It began with a simple Google search for a helicopter service to Kedarnath for the Char Dham Yatra.
On May 12, a government official found what appeared to be an authorised booking website, completed the payment in minutes and received confirmation and two tickets on WhatsApp and Gmail.
But when his family reached the Phata helipad, they were in for a shock — the tickets were fake.
Investigators said the website was part of a wider cyber fraud operation that allegedly targeted pilgrims across India. Three arrests have been made.
According to police, the government official clicked on a Google link — ‘irctc-heliyatra.com”.
The portal carried the tagline, ‘Divine journey to four sacred Himalayan abodes’, along with a package advertising ‘4 Dhams, 5N/6D from Rs 89,999’ and photographs of the four pilgrimage sites.
The official clicked ‘Book Now’ and was redirected to another page titled ‘Trans Bharat Aviation Kedarnath Helicopter Ticket Booking by 2026’, with a helicopter image and a mobile number.
Story continues below this ad
He clicked on the number and a WhatsApp chat opened, where he immediately received details of helicopter fares: Dehradun to Kedarnath (Rs 23,000), Sirsi to Kedarnath (Rs 6,390), Phata to Kedarnath (Rs 10,164) and Guptkashi to Kedarnath (Rs 12,762).
Police said the official called the number, and the person on the other end asked him which package he wanted to book. The official chose the Phata-Kedarnath helicopter service for two family members. The caller assured him that a booking link would be sent shortly.
The payment was made and he received two e-tickets worth Rs 20,328 via Gmail and WhatsApp.
Satisfied that everything was in order, the family set off from Delhi. At the Phata helipad, security personnel of Trans Bharat Aviation informed them that the tickets were fake.
Story continues below this ad
Trans Bharat Aviation, one of India’s oldest non-scheduled helicopter operators, offers helicopter charter services for elections, VIP movement, heli-pilgrimages, joy rides and aerial surveys. Its official website clearly states that it does not accept direct bookings and that http://www.heliyatra.irctc.co.in is the only authorised platform for reservations.
A police officer said the victim had booked the tickets through “irctc-heliyatra.com”, a domain designed to closely resemble the actual website.
“From Phata, the government official filed a complaint on the National Cyber Crime Reporting Portal (NCRP), following which it was transferred to the Cyber Police Station of South Delhi,” the officer said.
The three accused
Deputy Commissioner of Police (South) Anant Mittal said a dedicated team led by Inspector Hansraj Swami, SHO of Cyber Police Station, South District, under the supervision of Additional DCP (Operations) Arvind Kumar, was constituted. After a preliminary inquiry, an FIR was registered.
Story continues below this ad
Police soon realised the case was much larger than a single incident.
‘What initially appeared to be a single case of online cheating turned out to be a larger cyber fraud operation spanning multiple states,” said Mittal.
Through detailed analysis of bank accounts, the money trail, domain registrations, Gmail records, IP logs and technical evidence, police identified the accused and arrested two men, Omprakash Kumar and Rohit Kumar, from Nalanda in Bihar on June 2.
During questioning, police said they disclosed the role of a third accused, Shreyansh Tiwari alias Shivam, a BTech student from Jaunpur, Uttar Pradesh. He was later arrested from Noida.
Story continues below this ad
Modus operandi
Investigators said Omprakash came in contact with Shreyansh through Telegram after learning that the latter could develop websites, and allegedly offered him Rs 40,000 to create the fake booking portal.
Police described Shreyansh as the technical mastermind behind the operation. He allegedly developed and maintained the fake websites, while Rohit handled customer calls, communicated with prospective victims over WhatsApp and managed financial transactions by routing payments through multiple bank accounts.
They said the syndicate cloned official-looking websites, promoted them through paid advertisements on Meta platforms and directed victims to WhatsApp conversations. Once trust was established by sharing fare charts, package details and booking links, victims were persuaded to transfer money.
Their investigation so far has revealed that the gang is linked to nearly 30 complaints registered on the NCRP from different states and Union Territories, involving cheated amounts estimated at Rs 10 lakh.
Story continues below this ad
Investigators suspect the actual number of victims may be significantly higher, as many pilgrims either fail to report cyber fraud or realise they have been cheated only after reaching the helicopter boarding point.
Police said Omprakash was previously booked in a cyber job fraud case in 2022 at the Cyber Police Station in Northwest Delhi and spent a few months in jail before securing bail and returning to Nalanda.
The other two accused have no criminal record and were allegedly acting on Omprakash’s instructions.
Police recovered eight mobile phones, two laptops, a 10th-generation iPad, multiple ATM and debit cards, and froze Rs 20,328 in a bank account through a lien.
Story continues below this ad
Investigators are now examining whether the syndicate operated similar fake portals for other religious destinations, tourism services or seasonal events and if they are linked to larger cyber fraud networks operating across states.
They are also trying to contact other victims who are believed to have been duped through the fake websites.
A word of caution
Police said the case highlights how cyber criminals are increasingly exploiting the rush for pilgrimage bookings by cloning official-looking websites and promoting them through targeted social media advertisements to deceive devotees.
Officers said fraudsters are taking advantage of the high demand for limited helicopter seats during the Char Dham season, when pilgrims often make bookings in haste and are less likely to verify website addresses.
Story continues below this ad
A police officer advised people not to trust the first website that appears in Google search results. “Always verify that you are using the official website before making any payment, especially for pilgrimage bookings,” the officer said.
Police also urged pilgrims to cross-check URLs carefully, avoid completing bookings through links shared over messaging apps, and report suspected fraud immediately through the NCRP or by dialling the cybercrime helpline 1930, as early reporting improves the chances of freezing stolen funds.