BharatPe’s estranged co-founder Ashneer Grover has written an email to National Payments Council of India (NPCI) chief, accusing fellow co-founder and current CEO of OTPLess Bhavik Bhavik Koladiya of data theft of millions of BharatPe users.
Grover has said personal data of over 150 million UPI users were allegedly compromised at BharatPe when Kolidaya used to be the tech lead. FE has reviewed a copy of this email.
“This has been brought to my notice by whistleblowers within BharatPe who have been silenced (hushed up) by the current management under chairman Rajnish Kumar… He (Koladiya) had access to all the payments infrastructure and data at BharatPe and was the point person for NPCI and banks…. It was a grave mistake of giving him a chance at redemption at BharatPe, which he misused to pull off the biggest data theft in India till date,” Grover mentioned in his email to the NPCI.
In a response to FE’s queries, a spokesperson for BharatPe said Grover’s allegations are malicious and baseless. “BharatPe fiercely protects data of its customers and observes high-security standards…OTPless is our service provider that only enables verification via WhatsApp and is used by less than 10% of our merchant base. We are fully compliant on all our data privacy obligations with our customers and partners.”
Grover further alleged that as an architect of UPI acceptance at BharatPe, Koladiya had access to “all the data”. According to Grover, Koladiya, who now runs OTPLess, allegedly obtained user data extracted from payment APIs that BharatPe had with lenders like Yes Bank, Federal Bank and ICICI Bank.
“BharatPe has so far processed billions of UPI transactions at merchants, and was, in turn, privy to data of more than 150 million UPI users in the country. The data of transacting user was obtained at BharatPe using APIs with Yes Bank, Federal Bank and ICICI Bank,” Grover said.
Grover accused Koladiya of committing fraud by copying data obtained from BharatPe servers to allegedly pave way for setting up OTPLess. According to Grover, Bhavik quit BharatPe in July 2022 but continues to have access to all the systems of BharatPe.
Responding to the allegations, Koladiya in a statement said, “I strongly deny the baseless and false allegations made against me by Ashneer Grover. The allegations are nothing but an act of retaliation and frustration on his part, resulting from his removal from BharatPe and my ongoing legal suit against him in Delhi High Court.” Koladiya added, “I take privacy and security of users very seriously and I do not take these allegations lightly. However, in this particular case, there is no cause for concern as the claims made by Grover are completely without merit…”
____________________________________