Bengaluru techie hacks loyalty rewards site, steals nearly 5 lakh vouchers

A young techie “obsessed with hacking” allegedly broke into the website of a loyalty rewards company, stole lakhs of gift vouchers and used them to buy gold, motorcycles and expensive electronic gadgets, police say. 

All of 23 years, Bommaluru Lakshmipati allegedly hacked the website of Reward360, which runs loyalty and reward programmes in partnership with HDFC Bank, Standard Chartered Bank, American Express and Payback. 

Between January and June this year, Lakshmipati is suspected to have stolen nearly five lakh gift vouchers and redeemed them to buy Rs 4.16 crore worth of bullion and other valuables on Amazon and Flipkart, according to police. 

The 5.269 kg of pure bars gold seized from him is the biggest haul in the city police’s history. The gold alone is worth Rs 3.4 crore. 

It all began when Lakshmipati acquired debit and credit cards from a private-sector bank during his college days, said C K Baba, deputy commissioner of police (Southeast). When the bank denied him reward points, he developed an “ingenious” technique to exploit their servers and acquire unlimited vouchers. 

Police said he converted these vouchers into substantial amounts of digital currency, which he subsequently invested in precious metals like gold and silver. “He is a techie with brains,” Baba told DH. “The vouchers were meant for different bank card holders. Before the rightful owner could redeem them, Lakshmipathi stole and spent them off.” 

Police got on Lakshmipati's trail after the director of Reward360 filed a complaint on June 24. It detailed how the complaint had lost money because gift vouchers issued to customers were redeemed beforehand. The company suspected a cyberattack. 

Police sifted through tonnes of technical evidence to trace Lakshmpati. They were stunned to find out that he single-handedly carried out the entire con job. 

Lakshmipati is being compared with Srikrishna alias Sriki, the infamous hacker behind the Bitcoin scam. However, the similarity ends there. 

Unlike Srikrishna, Lakshmipati showed no interest in buying Bitcoin or other cryptocurrency. 

"He banked mainly on gold, 24-carat gold," Baba said. He also didn't target any government website, Baba added. 

A court has remanded Lakshmipati in judicial custody. 

Who's Bommaluru Lakshmipati? 

* A native of Chittoor, he studied BTech at the Indian Institute of Information Technology, Ongole. 

* After a brief stint at a company, he started working on his own. 

* Over a five-month period this year, he hacked into the website of Reward360, a company that runs royalty programs in partnership with banks. 

* What police seized from him: 5.269 kg of 24-carat gold worth Rs 3.4 cr; 27.2 kg of silver worth Rs 21.8 lakh; Rs 11.13 lakh in cash; 7 two-wheelers worth Rs 12 lakh; Rs 26 lakh in Flipkart wallet; Rs 3.5 lakh in Amazon wallet; 2 laptops worth Rs 1.3 lakh & 3 mobile phones worth Rs 90,000. 

C K Baba, DCP (Southeast), said Lakshmipati's hacking of Reward360's servers was a significant breach of security that had far-reaching consequences. The breach exposed vulnerabilities in the bank's systems and server security, highlighting the importance of robust cybersecurity measures in the digital age, he said.