New Delhi: Delhi Police have busted a large inter-state investment fraud syndicate and arrested eight individuals from multiple states, following a coordinated investigation into a cyber-enabled financial scam. Police said the syndicate used fake investment schemes to cheat victims and routed the stolen money through “mule” bank accounts to foreign cyber handlers operating from Cambodia.
Investigators said the racket functioned in a highly organised manner, with bank accounts opened across different parts of India and used on a commission basis to move fraud proceeds. The money was circulated through multiple domestic accounts before being transferred abroad to overseas operators coordinating the scam.
Certified Cyber Crime Investigator Course Launched by Centre for Police Technology
₹15.58 lakh fraud led to investigation
The case was registered in November 2025 after a 42-year-old woman from south Delhi approached the cyber police with a complaint of investment fraud. According to the complaint, the victim received WhatsApp messages offering expert guidance in stock market trading, along with assurances of guaranteed returns.
Police said the victim was gradually persuaded to transfer ₹15.58 lakh into multiple bank accounts shared by the fraudsters. When the promised returns failed to materialise and communication ceased, the victim realised she had been cheated and filed a formal complaint.
Mule account network and fake firm uncovered
During the investigation, technical analysis led police to a network supplying mule bank accounts for the syndicate. It emerged that a fake business entity had been created in Telangana to open a current account with a private bank, which was then used for cyber fraud operations.
Police said the account was subsequently shared with associates operating in other states. Initial transactions were conducted to test the account’s usability before large volumes of cheated funds were routed through it. The probe revealed an operational footprint spanning Delhi, Uttar Pradesh, Rajasthan, and Telangana.
Coordination with foreign handlers via encrypted platforms
According to investigators, certain members of the syndicate were responsible for arranging mule accounts across India and sharing account credentials with foreign handlers through encrypted messaging platforms such as Telegram. The cheated money was first deposited into Indian bank accounts and then layered through several transactions to obscure the trail before being transferred out of the country.
The investigation also revealed that some of the bank accounts used in the scam had already been linked to multiple complaints on the National Cyber Crime Reporting Portal (NCRP), yet continued to be used for fraudulent transactions.
Digital evidence seized
During raids conducted across several locations, police recovered 10 high-end mobile phones and 13 SIM cards. These were allegedly used for operating mule accounts, transferring funds, and coordinating communication within the syndicate.
Investigators said the seized devices contain extensive digital evidence, including bank account details, chat histories, transaction records, and contact networks linked to the fraud.
Fraudulent WhatsApp numbers operated from abroad
Police also found that the WhatsApp numbers used to lure victims with investment offers were not being operated from India. Technical analysis indicated that the numbers were controlled from Cambodia, while the India-based accused facilitated account management and the movement of funds domestically.
Officials said this structure allowed the syndicate to separate victim interaction from financial operations, complicating detection and enforcement.
Probe ongoing, more arrests likely
Delhi Police said the investigation is continuing and further arrests are likely as more digital evidence is analysed. Authorities have also begun tracing additional bank accounts and victims linked to the syndicate.
Police have advised the public to remain cautious of unsolicited investment offers received through social media or messaging platforms and to immediately report suspicious activity through official cybercrime reporting channels.
