Inside India’s Cyber Fraud Economy: Bank Insiders, Crypto and Mule Accounts
Introduction
The Delhi Police on October 23, 2026, stated that six persons, five of them bankers, have been arrested as part of the international cyber fraud syndicate. As per ANI, the accused were said to have laundered the proceeds of crime via cryptocurrency and kept in touch with one Chinese national who was paid in cash. Police claimed that the network has been operational since 2013 with two regional banks in Kerala, but these banks have not been named publicly, and an investigation is on.
One interesting piece of information has come up – the police reportedly said that the group kept the mobile phones that they used in the offence at least five kilometres away from their physical location in order to dodge location tracking. Interestingly, the same report also mentioned the arrest of seven persons by the Ghaziabad Crime Branch in a separate case of a fake motor insurance call centre that accumulated more than Rs 60 lakh by using fake Google Ads, but there appears to be no link to the two cases. All accused persons are presumed innocent until proven guilty in a court of law.
Why Bankers Matter
"Fraud only benefits when the gains out of the operation can be withdrawn without the fraudster catching the eye of the bank. Evidence indicates that victims are often asked to transfer money into accounts operated by the fraudster, requiring bank accounts to receive a large amount of inflows to be withdrawn without raising suspicion. These accounts are known as mule accounts," reports the I4C.
Delhi Police has met the insider problem before. In October 2025 it arrested five people, including a bank relationship manager who allegedly helped open fake current accounts and leaked internal alerts about complaints and account freezes on the National Cybercrime Reporting Portal. The seized material was tied to 52 complaints across at least 12 states. In September 2026, the Special Cell's IFSO unit arrested five people over Rs 12.84 crore taken from the corporate account of Hero FinCorp, among them a relationship manager of a private bank, with part of the money converted into the USDT stablecoin and sent abroad.
Five bankers in a single case, if the allegations hold, would suggest that the compromise was not one rogue employee but a group, and a thirteen year timeline makes a standing arrangement more plausible than an opportunistic one. That is a harder problem for banks than an individual lapse, because the people who design and enforce controls are the ones accused of bypassing them.
From Rupees to Crypto
However, the easy part is that once money is transferred to the mule account, its recovery depends largely on time taken to process the transaction. As per the Delhi Police, which has recently cracked down on a serious syndicate involved in money laundering through bank accounts and hawala channels that converted money into crypto, investigators said an account in the case had reportedly processed over 10,000 transactions worth Rs 5.24 crore over the course of five days.
Another favoured asset could be Tether (USDT), a US dollar-pegged coin used in a similar case and considered popular for its purchase in cash from local agents at a premium and being able to leave the country outside the banking system. In the June 2025 case, police have indicated that the accused maintained a direct Telegram line with a Chinese individual, which would have sent money into China through USDT. The scheme explained that USDT outflows plus cash inflows might be the basis for the Chinese contact to be under investigation.
The Scale of the Problem
Government figures to Parliament show how quickly cyber crime has spiralled. The amount of money lost to cybercrime, which is reported on the National Cyber Crime Reporting Portal and the Citizen Financial Cyber Crime Reporting and Management System, rose to Rs 22,845.73 crore in 2024 from Rs 7,465.18 crore in 2023, up 206%. The number of instances went up to 363,728 from 2,442,978.
While the steps taken have resulted in the saved money, the exact amount saved is not enough to offset the losses. As per the Ministry of Home Affairs, by June 30, 2026, a total of Rs 11,158 crore was saved through more than 32.80 lakh complaints. Since the amount saved is less than half of the losses, which is Rs 6,596,418,870, the actual amount saved from the amount lost in 2024 is different; thus, these figures are not the statistics of how much money was recovered.
Mule accounts seem to be the key. The Indian Cyber Crime Coordination Centre (I4C) has informed the government that 4.5 lakh such accounts had been frozen in one year alone. State Bank of India, Punjab National Bank, Canara Bank, Kotak Mahindra Bank and Airtel Payments Bank were named as the most common banks in which such accounts were opened. Bank managers and officials who helped set up these accounts are also under investigation, something the recent arrests would also seem to suggest.
How Authorities Are Responding
The Reserve Bank Innovation Hub has designed a machine learning-based model called Mule Hunter.AI that looks for transactional patterns. to detect suspicious accounts more accurately and with far fewer false alarms than many static rules. The government has told the Lok Sabha that the model was currently active in 26 banks and its implementation is under way. This design also aims to offer lower-tier banks some detection ability they would not otherwise have been able to design for themselves, a critical factor as regional lenders face probes in this case.
The pact between I4C and the Innovation Hub was signed in May 2026 to include data from the I4C Suspect Registry in such models. As many as 10,599 arrests had been made till July 2025 in the registry, which was launched on September 10, 2024. Union Home Minister Amit Shah has said mule accounts are one of the biggest hurdles in addressing cybercrime. Shah added that the Centre was also planning to bring all banks, even cooperative banks, on to the I4C portal by December 2026.
What Remains Unanswered
The public record is thin. Police have not revealed how much money the syndicate might have deposited, how many victims could be involved, what banks might be caught up in this, or whether the accounts were opened with real customers' documents. The nature of the link to the Chinese national is also unclear.
Furthermore, there is a more fundamental problem. Detection models learn from patterns, but an insider can open accounts that look legitimate and pass along warnings, as alleged in the October 2025 case. Technology therefore has to be paired with ordinary governance: tighter audit of account openings, access logs that show who viewed complaint alerts, separation of duties, and prompt action when an account draws repeated complaints. Experts quoted in reporting on mule networks have urged stricter KYC checks and real-time monitoring for the same reason.
Conclusion
For ordinary account holders, the message is simple. Never let an unknown person use your bank account, whatever the payment offered, because the account may become a link in a laundering chain. Anyone who loses money should report it at once through the helpline 1930 or the National Cyber Crime Reporting Portal, since quick reporting improves the chance of freezing the funds before they are moved on.
Related Blogs
Introduction:
Welcome to the third edition of our blog on digital forensics series. In our previous blog we discussed the difference between copying, cloning, and imaging in the context of Digital Forensics, and found out why imaging is a better process. Today we will discuss the process of evidence collection in Digital Forensics. The whole process starts with making sure the evidence collection team has all necessary tools required for the task.
Investigating Tools and Equipment:
Below are some mentioned tools that the team should carry with them for a successful evidence collection:
- Anti-static bags
- Faraday bags
- Toolkit having screwdrivers(nonmagnetic), scissors, pins, cutters, forceps, clips etc.
- Rubber gloves
- Incident response toolkit (Software)
- Converter/Adapter: USB, SATA, IDE, SCSI
- Imaging software
- Volatile data collection tools (FTK Imager, Magnet Forensics RAM Capture)
- Pens, permanent markers
- Storage containers
- Batteries
- Video cameras
- Note/sketch pads
- Blank storage media
- Write-Blocker device
- Labels
- Crime scene security tapes
- Camera
What sources of Data are necessary for Digital Evidence?
- Hard-Drive (Desktop, Laptop, External, Server)
- Flash Drive
- SD Cards
- Floppy Disks
- Optical Media (CD, DVD)
- CCTV/DVR
- Internal Storage of Mobile Device
- GPS (Mobile/Car)
- Call Site Track (Towers)
- RAM
Evidence Collection
The investigators encounter two primary types of evidence during the course of gathering evidence: non-electronic and electronic evidence.
The following approaches could be used to gather non-electronic evidence:
- In the course of looking into electronic crimes, recovering non-electronic evidence can be extremely important. Be cautious to make sure that this kind of evidence is retrieved and kept safe. Items that may be relevant to a later review of electronic evidence include passwords, papers or printouts, calendars, literature, hardware and software manuals, text or graphical computer printouts, and photos. These items should be secured and kept for further examination.
- They are frequently found close to the computer or other related hardware. Locating, securing, and preserving all evidence is required by departmental procedures.
Three scenarios arise for the collection of digital evidence from computers:
Situation 1: The desktop is visible, and the monitor is on.
- Take a picture of the screen and note the data that is visible.
- Utilize tools for memory capturing to gather volatile data.
- Look for virtual disks. If so, gather mounted data's logical copies.
- Give each port and connection a label.
- Take a picture of them.
- Turn off network access to stop remote access.
- Cut off the power or turn it off.
- Locate and disconnect the hard drive by opening the CPU chassis.
- Take all evidence and place it in anti-magnetic (Faraday) bags.
- Deliver the evidence to the forensic lab.
- Keep the chain of custody intact.
Situation 2: The monitor is turned on, but it either has a blank screen (sleep mode) or an image for the screensaver.
- Make a small mouse movement (without pressing buttons). The work product should appear on the screen, or it should ask for a password.
- If moving the mouse does not result in a change to the screen, stop using the mouse and stop all keystrokes.
- Take a picture of the screen and note the data that is visible.
- Use memory capturing tools to gather volatile data (always use a write blocker to prevent manipulation during data collection).
- Proceed further in accordance with Situation 1.
Situation 3: The Monitor Is Off
- Write down the "off" status.
- After turning on the monitor, check to see if its status matches that of situations 1 or 2 above, and then take the appropriate action.
- Using a phone modem, cable, confirm that you are connected to the outside world. Try to find the phone number if there is a connection to the phone.
- To protect evidence, take out the floppy disks that might be there, package each disk separately, and label the evidence. Put in a blank floppy disk or a seizure disk, if one is available. Avoid touching the CD drive or taking out CDs.
- Cover the power connector and every drive slot with tape.
- Note the serial number, make, and model.
- Take a picture of the computer's connections and make a diagram with the relevant cables.
- To enable precise reassembly at a later date, label all connectors and cable ends, including connections to peripheral devices. Put "unused" on any connection ports that are not in use. Recognize docking stations for laptop computers in an attempt to locate additional storage media.
- All evidence should be seized and placed in anti-magnetic (Faraday) bags.
- All evidence should be seized and placed in anti-magnetic (Faraday) bags.
- Put a tag or label on every bag.
- Deliver the evidence to the forensic lab.
- Keep the chain of custody intact.
Following the effective gathering of data, the following steps in the process are crucial: data packaging, data transportation, and data storage.
The following are the steps involved in data packaging, transportation, and storage:
Packaging:
- Label every computer system that is gathered so that it can be put back together exactly as it was found
When gathering evidence at a scene of crime,
- Before packing, make sure that every piece of evidence has been appropriately labeled and documented.
- Latent or trace evidence requires particular attention, and steps should be taken to preserve it.
- Use paper or antistatic plastic bags for packing magnetic media to prevent static electricity. Do not use materials like regular plastic bags (instead use faraday bags) that can cause static electricity.
- Be careful not to bend, fold, computer media like tapes, or CD-ROM.
- Make sure that the labels on every container used to store evidence are correct.
Transporting
- Make sure devices are not packed in containers and are safely fastened inside the car to avoid shock and excessive vibrations. Computers could be positioned on the floor of the car,and monitors could be mounted on the seat with the screen down .
When transporting evidence—
- Any electronic evidence should be kept away from magnetic sources. Radiation transmitters, speaker magnets, and heated seats are a few examples of items that can contaminate electronic evidence.
- Avoid leaving electronic evidence in your car for longer than necessary. Electronic devices can be harmed by extremes in temperature, humidity.
- Maintain the integrity of the chain of custody while transporting any evidence.
Storing
- Evidence should be kept safe and away from extremes in humidity and temperature. Keep it away from dust, moisture, magnetic devices, and other dangerous impurities. Be advised that extended storage may cause important evidence—like dates, times, and system configurations—to disappear. Because batteries have a finite lifespan, data loss may occur if they malfunction. Whenever the battery operated device needs immediate attention, it should be informed to the relevant authority (eg., the chief of laboratory, the forensic examiner, and the custodian of the evidence).
CONCLUSION:
Thus, securing the crime scene to packaging, transportation and storage of data are the important steps in the process of collecting digital evidence in forensic investigations. Keeping the authenticity during the process along with their provenance is critical during this phase. It is also important to ensure the admissibility of evidence in legal proceedings. This systematic approach is essential for effectively investigating and prosecuting digital crimes.
Executive Summary
A video is being shared on social media with the claim that it shows a protest against Chief Election Commissioner Gyanesh Kumar in Delhi. A large number of people can be seen protesting in the video. CyberPeace Research found that the video is not related to any recent protest against Chief Election Commissioner Gyanesh Kumar. Our Research revealed that the video is from a protest against Electronic Voting Machines (EVMs) held at Jantar Mantar in Delhi on January 31, 2024.
Claim:
The video was shared on X with a caption claiming that, “Despite heavy rain, Gen-Z, the youth of the country, have once again taken to the streets of Delhi to protest against the dictatorship of the BJP government, raising slogans of ‘Remove EVMs and Remove the Chief Election Commissioner.’ Remove EVMs, save democracy; remove BJP, save the country; remove BJP, save the Constitution.”
https://x.com/yadavanoop08/status/2103713972256166204
Fact Check
To verify the viral video being shared with the claim that it shows a protest against Chief Election Commissioner Gyanesh Kumar in Delhi, we conducted a reverse image search using keyframes from the video. We found the same video uploaded on a Facebook account on January 31, 2024. The caption accompanying the video described it as a protest against Electronic Voting Machines (EVMs).
https://www.facebook.com/watch/?v=3672972219640920
During the same search, we also found the video uploaded on another Facebook account on January 31, 2024. The post described the video as showing a protest held at Jantar Mantar in Delhi.
https://www.facebook.com/watch/?v=397803899424353
We then checked Vaman Meshram’s Facebook account and found several photographs related to the protest held at Jantar Mantar on January 31, 2024. The visuals in these photographs match the scenes seen in the viral video.
https://www.facebook.com/photo/?fbid=954806319346006&set=pcb.954806489345989
Conclusion
The evidence gathered during our Research clearly establishes that the video being shared with the claim that it shows a protest against Chief Election Commissioner Gyanesh Kumar in Delhi is actually from a protest against Electronic Voting Machines (EVMs) held in 2024.
Introduction
With the increasing frequency and severity of cyber-attacks on critical sectors, the government of India has formulated the National Cyber Security Reference Framework (NCRF) 2023, aimed to address cybersecurity concerns in India. In today’s digital age, the security of critical sectors is paramount due to the ever-evolving landscape of cyber threats. Cybersecurity measures are crucial for protecting essential sectors such as banking, energy, healthcare, telecommunications, transportation, strategic enterprises, and government enterprises. This is an essential step towards safeguarding these critical sectors and preparing for the challenges they face in the face of cyber threats. Protecting critical sectors from cyber threats is an urgent priority that requires the development of robust cybersecurity practices and the implementation of effective measures to mitigate risks.
Overview of the National Cyber Security Policy 2013
The National Cyber Security Policy of 2013 was the first attempt to address cybersecurity concerns in India. However, it had several drawbacks that limited its effectiveness in mitigating cyber risks in the contemporary digital age. The policy’s outdated guidelines, insufficient prevention and response measures, and lack of legal implications hindered its ability to protect critical sectors adequately. Moreover, the policy should have kept up with the rapidly evolving cyber threat landscape and emerging technologies, leaving organisations vulnerable to new cyber-attacks. The 2013 policy failed to address the evolving nature of cyber threats, leaving organisations needing updated guidelines to combat new and sophisticated attacks.
As a result, an updated and more comprehensive policy, the National Cyber Security Reference Framework 2023, was necessary to address emerging challenges and provide strategic guidance for protecting critical sectors against cyber threats.
Highlights of NCRF 2023
- Strategic Guidance: NCRF 2023 has been developed to provide organisations with strategic guidance to address their cybersecurity concerns in a structured manner.
- Common but Differentiated Responsibility (CBDR): The policy is based on a CBDR approach, recognising that different organisations have varying levels of cybersecurity needs and responsibilities.
- Update of National Cyber Security Policy 2013: NCRF supersedes the National Cyber Security Policy 2013, which was due for an update to align with the evolving cyber threat landscape and emerging challenges.
- Different from CERT-In Directives: NCRF is distinct from the directives issued by the Indian Computer Emergency Response Team (CERT-In) published in April 2023. It provides a comprehensive framework rather than specific directives for reporting cyber incidents.
- Combination of robust strategies: National Cyber Security Reference Framework 2023 will provide strategic guidance, a revised structure, and a proactive approach to cybersecurity, enabling organisations to tackle the growing cyberattacks in India better and safeguard critical sectors.
Rising incidents of malware attacks on critical sectors
In recent years, there has been a significant increase in malware attacks targeting critical sectors. These sectors, including banking, energy, healthcare, telecommunications, transportation, strategic enterprises, and government enterprises, play a crucial role in the functioning of economies and the well-being of societies. The escalating incidents of malware attacks on these sectors have raised concerns about the security and resilience of critical infrastructure.
- Banking: The banking sector handles sensitive financial data and is a prime target for cybercriminals due to the potential for financial fraud and theft.
- Energy: The energy sector, including power grids and oil companies, is critical for the functioning of economies, and disruptions can have severe consequences for national security and public safety.
- Healthcare: The healthcare sector holds valuable patient data, and cyber-attacks can compromise patient privacy and disrupt healthcare services. Malware attacks on healthcare organisations can result in the theft of patient records, ransomware incidents that cripple healthcare operations, and compromise medical devices.
- Telecommunications: Telecommunications infrastructure is vital for reliable communication, and attacks targeting this sector can lead to communication disruptions and compromise the privacy of transmitted data. The interconnectedness of telecommunications networks globally presents opportunities for cybercriminals to launch large-scale attacks, such as Distributed Denial-of-Service (DDoS) attacks.
- Transportation: Malware attacks on transportation systems can lead to service disruptions, compromise control systems, and pose safety risks.
- Strategic Enterprises: Strategic enterprises, including defence, aerospace, intelligence agencies, and other sectors vital to national security, face sophisticated malware attacks with potentially severe consequences. Cyber adversaries target these enterprises to gain unauthorised access to classified information, compromise critical infrastructure, or sabotage national security operations.
- Government Enterprises: Government organisations hold a vast amount of sensitive data and provide essential services to citizens, making them targets for data breaches and attacks that can disrupt critical services.
Conclusion
The sectors of banking, energy, healthcare, telecommunications, transportation, strategic enterprises, and government enterprises face unique vulnerabilities and challenges in the face of cyber-attacks. By recognising the significance of safeguarding these sectors, we can emphasise the need for proactive cybersecurity measures and collaborative efforts between public and private entities. Strengthening regulatory frameworks, sharing threat intelligence, and adopting best practices are essential to ensure our critical infrastructure’s resilience and security. Through these concerted efforts, we can create a safer digital environment for these sectors, protecting vital services and preserving the integrity of our economy and society. The rising incidents of malware attacks on critical sectors emphasise the urgent need for updated cybersecurity policy, enhanced cybersecurity measures, a collaboration between public and private entities, and the development of proactive defence strategies. National Cyber Security Reference Framework 2023 will help in addressing the evolving cyber threat landscape, protect critical sectors, fill the gaps in sector-specific best practices, promote collaboration, establish a regulatory framework, and address the challenges posed by emerging technologies. By providing strategic guidance, this framework will enhance organisations’ cybersecurity posture and ensure the protection of critical infrastructure in an increasingly digitised world.
