Panchkula: The Cyber Crime Police Station in Panchkula, Haryana, has arrested the alleged kingpin of an interstate cyber fraud syndicate accused of hacking Income Tax e-filing accounts of Non-Resident Indians (NRIs) and fraudulently claiming tax refunds worth crores of rupees. During the investigation, police uncovered suspicious financial transactions amounting to nearly ₹13 crore across nine bank accounts linked to the accused. A court has remanded him to eight days of police custody for further interrogation.
The accused has been identified as Dalip B.R., alias Dalip Rajgoda. According to investigators, he illegally accessed NRI Income Tax e-filing accounts, filed forged revised income tax returns in the victims’ names, and diverted fraudulent tax refunds into fake bank accounts. Police are now questioning him to identify other members of the syndicate, trace fake bank accounts, and uncover the complete money trail.
Investigators revealed that Rajgoda is also facing eight similar cyber fraud cases in Bengaluru. The Enforcement Directorate (ED) had arrested him in 2025 in a separate case. After securing bail, he allegedly kept changing locations to evade arrest. A B.Tech graduate in Mechanical Engineering, Rajgoda reportedly told investigators that he worked as a coconut trader.
The case came to light following a complaint from an NRI originally from Panchkula who has been residing in the United Kingdom for nearly five decades. The complainant had duly filed his Income Tax Return (ITR) for the financial year 2023–24 and had already received his legitimate tax refund. Subsequently, cybercriminals allegedly hacked his Income Tax e-filing account and changed the registered email address, mobile number, and bank account details.
The fraudsters then filed a forged revised income tax return in the victim’s name and fraudulently obtained an additional tax refund of approximately ₹2.26 crore, which was transferred to a fake bank account. Preliminary findings suggest that the operation was carried out in a manner that prevented the victim from detecting the unauthorized changes.
An examination of banking records and documents obtained from the Income Tax Department revealed that the fraud proceeds were first routed through multiple fake bank accounts before being transferred to various company accounts. Investigators suspect that commissions were deducted at different stages before the remaining funds were passed on to the key members of the syndicate. Police are now tracing the beneficiaries and reconstructing the complete financial trail.
Earlier in the investigation, police had arrested co-accused Kanhaiya Lal and recovered ₹5 lakh in cash from his possession. Technical evidence and information obtained during his interrogation led investigators to Rajgoda. The case was originally registered in 2024.
During Rajgoda’s arrest, police seized a laptop and a mobile phone. Both devices have been sent for forensic examination to determine how many Income Tax accounts were compromised, whose personal data was exploited, and the geographical spread of the cyber network.
According to the Future Crime Research Foundation, taxpayers should enable Multi-Factor Authentication (MFA), use strong and unique passwords, and regularly monitor their registered email address, mobile number, and bank account details linked to their Income Tax e-filing accounts. Any unauthorized changes or suspicious activity should be reported immediately to the concerned authorities and the cyber police.
Police said efforts are underway to arrest other members of the syndicate. Teams have been dispatched to multiple states, while investigators are also examining the role of banks where fake accounts were allegedly opened using forged documents. Authorities are further investigating whether the network targeted additional victims using the same modus operandi.
