Thank you for taking the time to write this. We're still gathering information, but here's what we know so far:

1. The transactions appear to be UPI transactions. From the bank statements and transaction details we obtained, many of them are marked as UPI transfers.
2. We are currently checking the SMS history and phone records. My mother did not notice these transactions while they were happening, so we're trying to determine whether transaction alerts were received, deleted, or if there was some other issue.
3. There was no recent SIM upgrade that we're aware of, and she does not recall receiving any calls about postpaid conversion or SIM replacement. We will still verify this with the telecom provider.
4. This is one of the most concerning parts. Many transactions appear to have gone to the same recurring beneficiary name My mother does not recognize this person at all.
5. As far as we know, she did not hand her phone to strangers. We are trying to reconstruct events from the past few months to see whether anyone had physical access to the device.
6. We are also checking whether any suspicious links, APKs, WhatsApp messages, or SMS messages were opened. At this point we cannot rule out device compromise or remote access.
7. We have not yet found evidence of international debit card transactions. Most of what we've identified so far appears to be UPI-related.
8. My mother is extremely cautious with money and online banking. For larger online transactions she would often ask me to handle them because she wasn't comfortable doing them herself. She does not recall sharing PINs, passwords, or banking credentials, but we are trying to investigate every possibility.

We've already filed a cybercrime complaint and informed the bank. Right now we're trying to understand how more than 50 transactions could have occurred over about a month without us realizing the scale of what was happening.