The National Testing Agency (NTA) on Monday admitted that the newly introduced refund process on the NEET-UG 2026 portal had “primary flaws” which a 19-year-old man from Bihar used to hack the login credentials of candidates to transfer refunds to his own account.
The vulnerabilities came to light during an investigation by the Ahmedabad Cyber Crime Branch into a complaint filed by a parent that her daughter’s NEET application number and password were stolen and misused. Ahmedabad Joint Commissioner of Police (Crime), Sharad Singhal, said that based on the technical data provided by NTA, along with analysis of bank account details and human intelligence inputs, Navinkumar Yadav, a resident of Gaya, was traced and arrested in Bihar.
National Eligibility Entrance Test (NEET) is required for admission to undergraduate medical courses.
Read also: ‘We’d better decide’: Supreme Court keeps Trans Act proceedings in 4 high courts
How are refunds made?
Police said Yadav targeted NEET portal accounts of around 350 students in various states and managed to access around 150 accounts. He exploited weak and simple passwords used by about 150 of them for unauthorized access. Once inside the accounts, he changed the registered bank account details and replaced them with his own, with the aim of transferring the eligible refund amounts directly to himself.
Investigators did not reveal how Yadav identified the accounts he targeted.
Read also: Delhi’s unsafe neighborhoods and the human cost of unauthorized growth
The refunds were due to the cancellation of the NEET-UG 2026 exam conducted on May 12 on May 3 after overlaps were discovered between the previously distributed guess paper and the actual question paper. The CBI is investigating the paper leak. The re-examination will take place on June 21. More than 2.27 million aspirants were affected by the cancellation.
What NTA said
At a joint press conference in Ahmedabad with JCP Singhal, Akash Jain, joint director of NTA, said: “There is an attempt to tarnish the image of NTA. This joint investigation is important to ensure that students who have worked hard and made honest efforts do not feel cheated again.”
Read also: In the midst of a war between the United States and Iran, clean energy allows India to take risks
Jain stressed that the upcoming re-examination on June 21 will include tight security features using government protocols for question paper preparation, transportation, and public conduct. Two-step security, including mobile OTP, has been introduced, along with efforts for Aadhaar-based OTP. Jain added that the refunds – a new move for NTA – are aimed at being provided to students as soon as possible.
“There may have been initial shortcomings, but through this investigation we learned and enhanced our system. We are now running the system with high security,” Jain said.
Separately, the Cyber Crime Branch arrested Sumer Singh, an ITI (electronics) graduate from Jaipur, and Akash Meena, a BA graduate from Kota, for running an inter-state Telegram racket targeting candidates for NEET re-examination. The duo falsely claimed to have the question papers, accused $49,999 for complete packages and $12,750 for individual subjects.
Investigations revealed that they ran eight channels on the Telegram application with artificially inflated memberships, and operated 44 websites related to gaming and electronic fraud. It’s almost washed out $1.5 crore through various accounts to hide the source of funds. While 12 complaints were linked to their accounts and 1,000 contacts were identified, no actual screening materials were found, police said.
HT reached out to NTA officials in Delhi for a response but did not immediately get one. Separately, the agency said in a statement that it has launched a platform to “make it easier for candidates, parents, coaching institutes and members of the public” to report suspicious claims, unauthorized content or fraudulent activities” related to NEET re-examination.
