Reliance Jio Impersonation Issue

By Susam Pal on 18 May 2021

Reliance Jio Email Notifications

Since yesterday, i.e., 17 May 2021, I believe someone is impersonating me and buying Reliance Jio mobile numbers with my name and email address. So far three mobile numbers were issued by Reliance Jio to whoever this party is, one of which has been activated. I realized this problem when I received the following three email notifications from Jio at my email address. I am including the date and subject of the emails only for the sake of brevity.

Email Date Email Subject
17 May 2021 19:07 Order Number NO0000HD15ID received for Jio Number 6005758245
18 May 2021 18:36 Order Number NO0000HDA7NG received for Jio Number 9149982331
18 May 2021 19:07 Order Number NO0000HDAHZ7 received for Jio Number 7889875316

For the record, I have never made any purchase or any transaction with Reliance Jio or Reliance Digital ever. Now out of these three orders, two were cancelled eventually. I learnt this from the following two email notifications from Jio:

Email Date Email Subject
17 May 2021 19:12 Unable to process your application for Jio Number 6005758245
18 May 2021 18:46 Unable to process your application for Jio Number 9149982331

The reason for the failed orders was mentioned as follows in these emails:

Due to incomplete or mismatched information, your application for Jio Number [number] could not be processed.

But Reliance Jio has activated the third number!

Email Date Email Subject
18 May 2021 19:28 Your Jio Number 7889875316 has been activated
18 May 2021 20:57 Recharge successful for Jio Number 7889875316

Reliance Digital Email Notifications

In addition to the emails mentioned above, I also received an email from Reliance Digital for each order mentioned above. It appears that whoever is doing this is buying these Jio mobile numbers online via Reliance Digital. Here is a summary of all the orders and the mobile numbers issued so far:

Order Date Order Number Customer Address Customer Contact Number Seller Address in Receipt Mobile Number Issued Status
17 May 2021 19:04 NO0000HD15ID 228, Jalpur Nangal Najibabad, Bijnor 246732, Uttar Pradesh 8082533690 Reliance Retail Limited, HDFC Building Main, Market Kangan, Dist - Srinagar, Kangan, Jammu and Kashmir, Pincode - 191202 6005758245 Unsuccessful
18 May 2021 18:32 NO0000HDA7NG 228, Jalpur Nangal Najibabad, Bijnor 246732, Uttar Pradesh 8082533690 same as above 9149982331 Unsuccessful
18 May 2021 19:04 NO0000HDAHZ7 228, Jalpur Nangal Najibabad, Bijnor 246732, Uttar Pradesh 8082533690 same as above 7889875316 Activated
18 May 2021 20:57 CO0000BV1N1O Check Ganderbal Partly, P O Ganderbal, P S Ganderbal, JK 191131

7889875316

(This is the previous activated number!)

same as above Not issued yet In Progress

See the fourth row which is an order still in progress where this party has used the new mobile number from the third row to purchase yet another Jio mobile number!

Human Error or Impersonation?

One might wonder if these could merely be spam or phishing emails. I have confirmed that these emails are not spam or phishing. I have contacted Reliance Customer Support team about it and while they acknowledge the problem, they are not making any progress in providing a resolution. They just keep asking me to call 1800-88-99999 but that is of no help to me because the first thing you need to do after calling that number is punch in your Jio number. Well, I don't have any Jio number and that is the whole issue here, is it not? I have never had any Jio mobile number. Someone else is buying these Jio mobile numbers with my name and my contact details. Their customer support workflow appears to be totally dysfunctional for an issue of this nature.

If it were only a single purchase order, I could entertain the thought that this could be a genuine customer who happens to have the same name as mine and they happened to enter my email address by mistake. But after 4 orders, 2 rejected applications, 1 activated mobile number, and 1 order still in progress, I have begun to get worried. What are the odds that someone with the same name as mine needs 4 mobile numbers within a span of 2 days using 2 different home addresses for a genuine purpose? It seems fishy!

Lack of Email Address Verification

It is worth noting that there was no email verification whatsoever done either by Reliance Jio or Reliance Digital to confirm whether the person making the purchase really is the owner of the email address or at least has access to the email address they entered while making the purchase. Apparently, Reliance Jio allows anyone to purchase a new mobile number with anyone's email address without verifying whether the customer really has access to the given email address by sending a secret link or secret code to the email address. This appears to be a bug in their purchase workflow. I have reported this bug to them via their bug reporting email address (jio.bugsreporting at jio.com). I have received no response about it yet.

Now I know that only first name, last name, and an email address do not define someone's identity, especially, when the system allows someone to enter any arbitrary email address without verifying if they have access to it. I understand this. I am hoping you do too. But does everyone understand this? If someone misuses the purchased mobile number for an illegitimate activity, would law enforcement understand this? From my prior experience, I am pretty sure it is going to require several rounds of discussion to investigate and explain that although the name and email address are mine, the mobile number isn't mine. Why go through that hassle if it can be avoided merely by delinking my email address from these mobile numbers?

In the best case scenario this could indeed be a mistake by someone who happens to have the same name as mine. But in the worst case scenario this could be impersonation and fraud! I did not want to ignore my gut feeling that this is suspicious, so I decided to talk to Reliance Jio's customer support and have this investigated. In the best case, I would then be able to solve the inconvenience of receiving emails meant for someone else. But in the worst case, I would be able to prevent fraud or at least get my contact details disocciated from a possible fraud. However, this requires Reliance Jio's assistance who have not got back to me with any updates or resolution yet.

Help!

Trying to get the attention of the Appellate Authority at the Jio Srinagar office as well as Jio Bangalore office has yielded no results yet. If you know how I can have this issue resolved, I would appreciate the help! You are welcome to email me directly to susam.pal at gmail.com or talk to me via Twitter. I am @susam on Twitter. Thanks!

Also, here is how you can help to get more attention for this issue. If you are on Twitter, please retweet this tweet. If you are on Facebook, please reshare this post.

Updates

I received an update this afternoon that Reliance Jio's cybersecurity team has got involved after they found my post on Twitter. They are now investigating the matter. They acknowledged the lack of email verification. They are now investigating if some other attributes associated with me also has been misused. I have not received any further updates yet. I will update this section later as further updates arrive. I will share them on my Twitter feed too.