Kanpur Police are investigating an alleged cybercrime network after suspicious financial transactions estimated at around ₹5,600 crore were detected across dozens of bank accounts linked to bogus firms and nationwide fraud complaints.
Two alleged members, Shawez Waris and Salman, have been arrested, while investigators are searching for several others, including alleged key associate Akhlaq Hussain, whose location was earlier traced to Nepal. Police Commissioner Raghubir Lal said the ₹5,600 crore figure remains under verification and represents transactions, not confirmed losses suffered by victims.
Police also recovered around ₹65 lakh in cash during a raid in Jajmau.
Proposal for Conducting Cyber Crisis Drill, Tabletop Exercise (TTEx) & CCMP Readiness Exercise
Fake firms and bank accounts allegedly moved fraud proceeds
Investigators believe the network created or controlled bogus firms and bank accounts to receive money generated through cybercrime.
The alleged fraud methods included fake investment schemes, online gaming, cricket betting and other digital scams. Police also suspect that some funds were moved through hawala channels and gaming platforms to make the money trail harder to follow.
According to PTI, analysis of 76 accounts and related entities found roughly 82 to 86 complaints on the National Cyber Crime Reporting Portal.
Aaj Tak, citing police, reported 72 suspicious accounts connected with around 86 cybercrime complaints from states including Delhi, Kerala, Tamil Nadu, Madhya Pradesh, Rajasthan, Telangana, Andhra Pradesh, Jammu and Kashmir, Bihar, Gujarat, Maharashtra and West Bengal.
The difference in account totals means the investigation is still evolving.
Police are now trying to identify which transactions represented genuine business activity, which involved cybercrime proceeds and whether the same money was repeatedly moved between accounts.
₹5,600 crore does not mean ₹5,600 crore was stolen
This distinction is crucial.
When police say accounts recorded transactions worth ₹5,600 crore, that does not automatically mean victims collectively lost ₹5,600 crore.
One sum of money can move through several accounts and be counted multiple times in aggregate transaction volume.
Investigators therefore have to reconstruct individual victim complaints, first beneficiary accounts, subsequent transfers, cash withdrawals and transfers through gaming or hawala channels before estimating the actual proceeds of crime.
Police have already identified more specific transaction trails around the arrested accused.
PTI reported that 11 accounts associated with Waris recorded around ₹170 crore in transactions and were linked to 22 cybercrime complaints, while two accounts linked to Salman showed transactions of roughly ₹16 crore.
Nepal link brings alleged overseas network under scrutiny
Police are also tracing absconding suspects.
Among them is Akhlaq Hussain, whom investigators describe as an alleged key member of the network.
His location had reportedly been traced first to Lucknow and later to Nepal, leading investigators to examine possible international connections.
Other reports have named several additional suspects, including Mohammad Arif, Itisham Hussain, Shahwez Ilahi and Mohammad Muzammil.
Investigators will need to determine whether those individuals controlled accounts, supplied shell companies, recruited account holders or dealt directly with operators outside India.
Mobile phones recovered during the investigation reportedly contain WhatsApp conversations, call records and other digital material that police believe could help identify the wider chain.
Fraud network allegedly mixed several scam models
The investigation is significant because the suspected infrastructure does not appear to have been built around one type of scam.
Police say the network handled money connected with investment fraud, online gaming and betting, while investigators are also examining other cybercrime complaints associated with the accounts.
That is increasingly how large cybercrime networks operate.
One group may specialise in calling victims. Another supplies bank accounts. Another creates shell firms or payment gateways, while a separate group converts the proceeds into cash, cryptocurrency or hawala transfers.
The person whose account receives a victim’s money may never have spoken to the victim.
This financial infrastructure is what allows completely different scams to feed into the same laundering network.
Bogus companies allegedly gave bank accounts a legitimate appearance
Police have identified dozens of suspected firms connected with the investigation, some of which allegedly operated from fake or unverifiable addresses.
Creating a business can make suspicious banking activity appear less unusual.
A company account receiving frequent large transfers may initially look more credible than a personal savings account doing the same.
Fraud networks can also use GST or Udyam documents and other corporate paperwork to open accounts or convince banks and payment providers that transactions relate to genuine business.
Police reportedly recovered documents connected with company and bank-account creation during the raids.
Investigators are now examining whether account-opening procedures were manipulated and whether anyone inside financial institutions knowingly facilitated suspicious accounts.
No evidence has yet established wrongdoing by any specific bank employee.
Arrests may expose only the financial middle layer
The two arrested men may not represent the top of the alleged organisation.
Waris was arrested in Hyderabad after police said he attempted to travel to Dubai following registration of a case in August. Salman was subsequently arrested based on information obtained during the investigation.
The search for alleged associates in Nepal and elsewhere suggests police believe the network extends beyond the people currently in custody.
That makes tracing the money more important than simply counting arrests.
Each bank account can reveal who introduced its holder, which devices accessed it, where funds moved and who ultimately benefited.
What this means for you: Never allow another person to use your current account, company account, ATM card or UPI credentials in exchange for commission. If that account receives cyber-fraud proceeds, it can be frozen and its holder may become part of a criminal investigation.
The420 Insight: The ₹5,600 crore headline is striking, but the deeper story is the financial machinery underneath it. Modern cybercrime can combine fake firms, mule accounts, gaming platforms, WhatsApp coordination and overseas contacts into one payment network capable of servicing many completely different scams.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
