Delhi Police bust international cyber crime network using digital footprints in Flipkart, Swiggy, Zomato

According to police, Kumar came across a Facebook advertisement in April featuring the genuine logo of Upstox, a legitimate trading platform. “He clicked on a ‘Start Trading’ button and was redirected to a WhatsApp group claiming to be ‘Upstox Securities Private Limited.’ One handler, identifying himself as Kapil Jaikalyani, posed as the company’s director and assured him the firm was SEBI-registered,” said Raja Banthia, Deputy Commissioner of Police, North.

Kumar was added to a WhatsApp group called ‘UP Success Express,’ where members shared fabricated profit screenshots and deposit proofs. After initial small profits designed to build trust, he invested Rs 22.06 lakh over several transactions. When he attempted to withdraw his funds, the status remained stuck at “In Progress” before the fraudsters blocked all communication.

The police registered a case on June 9, and constituted a special team under Inspector Rohit Gahlot, SHO of Cyber Police Station North, with SI Arvind Yadav leading the investigation team.

WhatsApp data revealed the accounts were operating from Malaysia, while digital footprints from delivery platforms like Flipkart, Swiggy, and Zomato helped trace the accused despite frequent location changes.

“The investigation involved detailed technical analysis of WhatsApp logs, Google Lens data, IP addresses, and registered email IDs. The accused constantly changed locations, making the operation challenging,” DCP Banthia said.

According to the police, the scam operated in a sophisticated three-tier structure, with Malaysia-based handlers at the helm, directing accused in India to operate fake companies, laundering money through multiple mule accounts, and diverting funds to Dubai-based operators and online gaming platforms.

Between October 6 and October 14, police conducted raids across Delhi, Gurgaon, Ghaziabad, and multiple locations in Rajasthan, resulting in three waves of arrests that exposed distinct operational chains.

First chain: The fake company operators

On October 6, police arrested Atul Kumar, 31, from Gurgaon. His interrogation led to the arrest of Prashant Singh, 31, and Bhavesh Kumar Khan, 50, an MBA holder in Human Resources from Patna.

The police said the trio had established a fake company called ‘Mostly Social Technology Private Limited’ on rented premises. They opened current accounts in the company’s name and handed over net banking credentials, corporate IDs, and account-linked SIM cards to Khan in exchange for 3 per cent commission on deposits.

“They provided three current accounts and received Rs 60,000. Khan then supplied these accounts to a handler named Aman for 5 per cent of the deposited amounts. The cheated money was further transferred to online gaming accounts,” a senior officer said.

Second chain: The Jhunjhunu network

On October 9, raids in Sultana, Jhunjhunu, Rajasthan, led to the arrest of Sumit Jhajharia, 27, and Yogesh Kumar, 24.

During interrogation, Jhajharia disclosed that he sold bank accounts to Yogesh for 8 per cent commission. Yogesh, in turn, supplied these accounts to his relative Rahul, who is based in Dubai, for 10 per cent of the total credit balance.

“After retaining their commission, they transferred money using a scanner provided by Rahul. All account management operations were conducted from Jhunjhunu,” the police said.

Third chain: The Alwar-Jaipur connection

On October 14, the police apprehended Gourav, 27, from Pratap Nagar, Sanganer, Rajasthan. His questioning led to a chase from Alwar to Delhi, culminating in the arrest of Vivek Kumar Sattawan, 25.

Gourav sold accounts to Sattawan for 2 per cent commission, who then supplied them to one Saddam from Mewat for 3 per cent. The police stated that the accused promptly deleted all Telegram and WhatsApp conversations, although forensic recovery is currently underway.

International connections and money trail

The investigation revealed the cybercrime syndicate had handlers operating from Malaysia, with funds eventually reaching Dubai-based operators. Money was layered through multiple mule accounts before being diverted to online gaming platforms and cryptocurrency wallets.

“WhatsApp analysis showed the group administrators were operating from Malaysia. The money trail revealed a complex web designed to obscure the source and destination of funds,” a police officer said.

The police traced 46 similar complaints on the NCRP portal involving the same bank accounts. Several alleged accounts have been frozen, and Rs 8.58 lakh belonging to the complainant has been marked as hold/lien in various accounts. All seven accused have been sent to judicial custody. Further investigation is in progress, with efforts on to nab additional co-accused, including handlers Aman, Rahul in Dubai, and Saddam from Mewat.