A forged voter ID, a manipulated photograph and a complicit bank official were all it took to create a fully functional account at a City Union Bank branch in Ajmer, one that later sold for just ₹12,000 and went on to receive proceeds from an unrelated ₹17.71 lakh cryptocurrency fraud in Sri Ganganagar. Rajasthan Police have arrested bank assistant manager Shubham Farkya and a second accused, Subhanshu Thakaria, in a case that traces a single fraudulent account from its fabricated origin through to its use in an entirely separate cybercrime.
The investigation began with a complaint from Mukesh Kumar, a Gharsana resident and active stock market trader through Angel Broking, who received a Facebook friend request on 16 April from a woman identifying herself as Soni Sharma. She subsequently moved the conversation to WhatsApp and persuaded him to invest in cryptocurrency through a platform called TrustMyCoin.com, ultimately defrauding him of ₹17,71,480.
Algoritha Security Launches ‘Make in India’ Cyber Lab for Educational Institutions
Tracing the Money to a Bank Account That Should Never Have Existed
When cyber police began examining the financial trail behind Kumar’s complaint, they identified a savings account opened using a scanned and digitally manipulated voter ID bearing the name Vijay Chaudhary, a Tilonia resident in Ajmer who had no actual connection to the account. According to investigators, the account-opening form carried forged signatures and a photograph belonging to someone else entirely, while Thakaria’s own mobile number was linked to the account for net banking access.
This pattern of identity fabrication at the point of account creation reflects a documented, systemic vulnerability in Indian banking that regulators have grappled with for years. Reserve Bank of India data reviewed by industry analysts found that roughly 0.5 to 1 per cent of newly opened accounts nationally show mule account characteristics, a proportion that becomes alarming when scaled against the volume of accounts opened annually across India’s banking system. The Indian Cyber Crime Coordination Centre had flagged more than 2.47 million Layer-1 mule accounts by early 2026 alone.
An Insider’s Role Turns Negligence Into Complicity
What distinguishes the Jaisalmer case from simple KYC failure is the alleged direct involvement of a bank employee in the account’s creation, a distinction investigators across India have increasingly drawn between negligent oversight and active facilitation. A comparable case in Hyderabad earlier this year saw seven bank officials arrested under a dedicated operation after investigators found they had deliberately bypassed mandatory KYC norms while opening current accounts later handed directly to fraudsters, with officials in that case found to be “not merely negligent but actively complicit.”
An even starker precedent emerged from Bhopal, where a former UCO Bank manager allegedly conspired with college officials to open 118 fraudulent accounts using fabricated bona fide certificates, completely bypassing KYC checks to siphon government scholarship funds the moment they were disbursed. These cases collectively illustrate that mule account infrastructure in India frequently depends not on sophisticated technical circumvention but on individual bank employees willing to certify falsified documentation.
According to police, the fraudulently opened account was subsequently sold to Gordhan alias Rahul Chaudhary of Ajmer for ₹12,000, a transaction that transferred functional access to India’s formal banking system for a price far below the eventual damage the account would enable. On 14 June, ₹1.65 lakh connected to a separate cybercrime was credited to the account, with ₹1 lakh withdrawn through an ATM in Kishangarh and the remainder moved via UPI, a rapid cash-out pattern typical of mule accounts designed to convert digital fraud proceeds into untraceable cash before any freeze order can take effect.
Banks Are Already Responding, But Unevenly
The broader banking sector has begun reversing years of digital onboarding simplification specifically in response to this mule account crisis. Major lenders including ICICI Bank, HDFC Bank, State Bank of India, Bank of India and Bank of Baroda have paused fully digital account-opening processes, reintroducing in-person verification and branch visits following RBI penalties for weak KYC compliance during online onboarding. ICICI Bank has gone furthest, discontinuing its instant online account-opening service entirely except for salary accounts, requiring an assisted model with a branch executive completing verification in person.
Yet the Jaisalmer case demonstrates that even in-person, branch-level account opening offers no protection when the verifying official is the one falsifying documents. The RBI’s ombudsman has separately ordered banks to compensate a digital arrest fraud victim after finding beneficiary banks failed to adequately monitor mule account transactions despite documented KYC lapses, reinforcing that regulatory accountability increasingly extends to the receiving bank’s internal controls, not merely the victim’s own vigilance. Investigators in Rajasthan continue examining whether the account was used in cybercrime cases beyond Kumar’s complaint, and how many similar accounts the same network may have fraudulently created.
