BharatPe fight escalates: Ashneer Grover writes to NPCI, independent director alleging data theft by Bhavik Koladiya

Ashneer Grover said that whistleblowers within BharatPe brought this data theft development to his attention.

Ashneer Grover, BharatPe's estranged cofounder has written an email to the National Payments Council of India (NPCI) and BharatPe's independent director Kaushik Dutta alleging data theft of around 150 million Unified Payments Interface (UPI) users of the fintech startup by his fellow cofounder and current CEO of OTPLess Bhavik Koladiya.

“It was a grave mistake of giving him (Koladiya) a chance at redemption at BharatPe, which he misused to pull off the biggest data theft in India till date…Bhavik previously was convicted in the US for credit card fraud, where he was put under house arrest for 18 months and subsequently deported to India. And, in India, he also has a FIR registered against him at Delhi airport as he attempted to travel to Gujarat on a forged ticket. I’ve attached documents pertaining to his conviction and copy of the FIR,” Grover wrote in an email on February 6.

"BharatPe has so far processed billions of UPI transactions at merchants and in turn was privy to data of more than 150 Mn UPI users in the country. The data of transacting user was obtained at BharatPe using APIs with Yes Bank, Federal Bank and ICICI Bank," Grover said.

Moneycontrol has seen the copy of the email.

"I strongly deny the baseless and false allegations made against me by Ashneer Grover. The allegations are nothing but an act of retaliation and frustration on his part, resulting from his removal from BharatPe and my ongoing legal suit against him in Delhi High Court,” Koladiya said in response to Moneycontrol’s query.

“I take the privacy and security of our users very seriously and I do not take these allegations lightly. However, in this particular case, there is no cause for concern as the claims made by Mr. Grover are completely without merit,” Koladiya added.

In a response to Moneycontrol’s queries, BharatPe said that the data of its customers are protected and it observes high-security standards.

"This allegation is malicious and completely baseless. BharatPe fiercely protects the data of its customers and observes high-security standards…OTPless is our service provider that only enables verification via WhatsApp and is used by less than 10 percent of our merchant base and we are fully compliant on all our data privacy obligations with our customers and partners,” BharatPe’s official spokesperson said.

Koladiya, one of the company's founders and the first CEO, left in August 2021 to start OTPLess along with Tanmay Sagar and Satyam Nathani who were also founding members of BharatPe. Three other former senior BharatPe executives, Sagar Satija, Manas Poddar, and Chirag Bhadiyadra, have also joined OTPless.

OTPLess is a platform that allows users to sign in to any website or platform using WhatsApp. The main idea is to avoid using traditional SMS OTPs and provide users with a seamless experience when signing in to websites. Within a few months of its launch, the startup was able to sign up around 2,000 clients, including BharartPe, as per various news reports.

“Bhavik did a very systematic fraud, where he formed another company in the name of his wife Dharti Koladiya by the name of ‘Otpless Solutions Private Limited’ in 2021, while he still was at BharatPe. He then transferred all the privileged and confidential data of BharatPe to this company OTPLess. He also hired the core team he worked at BharatPe at OTPLess over time,” Grover wrote in the email.

Grover said that whistleblowers within BharatPe brought this data theft development to his attention.

“Whistleblowers are being silenced (hushed up) by the current management under Chairman Mr. Rajnish Kumar,” he added.

Grover also claims that Sagar and Nathani of BharatPe are now designated cofounders of OTPLess. The whole transaction processing team of more than 10 engineers at BharatPe has been poached by Bhavik to OTPLess.

Grover has requested NPCI to conduct a forensic audit of OTPLess servers and BharatPe architecture/servers to assess the extent of the data breach and take immediate remedial measures. “This is a serious breach of privacy of UPI users and should be punishable under law,” Grover wrote.

NPCI’s managing director Dilip Asbe could not be reached for a comment on this development.

Grover also requested BharatPe's Independent Director Dutta to investigate whether BharatPe management has been pursuing frivolous cases and complaints against him as a smoke screen to cover up this more serious crime. He called for a full audit of IT systems and the level of access enjoyed by previous employees now working at OTPLess.

“Necessary actions against all management who have been complicit in this crime including removal from board and employment and cancellation of their ESOPs and benefits availed at BharatPe,” Grover wrote.

Grover Vs Koladia

The Delhi High Court summoned Grover and BharatPe in January 2023 as part of a lawsuit filed by Koladiya to reclaim shares transferred to Grover.

Koladiya, who was working as a consultant for the company, resigned from his position at BharatPe in August of last year.

During that time, Koladiya had said BharatPe was one of his largest investments and he would continue to stay invested in the company for the foreseeable future.

Earlier news reports indicated that Grover held some BharatPe shares on behalf of Koladiya.

Koladiya co-founded the fintech company with Shashvat Nakrani in 2017. In 2018, the duo sought a chief executive officer for the company, and they subsequently joined hands with Grover.