Mumbai Police have arrested six people in an interstate cyber-fraud investigation that has expanded from a ₹10 lakh impersonation scam into a nationwide network allegedly linked to 255 complaints involving about ₹72 crore.
The investigation began after an accountant reported receiving a WhatsApp message from an unknown number displaying his company owner’s photograph.
Believing the message to be genuine, he allegedly transferred ₹10 lakh as instructed.
Police later followed the transaction trail across bank accounts, mobile phones and cryptocurrency channels, uncovering what they describe as a wider network dealing in bank accounts, SIM cards and fraudulent proceeds.
₹10 Lakh Complaint Opens Wider Investigation
The complainant received the WhatsApp message on July 30.
The sender allegedly posed as the owner of the firm where the accountant worked and instructed him to make a financial transfer.
After the accountant realised he had been deceived, a case was registered at Mulund police station under provisions of the Bharatiya Nyaya Sanhita and Information Technology Act.
Investigators then began analysing the bank transactions and mobile numbers connected to the fraud.
Police found that ₹5.50 lakh of the allegedly stolen amount had been transferred to a bank account in Meerut, Uttar Pradesh.
The money was subsequently withdrawn through a cheque.
That transaction gave investigators a physical trail to follow.
A Mumbai Police team travelled to Meerut and arrested three suspects.
Questioning and technical analysis then led to three additional arrests from Ghaziabad in Uttar Pradesh, Vadodara in Gujarat and Kandivali in north Mumbai.
Police recovered ₹5.50 lakh and five mobile phones during the operation.
Phones Reveal Links To 255 Cyber-Fraud Complaints
The scale of the suspected network emerged after investigators examined banking information stored on the seized phones.
According to police, one suspect’s device contained details of 11 bank accounts.
Those accounts were allegedly connected to 182 cyber-fraud complaints registered across 21 states.
Investigators then examined another suspect’s phone and discovered information relating to 49 additional bank accounts.
Those accounts were linked to 73 more cybercrime complaints.
Together, the two sets of accounts were connected to 255 complaints across the country.
Police estimate that the total amount involved in those cases is around ₹72 crore.
The figure represents the wider money trail associated with complaints linked to the discovered accounts and does not mean the six accused have yet been convicted of personally stealing the entire amount.
Investigators are still establishing the precise role of each suspect and how individual accounts were controlled.
Telegram Used To Buy And Sell Accounts, SIM Cards
Police say members of the network used Telegram groups to buy and sell bank accounts and SIM cards.
Such accounts are valuable to cyber-fraud operators because they provide somewhere to receive money taken from victims without immediately exposing the identity of the person running the scam.
An account may be opened or obtained by one person before being handed to another operator.
The details can then be resold or circulated through online groups.
This creates layers between the victim and the people ultimately controlling the proceeds.
Investigators increasingly refer to these as mule accounts.
In large networks, a single scam can involve multiple account suppliers, SIM-card providers, intermediaries, cash handlers and cryptocurrency operators before the money reaches its final destination.
The Mumbai investigation appears to be examining exactly such a chain.
Malicious APKs Allegedly Used To Control Account Holders’ Phones
Police have also alleged that the gang installed malicious APK files on the mobile phones of some account holders.
APK files are installation packages used by Android devices.
Legitimate applications use the same format, but cybercriminals can distribute modified APKs containing malicious software.
Police say the files in this case were allegedly used to control devices belonging to account holders and receive or manage fraudulent funds.
If an attacker gains sufficient control over a phone, they may be able to monitor messages, access authentication information or interfere with banking activity.
That can allow criminals to operate an account even when it remains registered in another person’s name.
This also complicates investigations because the legal account holder and the person technically controlling the transactions may be different people.
Money Routed Through Accounts Before Crypto Conversion
Investigators say proceeds from cyber fraud were routed through multiple bank accounts before being withdrawn as cash or converted into USDT cryptocurrency.
USDT, also known as Tether, is a cryptocurrency designed to maintain a value close to the US dollar.
Cybercrime networks sometimes use cryptocurrency after moving money through conventional bank accounts because digital assets can be transferred quickly across borders and between wallets.
The conversion does not make transactions invisible, but it can add another layer to the laundering process.
Police are likely to examine wallet addresses, exchange records and communications recovered from the suspects’ devices to determine where the funds ultimately moved.
The ₹72 crore trail suggests that the investigation may extend beyond the six people arrested so far.
Account Infrastructure Is Becoming Central To Cybercrime Probes
The case illustrates how one relatively ordinary impersonation complaint can expose a much larger financial network.
The initial victim allegedly lost ₹10 lakh after responding to a WhatsApp message.
But the investigation changed once police stopped looking only at the sender and started tracing the receiving accounts.
That trail led from one ₹5.50 lakh transfer to dozens of accounts and hundreds of complaints.
For law-enforcement agencies, this financial infrastructure is increasingly becoming one of the most useful ways to dismantle organised cybercrime.
Callers, fake profiles and phishing websites can be replaced quickly.
Bank accounts, SIM cards and cryptocurrency channels, however, leave records that can connect separate fraud complaints across different states.
The Mumbai Police investigation is now focused on identifying additional account suppliers, handlers and ultimate beneficiaries connected to the network.
