Desperation, debt and digital ignorance: how ordinary citizens end up as cyber mules facilitating online fraud | Pune News | #cybercrime | #infosec

‘The human infrastructure of cybercrime’

Cyber scams in India, including investment frauds, digital arrest, etc, are primarily fuelled by citizens who, knowingly or unknowingly, become what investigators call ‘the human infrastructure of digital crime’. At the core of such highly layered, geographically distributed, and multinational cybercrime syndicates are mule accounts that receive the funds siphoned from the victims and from where it is funnelled further and converted into cryptocurrency, filling the digital wallets of international cyber criminals, investigations have revealed.

“It has emerged that mule account holders are typically recruited in two ways: either through person-to-person referrals or via social media platforms, where a growing number of groups and forums have sprung up, openly soliciting bank account holders with promises of easy money,” said a cybercrime investigator with Pimpri Chinchwad police.

Mule accounts are crucial to these syndicates as they add layers to the money trail, leaving the investigators to solve a frustrating maze. The mules, on the other hand, are always the first link that the police can trace, and they take the fall. The Indian Express spoke with at least a dozen individuals who have been identified as mule account holders by various police units in Maharashtra, some of whom were booked or arrested and are subsequently out on bail. From these interviews and discussions with investigators, the three stories detailed below serve to indicate how the handlers lure people.

‘Was promised Rs 1.5 lakh but got less than Rs 23k’

The construction labourer from Sangli specialised in centering work, which involves building steel frames for pillars, beams, or slabs – a skill that he acquired by watching his father as he grew up. At the time of his arrest earlier this year, the three bank accounts in his name had seen transactions of Rs 19 lakh over a week.

“My two sisters’ weddings left our family in debt. My drinking habit, as well as my father’s, made things worse. We mainly survived on our mother’s salary from the turmeric factory. I was addicted to online rummy like some other workers I know,” he said.

The man added that in November 2024, two men met him through a friend at a vada pav stall. “They said they were looking for bank accounts that can receive money from online rummy. They asked me for my documents to open a bank account and sought an Aadhaar-linked SIM. At the time of my arrest, I got to know they had opened three accounts in my name. They had promised me Rs 1.5 lakh but only gave a little less than Rs 23,000 in small cash instalments,” he said.

The police officer who investigated his case said they had arrested one of the two men who had approached the labourer. “He was a mule handler who had recruited half a dozen workers from the same area on this ‘gaming money’ pretext. This handler had given the bank account documents of these mules and their SIMs to another handler from Rajasthan who used to convert the money from these accounts into Tether (USDT) cryptocurrency to be sent to the international masterminds in Dubai.”

Blurring the line between mule and handler

The armed forces veteran’s son dropped out of college during the first year of graduation. His bank account had seen transactions of Rs 90 lakh received from cyber fraud activities. These transactions happened in two days for which he was given a hefty commission in February.

“I never planned to join the armed forces but wanted to start my own business. After getting to know about cryptocurrency trading, I started trading in USDT and was earning some money through it. Like other traders, I too had joined many Telegram and Facebook groups on the subject,” he said.

“In February, I was contacted by a man on Telegram, who said he was from China and offered me money for access to my bank account. He asked me to meet a man at a bar in Mumbai. This man took the access details of my account which later saw transactions of Rs 90 lakh, which came and went to some other accounts. They gave me around Rs 2 lakh equivalent USDT as commission,” he added.

The cybercrime investigator who probed this case said that as they followed the money trail in the case, they found that the Rs 90 lakh received was quickly dispersed to at least four other bank accounts. “From there, the funds were likely used to purchase USDT, which was then routed to international masterminds based in China. This mule account holder had remained in contact with a man he first met at a hotel in Mumbai and went on to recruit at least four more mule account holders, including his own cousin,” the officer said.

“This case illustrates how someone initially tapped via Telegram went on to recruit mules through personal referrals — blurring the lines between a mule and mule handler,” the investigator added.

‘Specifically targeting aspiring youths’

The ice-cream factory worker was on a desperate online hunt for a job. “While the ice cream brand I worked for is international, the salary was very low. I had done a course in computer applications and was in search of jobs. Two men from Rajasthan used to talk to us often at a small eatery in Hinjewadi where my friends and I regularly went for tea and cigarettes. After they got to know about my interest in online jobs, they asked me and two of my friends to buy a new SIM card and open a bank account linked to it, which has a high daily withdrawal limit,” he stated.

“They said we will each get Rs 15,000 per month. After we bought the SIM and opened the accounts, they took all the details and access to the account and the SIM. The next month, when we contacted them and asked for the promised amount, they told us that our accounts had been frozen and the money could not be paid to us,” said the man who was born and brought up in Pune.

The officer who investigated this case said that when the youths approached the police, complaining that they had not been paid, it came to light that their accounts had been used for cyber fraud and were flagged and frozen without their knowledge. “A probe is currently on into who the mule recruiters were. It seems that they were specifically targeting aspiring youths and luring them with money in exchange for access to bank accounts.”

‘Mule ecosystem their backbone’

An officer who has worked at the Pune Cyber police station said every mule account holder comes with a different story. “We see a pattern of misdirected aspirations, digital ignorance, and financial distress among other vulnerabilities. The mule ecosystem is not the result of online scams but is rather their backbone,” the officer said.

“The mule account holders often believe that they are committing minor acts for quick cash, without realising the legal and financial consequences that follow,” the officer added, underlining the importance of being alert to the possibilities and aware of such exploitation.

Reminding that one is ultimately responsible for activities carried out through one’s bank accounts, the investigator stated, “Interpol’s campaign ‘Your Account, Your Crime’ makes it clear that accountability is also on the mules. Thousands of mule accounts detected by central agencies in India highlight the same issues.”