Police suspect this Northeast Delhi branch became one such concentration point. And one of those 96 accounts belonged to a 30-year-old unemployed local resident.
A ‘chance meeting’ at GTB Hospital
In March, while visiting his uncle undergoing treatment at GTB Hospital, the 30-year-old man claimed he was approached by a man in his 40s who introduced himself as ‘Shiva’. Claiming that his mother was ill and that he urgently needed cash but could not withdraw money from his own account, Shiva requested help.
The 30-year-old allegedly allowed around Rs 30,000 to be transferred into his account. Police said he then withdrew Rs 25,000 from a nearby ATM and gave Rs 5,000 in cash from his own pocket to Shiva.
Two days later, he claimed Shiva contacted him again, saying another Rs 24,000 had been transferred to his account “by mistake”. The man initially refused to return it if such transfers continued, but later met Shiva again at GTB Hospital and handed over the money.
Weeks later, his account was frozen and the man was detained after police said he was linked to two cyber fraud complaints from outside Delhi involving Rs 30,000 and Rs 24,000.
Police said the man later admitted he had accepted Rs 2,500 as commission for allowing the transactions, although he maintained he did not know the money was linked to cyber fraud.
He was bound down and released.
The man, who lives with his wife and two-and-a-half-year-old son, studied till Class 10. He earlier sold mobile phone chargers before losing his livelihood during the Covid-19 pandemic and now survives on occasional daily-wage work.
How vulnerable people are recruited
Investigators said his experience matches a pattern.
Police said cyber financial fraud typically operates in two parts — one that cheats victims and another that manages and launders the stolen money.
A key role is played by facilitators — several of them are unemployed — recruited through platforms such as Telegram, Signal and Instagram.
Police said they provide bank accounts to cyber criminals and help launder the proceeds through hawala channels: The money is withdrawn from the banking system, handed over to hawala operators in cash, and ultimately settled through cryptocurrency transactions, particularly using USDT.
To set up ‘mule accounts’, facilitators identify unemployed youth, daily wage labourers and financially distressed individuals in their localities and persuade them to let their bank accounts be used.
Some account holders knowingly rent out their accounts for a commission of 2-3% of the money routed through them. They hand over their SIM cards, banking credentials and account access altogether in exchange for a fixed monthly payment, allowing the accounts to be operated remotely.
Others are falsely told the transactions relate to online gaming or investment activities.
In this case, police said the facilitator. ‘Shiva’, allegedly paid the 30-year-old Rs 2,500 for allowing Rs 54,000 of suspected fraud proceeds to pass through his account.
How police traced the branch
A probe was launched into the bank’s activities.
Deputy Commissioner of Police (Northeast) Rahul Alwal constituted a special team led by Inspector Rahul Kumar of the Cyber Police Station and Inspector Vijay Kumar to investigate the network under Cyber Hawk.
Using complaint data from the National Cyber Crime Reporting Portal (NCRP), transaction analysis and other digital intelligence, investigators identified 96 suspected mule accounts linked to the private bank branch.
They also found two complaints from outside Delhi linked to the 30-year-old’s account and discovered that the login credentials used to transfer money originated from Tamil Nadu. When investigators travelled there, they discovered that those bank accounts had been opened using fake Aadhaar cards.
Investigators also found several accounts opened using fake addresses and forged documents. A case has been registered under Sections 112(2) and 318(4) of the Bharatiya Nyaya Sanhita.
Why did one branch have so many mule accounts?
The concentration of suspected mule accounts in a single branch raised immediate questions for investigators.
Police said bank officials claimed the branch was authorised to open accounts online, a facility available at select branches nationwide, allowing customers to open accounts remotely without visiting the branch.
Investigators then looked at whether insiders had knowingly facilitated account openings, whether the online onboarding process had weakened customer verification, or whether fake Know Your Customer (KYC) documents had bypassed checks.
However, no evidence has yet emerged establishing the involvement of any bank official, police said, adding that the investigation is ongoing.
Delhi Police has now written to the bank, recommending changes in its online account-opening process and seeking mandatory physical verification of customers.
Police have so far been unable to identify or locate the man who introduced himself as ‘Shiva’.
“We tried to identify the person who transferred the money to the 30-year-old, but the mobile number he used had been obtained using fake documents. Our team is still working to trace the chain. He identified himself as ‘Shiva’, though that name could also be fake,” the officer said.
The only clue they have? The 30-year-old told police that Shiva’s accent sounded South Indian.
Police said cyber financial fraud typically operates in two parts — one that cheats victims and another that manages and launders the stolen money. (Image generated using AI) 
Share
