Delhi Police’s Cyber Police Station in the South-West district has arrested two more alleged members of a fake loan app fraud nexus under Operation CyHawk 4.0, taking forward an investigation into online financial fraud, extortion and the use of mule bank accounts. Police said the latest arrests were made after earlier action in the same case and that the accused were found in contact with other members of the syndicate through virtual numbers linked to Pakistan and Bangladesh.
How the Investigation Expanded
According to the press release dated April 10, the two newly arrested accused were identified as Karan Kumar, 24, and Shami Ahmad, 27, both residents of Kapashera in New Delhi. Police said two mobile phones containing incriminating WhatsApp chats were recovered from their possession. The arrests followed leads developed after four earlier arrests in FIR No. 39/26 under Section 112(2) of the Bharatiya Nyaya Sanhita.
FCRF Launches Premier CISO Certification Amid Rising Demand for Cybersecurity Leadership
Police said the case widened after an analysis of mule bank accounts led investigators to a Bank of Baroda account in Kapashera allegedly used to siphon cheated money. Complaints linked to that account were found to involve a fake loan app scam. Investigators then identified another Bank of India account allegedly maintained in Karan Kumar’s name, which was also linked to two complaints of the same nature, leading to the registration of a second case, FIR No. 54/2026.
A police team was then formed to trace the remaining members of the nexus. During interrogation, Karan Kumar allegedly told police that he had provided his bank account on commission to Shami Ahmad, who in turn passed it on to another person identified as Rahul for use in cyber fraud activities.
The Alleged Fraud Network
Police said analysis of the seized phones revealed WhatsApp chats linked to the operation of the fake loan app fraud, the management of mule accounts and the receipt of cheated money through UPI QR code scanners associated with those accounts. Investigators also said the accused were in touch with other members of the syndicate using virtual numbers from Pakistan and Bangladesh.
The press release said the investigation is continuing to determine whether the virtual numbers were being used by handlers based in Pakistan and Bangladesh or by India-based criminals. It also said technical analysis indicated contact with foreign nationals through WhatsApp, and that UPI IDs were allegedly provided to route cheated funds.
Police described the alleged modus operandi as beginning when victims obtained loans through fake applications, after which access to their mobile phones went to the backend team of the apps. The release said the first instalment was deducted as soon as the loan was generated, and the victims were later threatened with morphed pictures being shared with them or their family members. Police also alleged that cheated money was moved through mule accounts and later converted into cryptocurrency, specifically USDT, to conceal the money trail.
Profiles, Recovery and Next Steps
The two arrested men were described by police as Rapido drivers from the same locality. Investigators said Karan Kumar lived with his parents and had come into contact with the alleged scheme through Shami Ahmad, while Shami allegedly learned about arranging bank accounts for fraudsters through a contact named Rahul at his brother’s mobile phone shop.
Police said the recovery in the case consisted of two mobile phones containing incriminating material related to the operation of the fake loan app scam. Further investigation, the release added, is continuing.
