Delhi Police have busted an alleged cyber-fraud network involving bank insiders who are accused of helping open dozens of mule accounts using forged signatures and identity documents belonging to unsuspecting people.
Investigators identified 37 suspected mule bank accounts that received around ₹7.36 crore linked to 99 cyber-fraud complaints registered across India.
Six people have been arrested, including a private-bank branch manager and four sales staff members.
Police suspect some of the fraud proceeds were later converted into cryptocurrency, including USDT.
FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders
37 Mule Accounts Found at Two Bank Branches
The investigation centred on two branches of a private bank in Delhi.
Police identified 17 suspected mule accounts at the bank’s Saraswati Vihar branch and another 20 at its Tri Nagar branch.
The case began after investigators scrutinising mule-account data noticed suspicious activity connected to the Tri Nagar branch.
A preliminary check of one account found that the person whose identity had been used had allegedly never visited the branch or applied to open an account.
Addresses associated with two other suspected accounts could not be verified either.
That raised suspicion that a larger network was creating bank accounts without the genuine account holders being physically present.
Police registered an FIR on June 17 and expanded the investigation.
Further scrutiny eventually exposed dozens of accounts allegedly used to receive cyber-fraud proceeds.
Daily-Wage Workers’ Documents Allegedly Misused
Investigators traced the network to Mayank Kapoor, also known as Rinku, who police describe as an alleged operator of the mule accounts.
According to police, Kapoor contacted daily-wage labourers on the pretext of helping them obtain loans.
He allegedly collected their Aadhaar cards, PAN cards, photographs and other KYC documents through mobile phones and social media.
SIM cards were also allegedly arranged in their names.
Those documents were then allegedly used to open bank accounts without the individuals properly participating in the process.
A mule account is a bank account used to receive or move money obtained through fraud.
The person whose identity appears on the account may sometimes knowingly participate for a commission.
In other cases, documents may be misused without the genuine holder fully understanding how the account will be used.
For cybercriminals, mule accounts are crucial because they create distance between the victim and the ultimate beneficiary of the stolen money.
Bank Manager Allegedly Helped Open Accounts
Police say Kapoor came into contact with Shobhit Aggarwal, a manager at the Saraswati Vihar branch.
Aggarwal allegedly helped facilitate the opening of accounts without the supposed customers being physically present.
Police claim forged signatures were used on account-opening documents.
Aggarwal later allegedly introduced Kapoor to Sushant Kumar, manager of the Tri Nagar branch.
Investigators say around 17 mule accounts were opened at Saraswati Vihar and 20 at Tri Nagar with the alleged assistance of bank employees.
Sales team members identified as Manoj, Ankur, Fatma and Pankaj allegedly processed several of the applications before they were approved at branch level.
The allegations have not been proved in court.
The case nevertheless raises serious questions about internal banking controls because KYC rules are specifically designed to prevent anonymous or fraudulent accounts from entering the financial system.
₹7.36 Crore Linked to 99 Cyber Complaints
Police said the 37 accounts were linked to 99 cyber-fraud complaints filed across the country.
Around ₹7.36 crore was credited into the accounts under investigation.
That does not necessarily mean the entire ₹7.36 crore represents confirmed victim losses in the current case.
It represents money flowing through accounts that police have connected to complaints and are now examining.
Investigators allege that part of the proceeds was paid to people who helped operate the accounts.
The remaining money was allegedly converted into cryptocurrency, including USDT.
USDT, or Tether, is a cryptocurrency designed to broadly maintain the value of the US dollar.
Cyber-fraud networks frequently use stablecoins such as USDT because funds can be transferred quickly between digital wallets and across borders.
That does not make cryptocurrency transactions anonymous, but tracing the final beneficiary can require coordination between banks, exchanges and law-enforcement agencies.
Aadhaar, PAN Cards and SIMs Recovered
Police arrested Aggarwal and four members of the bank’s sales team on October 18 after gathering evidence in the case.
During searches, investigators recovered a laptop, seven mobile phones, 11 SIM cards, seven cheque books and seven debit cards.
They also seized ₹60,000 in cash and around 150 grams of gold jewellery.
More significantly, police found 63 Aadhaar cards, 60 PAN cards and 55 passport-size photographs belonging to different people.
Investigators suspect these documents may have been intended for opening additional bank accounts.
The recovery could help police determine how widely the network operated and whether more mule accounts remain active.
The investigation is continuing to identify other bank officials, account operators and overseas or domestic handlers who may have used the accounts to move cyber-fraud proceeds.
What this means for you:
If someone asks for your Aadhaar, PAN, photograph or SIM details while promising a loan or financial service, verify the organisation independently. Misused KYC documents can be used to open accounts that later become part of cyber-fraud and money-laundering networks.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
