The investigation into Kanpur’s alleged ₹5,600 crore cyber-fraud network has taken a fresh turn after wanted suspect Ikhlaq Hussain reportedly surrendered before the police, opening a new trail of bank accounts, associates and transactions for investigators.
Police are now examining information allegedly provided during his questioning, including details of 19 additional bank accounts suspected to be connected to firms used by the network. Another suspect was subsequently arrested on the basis of information obtained during the probe, according to police details supplied in the case.
The development expands an investigation that has already identified 77 suspicious accounts linked to firms in Kanpur and Unnao, with cumulative transaction volumes running into thousands of crores.
Proposal for Conducting Cyber Crisis Drill, Tabletop Exercise (TTEx) & CCMP Readiness Exercise
Wanted suspect had earlier been traced towards Nepal
Ikhlaq Hussain had been named as one of the key suspects after the arrests of Shawez Waris and Salman earlier this month.
Police had previously traced his movements to Lucknow and later towards Nepal while teams searched for him. Investigators alleged that he was closely associated with the network and had links to bogus firms and mule accounts used to receive and move funds.
Earlier reporting also linked Ikhlaq to unusually high-value banking activity.
Police said that one of his Bank of Baroda accounts saw around ₹180 crore in transactions within eight days in 2024. The bank had reportedly flagged the activity at the time, after which he was questioned by police and later released.
His surrender now gives investigators direct access to one of the people they had been trying to trace since the network came under wider scrutiny.
Nineteen more accounts widen the financial trail
During questioning, police reportedly obtained information about 19 additional bank accounts.
Some of those accounts are believed to be linked to firms that may still be active.
Investigators are examining how PAN details, mobile numbers and company identities were allegedly reused across multiple accounts.
According to the supplied police information, eight PAN cards and five mobile numbers were connected with one firm, while six cluster accounts were allegedly created using a single PAN.
Accounts under scrutiny are said to span several major banks, including HDFC Bank, IDBI Bank and Axis Bank.
These findings are significant because the earlier investigation had already revealed a complex web of accounts across 14 banks.
Police said nine accounts alone had recorded more than ₹100 crore each in transactions, while one account linked to SK Enterprises allegedly handled ₹295.31 crore.
₹5,600 crore remains transaction volume, not confirmed victim loss
The biggest number attached to the case still needs careful treatment.
Police have estimated that accounts associated with the suspected firms recorded around ₹5,600 crore in transactions over roughly three years.
That does not mean investigators have established ₹5,600 crore as money directly stolen from victims.
The figure represents transaction volume detected across the accounts being examined.
PTI reported that investigators had identified around 76 suspected firms and 82 to 86 complaints on the National Cyber Crime Reporting Portal while verifying the ₹5,600 crore trail.
Police are trying to separate legitimate-looking turnover from suspected cybercrime proceeds, gaming and betting transactions, possible hawala transfers and alleged GST input-tax-credit abuse.
That work could substantially change the final fraud figure.
Fresh questioning may reveal how firms and accounts were arranged
Ikhlaq reportedly told investigators that he operated a hotel on lease and also had a GST-registered firm.
Police are examining whether those businesses were used for genuine commercial activity or formed part of the larger financial structure under investigation.
The second suspect arrested after his surrender is also being questioned about the creation of firms and bank accounts allegedly used by the network.
Police have previously said that several of the 77 firms linked to the investigation existed only on paper or could not be verified at their declared addresses.
That has raised questions about who created the companies, who completed their GST and banking documentation and who ultimately controlled their accounts.
The probe has also widened to possible bank-level failures.
Amar Ujala reported that officials connected to 14 banks are under scrutiny over unusually large transactions passing through accounts with apparently modest profiles. Those individuals have not been found guilty, and police must establish whether there was deliberate involvement, negligence or no wrongdoing at all.
Four accounts linked to surrendering suspect also under examination
Police are also examining four accounts allegedly linked to Ikhlaq in which around ₹7.53 crore in transactions were detected between 2024 and the present, according to information provided with the latest development.
Those accounts are said to be with State Bank of India, Bank of Baroda, HDFC Bank and ICICI Bank.
Investigators will need to determine the source of those funds, their destination and whether they overlap with accounts already connected to cybercrime complaints.
Authorities are also looking at property and vehicles associated with suspects to establish whether assets were purchased using funds allegedly generated through illegal transactions.
This stage is important because account turnover alone does not establish criminal proceeds.
Police will need to connect individual transactions with victims, suspected fraud platforms, gambling accounts, hawala operators or other identifiable illegal activity.
Case has already expanded far beyond original complaint
The investigation began from a much smaller fraud complaint.
Police said the initial case involved an alleged ₹25 lakh fraud registered in August. Following the money trail eventually exposed dozens of accounts and firms, leading investigators to examine thousands of downstream transactions.
The network is now being examined for alleged links across 18 states and overseas locations.
Police have also been looking at travel to Dubai, Turkey, Uzbekistan and Kyrgyzstan by people associated with the case, along with suspected Nepal connections.
The surrender of a wanted suspect could now help investigators test some of those earlier claims against direct questioning and banking evidence.
What this means for you
Large cyber-fraud cases are often uncovered by following bank accounts rather than by identifying the caller or app used to scam the victim. If police successfully connect the newly identified accounts to other complaints, more victims and beneficiary accounts may emerge from the same network.
The420 Insight
The significance of Ikhlaq Hussain’s surrender is not simply that another suspect is now in custody. It gives investigators a chance to test the structure behind the money — who arranged the firms, who controlled the accounts and why enormous transaction volumes passed through businesses that police say may have existed largely on paper.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
