Kanpur Police have arrested four people in an alleged cyber-fraud network involving forged Aadhaar documents, mule bank accounts and transactions estimated at around ₹250 crore.
The accused have been identified as Vipin and Shivpratap, both from Auraiya, Rajshekhar alias Ajit from Bidhuna in Auraiya, and Himanshu Gautam from Raniya in Kanpur Dehat. Police allege that the group created or arranged bank accounts using forged documents and then used those accounts to move proceeds generated through online fraud.
Investigators say the case widened after they examined one suspicious bank account linked to multiple cybercrime complaints across India.
Proposal for Conducting Cyber Crisis Drill, Tabletop Exercise (TTEx) & CCMP Readiness Exercise
One account saw ₹8 crore in transactions within three days
DCP West S.M. Qasim Abidi said police were examining a suspected bank account on the National Cyber Crime Reporting Portal when they discovered transactions worth around ₹8 crore over just three days.
The same account was linked to 115 complaints registered from different states, according to police.
That discovery prompted investigators to examine the people behind the account and other bank accounts connected with it.
Police say the financial trail eventually pointed towards a wider network of accounts allegedly being used to receive and move money obtained through cyber fraud.
The ₹250 crore figure cited by police refers to the approximate value of transactions linked to the wider network under investigation. It should not be read as a final judicial determination that ₹250 crore was stolen from victims.
Forged Aadhaar documents allegedly used to arrange mule accounts
Police recovered forged Aadhaar cards and documents relating to suspected mule accounts from the accused.
A mule account is a bank account used to receive, hold or transfer money on behalf of another person. In cybercrime cases, such accounts are often used to separate the original victim payment from the people who ultimately control the proceeds.
Investigators allege that Rajshekhar played a central role in arranging mule accounts with forged identity documents.
The purpose of creating layers of bank accounts is to make the money trail more difficult to follow.
Funds can be split between accounts, rapidly transferred onward or withdrawn before banks and police receive a fraud complaint and place a freeze on the money.
Not every mule-account holder is necessarily part of the same level of conspiracy. Investigators still have to establish whether an account holder knowingly participated, was paid to provide access or had their identity documents misused.
Police find office allegedly used for cyber-fraud transactions
The investigation also led police to an office called Orbit Build Infrastructer at Vijay Nagar Chauraha in Kanpur.
Police allege that Himanshu Gautam had opened the office and that work connected with mule accounts and cyber-fraud-linked transactions was conducted from there.
Investigators are now examining what role the office played in the network.
That could include checking computers, banking records, account-opening documents and communications to determine whether the location was being used to coordinate financial transactions or create documentation for additional accounts.
Police have not yet publicly disclosed how many mule accounts they believe were ultimately controlled by the group.
115 NCRP complaints could reveal wider victim network
The link to 115 complaints on the National Cyber Crime Reporting Portal is significant because it suggests that one of the accounts under investigation may have received money from victims in multiple states.
NCRP allows cybercrime complaints and financial-fraud reports filed across India to be connected through common phone numbers, bank accounts, UPI IDs and other identifiers.
When the same beneficiary account appears in complaints from different places, investigators can use that data to identify a possible common network.
Police are now examining whether additional complaints can be connected to accounts associated with the four arrested men.
The suspects’ alleged roles will have to be established individually through banking records, device data and other evidence.
Kanpur has seen separate large mule-account investigations
The new case is separate from another major cyber-fraud investigation previously reported by The420.in.
In that earlier case, Kanpur Police were probing a gang allegedly led by Rajbir that moved about ₹125 crore through more than 250 bank accounts. Police had frozen 53 of those accounts.
Kanpur has also seen a separate ₹773 crore investigation involving alleged bogus firms, GST registrations and bank accounts opened in other people’s names. Police recently filed a 3,013-page chargesheet in that case.
These are distinct investigations, but all three demonstrate why bank accounts obtained through forged documents, fake firms or financially vulnerable account holders have become critical infrastructure for large cyber-fraud operations.
Probe now turns to account suppliers and money trail
Police say they are questioning the four accused to identify other people involved in arranging or operating the accounts.
Investigators will also need to determine where money moved after entering the mule accounts and whether additional individuals withdrew, transferred or converted the funds.
The forged Aadhaar material will be important because it may reveal whether identities were completely fabricated or whether genuine people’s information was altered or reused.
Police are continuing to examine the network’s financial links and have indicated that further arrests could follow.
The accusations against the four arrested men remain allegations and will have to be established through investigation and court proceedings.
What this means for you: Never allow another person to use your bank account in exchange for commission, and never hand over Aadhaar, SIM or banking credentials for opening accounts you do not control. An account used to receive cyber-fraud proceeds can become part of a nationwide police investigation even if the original victims are in other states.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
