystery.
The SIT has so far interrogated six persons associated with a Kalaburagi-based private firm that won the contract to manufacture forged Form 7. The SIT also raided former BJP MLA Subhash Guttedar and his sons in connection with the case. They have a secured anticipatory bail.
One of the key persons running the firm who was in Dubai and returned recently was questioned by the SIT. He helped solve the OTP mystery.
Portals that sell one-time passwords
The co-owner of the company allegedly alerted the investigators to two portals that provided them with 72 mobile numbers and OTPs to open accounts on EC portals.
After registering on these portals for a fee, the client will have to choose a service such as WhatsApp or Telegram and “order” credentials.
The portal will generate a mobile number which needs to be copied and pasted into the selected service in order to send the OTP to that particular number. Bapi Adya was identified and traced through a money trail paid by a Kalaburagi-based firm.
While that was the front end of how these portals worked, what technology they used to access the one-time passwords sent to these random phone numbers that they generated has yet to be cracked.
Web portals that sell logins and one-time passwords without involving the owners of these SIM cards have highlighted their potential for cybercrime. These portals are now likely to be investigated for transactions outside of the Aland case.
Verification process
However, the portals only work for single authentication and not for transactions that have double authentication. EC portals had only one verification during the 2023 voter fraud and now they have double verification.
Published – 13 Nov 2025 20:30 IST
