MUMBAI: What began as routine threat monitoring by cybersecurity firm CloudSEK has unearthed a national crisis rooted in a quiet corner of Maharashtra. Jamade village in Dhule district has emerged as the unlikely hub of a highly-organized counterfeit currency network that used Facebook, Instagram, and YouTube to distribute fake notes worth an estimated ₹17.5 crore over six months.
CloudSEK’s STRIKE team, using a combination of OSINT (Open Source Intelligence) and HUMINT (Human Intelligence) methods, tracked and profiled the syndicate’s key players, revealing their faces, contact numbers, GPS coordinates, and operational tactics. What’s more alarming—the network ran in broad daylight, operating openly on public Facebook groups and pages, with some sellers even promoting their business through Meta Ads.
The Digital Trail: From Posts to Payments
CloudSEK began the investigation in December 2024 while monitoring suspicious keywords like “second currency” and “A1 note” on open digital platforms. Their threat intelligence platform, XVigil, flagged over 4,500 posts, 750+ social media accounts, and 410+ unique phone numbers engaged in selling counterfeit currency between December 26, 2024, and June 26, 2025.
Unlike dark web marketplaces that thrive on anonymity, this network used Facebook groups, Instagram Reels, and even YouTube Shorts to openly market fake notes. Sellers enticed buyers with offers like ₹5–8 lakh in counterfeit notes for every ₹1 lakh of real currency. Posts often showcased stacks of fake ₹500 and ₹2000 notes, accompanied by personal mobile numbers and videos to build buyer trust.
Sophisticated, Open, and Bold Operations
Analysis of these posts revealed detailed pricing, shipping options, and claims that the fake notes were of “A1 quality”, capable of bypassing ATMs, CDMs, and counterfeit detection systems. These notes closely replicated original features like color-shifting ink, watermarks, security threads, and even texture.
To instill trust, sellers posted handwritten notes next to the fake currency, sometimes offering live video calls or “cash-on-delivery” deals. In many cases, buyers were offered personal inspection before purchase, further blurring the line between scam and trust-based transaction.
The Tech Behind the Crime
CloudSEK also uncovered the tools and techniques used by these operators:
- Sellers used Adobe Photoshop and distributed editable PSD files of Indian currency to design and customize fake notes.
- They printed these using large-format, high-resolution printers, capable of replicating currency at scale.
- Alarmingly, some sellers even showcased specialized security paper pre-embedded with green security threads and watermarks—mimicking legitimate RBI-printed paper.
This mix of digital design tools and industrial-grade equipment enabled them to mass-produce convincing counterfeit notes.
India’s Bank Fraud Crisis Deepens: RBI Report Flags ₹36,014 Crore Scam Surge, PSBs Hit Hardest
Delivery Network and Operational Risks
Once a buyer expressed interest, communication shifted to WhatsApp or phone calls. Payments were arranged for either in-person delivery, courier services, or “dead drops” at designated locations.
However, the dealings weren’t always smooth. CloudSEK flagged instances of:
- Advance payment scams (where money was taken but no delivery made)
- Robbery during physical meetings
- Sellers intimidating buyers by claiming local criminal connections
These risks highlighted not just financial fraud, but serious public safety concerns.
Identifying the Masterminds: Names, Faces, and Coordinates
CloudSEK went beyond surface-level detection. Its investigators conducted in-depth attribution to identify the people behind the operation:
Group Admins:
- Vivek Kumar – Operated a Facebook group titled “Fake Indian Currency Contact”. His exact location was traced to Jamade village (GPS: 21.2146251, 74.3404639). He promoted fake currency under aliases such as Anand Kedia and posted frequently with his number: +918265032575.
- Karan Pawar – Managed a group titled “Fake India Second Hand Currency”. His presence was also pinned to Dhule (GPS: 21.21437, 74.34102). He operated under multiple aliases: Surya Pawar, Robin Pawar, with contact: +917559336902.
Active Sellers:
- Nishant Chavare – Facebook & Instagram active, traced to GPS: 21.21529, 74.34154
- Sachin Deeva – Facebook & YouTube active, found at GPS: 21.21470, 74.34087
- Gotam Pawar – Facebook seller traced to GPS: 20.80663, 74.63422
- Tukaram Rm (aka Aashiq Laila) – Operated multiple Facebook accounts, traced to GPS: 21.03086, 76.35246
- Sandip Sonawane – Instagram seller located at GPS: 18.43264, 73.85996
- Madhav Gaikwad & Sumit Kumar – Instagram sellers using multiple identities and burner numbers
In total, CloudSEK attributed at least 350 sellers based on 410 unique phone numbers—each likely responsible for crores in circulation.
Dhule: A Coordinated Counterfeit Hub
The investigation revealed a clear geographical clustering of sellers in Dhule, with Jamade village appearing repeatedly as a hotspot. This indicates the existence of a well-coordinated counterfeit syndicate, with potential links between sellers, group admins, and production units operating locally.
Further evidence from public news reports confirms the region’s history with such crimes:
- March 2024: ₹25,000 in fake notes seized from youth in Dhule
- October 2023: Dhule police booked 24 people in counterfeit racket
- 2022: ₹5 lakh seized in Shirpur area (Dhule district)
- 2021: TV9 Marathi reported arrest of four individuals with fake notes in Dhule.
Why This Is a National Emergency
Counterfeit currency is not just about lost money—it poses serious systemic threats:
- Economic Destabilization: Fake notes inflate money supply, triggering inflation and devaluing the rupee.
- Direct Loss to Citizens and Small Businesses: Victims include roadside vendors, shopkeepers, and low-income workers who can’t recover their losses.
- National Security Risks: These operations may be linked to terror financing, narcotics trade, and cross-border crime.
- Law Enforcement Overload: Tracking, analyzing, and prosecuting such cases diverts enormous public resources.
- Erosion of Trust in Cash: Rural economies and cash-heavy sectors suffer when people become wary of using physical money.
Recommendations for Authorities and Platforms
CloudSEK has submitted its findings to national and state law enforcement, urging swift and systemic action. Key recommendations include:
- Immediate surveillance and raids in Dhule and Jamade
- Takedown of identified Facebook and Instagram accounts
- Monitor Meta Ads promoting illegal products
- Social media platforms to flag keywords and hashtags like #fakecurrency, #a1note, #counterfeitindia
- Use of AI-based threat monitoring tools like XVigil by LEAs for real-time detection
The Digital Battlefield: CloudSEK’s Role
The investigation was powered by CloudSEK’s XVigil platform, which monitored open-source environments for suspicious activities using keyword triggers. The platform’s modules like Fake Pages, Fake Call Centers, and Meta Ads Monitor provided layered visibility across Facebook, Telegram, Instagram, and YouTube.
This fusion of cyber intelligence and human verification enabled a detailed mapping of the ecosystem—proof that counterfeit crime is no longer hidden in the shadows. It’s happening in your feed.
A Wake-Up Call to the Nation
This isn’t just an exposé of one syndicate. It’s a warning about how fraudsters are adapting faster than policy, law enforcement, or tech platforms.
The Dhule counterfeit currency case is a blueprint for modern-day digital crime—organized, decentralized, and dangerously open. To defeat it, India needs a response just as agile, just as coordinated, and just as bold.