On CCTV footage from ATMs in Kerala's Thiruvananthapuram, three foreigners are seen reaching up and apparently tampering with the smoke alarm.
Then they leave without using the machine.
The odd behaviour was connected to messages that at least 50 people in the Kerala capital received from their banks on Sunday, informing that chunks of money had been withdrawn from their accounts.
One of the men, Romanian Gabriel Marian, was arrested in Mumbai on Tuesday night. He has revealed an MO that was both high-tech and incredibly simple, involving at least two other Romanians, Bogdean Florian and Christan Victor. Kerala wants to ask Interpol to help catch the other two.
The gang had been active for nearly two weeks, said the police, and even stayed for a while at the popular beach resort Kovalam.
The police say the men installed an electronic device in the ATMs to scan account details and pin numbers of those who came to draw money. The details went into fake cards that were used in ATMs in Mumbai.
The money the gang was able to steal could amount to around 4.5 lakhs, say the police.
When the police checked visuals from the ATMs used by the people who complaint, they found the foreigners acting suspiciously. Next, they checked their records from hotels.
Police sources say they are trying to establish through experts how they collected the data and whether more people were involved.
All those who withdrew money from the "fixed" ATMs have been urged to change their pins.