Ahmedabad: A ping offering "passive income" or a harmless-looking app

 

    Ahmedabad: A ping offering "passive income" or a harmless-looking app download is all it takes to pull unsuspecting users into a vast financial crime network. Investigators, who are part of the recently launched ‘Operation Mule Hunt' in Gujarat, have uncovered mule-account operations that launder hundreds of crores of illegal funds through fake apps and illegal gateways across countries and continents fast and quietly. From students to corporate shell firms,

    The Gujarat CID's Cyber Crime Centre of Excellence has uncovered a mule-account network that laundered Rs 719 crore across 26 states, exploiting weak bank KYC processes, insider lapses, forged Aadhaar, PAN and GST documents, and rapid digital payment systems. The crackdown followed Surat's landmark GujCTOC case, in which a 46-member gang was found operating 1,029 mule accounts spread across 15 states.

    Investigators say these mule accounts form the backbone of an interconnected fraud economy powered by fake apps, including Ponzi schemes, betting platforms, loan scams and sham investment portals. These apps are linked to illegal payment gateways, mule bank accounts and crypto wallets operating across more than 40 countries, allowing fraud proceeds to be layered and moved before detection.

Threat analyst Mayank Sahariya at CloudSEK, an AI-powered cybersecurity company, said fraudulent Android apps circulated via Telegram and WhatsApp are among the most effective recruitment tools.

    These apps masquerade as earning platforms, wallets or investment tools. Identified applications include Xhelper, Big Winner, Jeevan Earnbox, Petross, Lakshmi, Xwallet, Honeygain and Sharkpay, among 22 flagged apps.

Once installed, the apps demand extensive permissions, particularly access to SMS messages. This enables them to intercept OTPs, capture UPI IDs, scan merchant QR codes and steal banking credentials. Users are typically promised commissions of 2-3% on transaction volumes. "In reality, the app runs silently in the background, approves transactions without the user's knowledge and converts the bank account into a laundering node," Sahariya said.Recruitment is not limited to the digital space. Local agents — often coordinated through Telegram channels — target students, unemployed youth, daily-wage workers and residents of rural areas. If the latter allows the agents to use their savings accounts, they can earn an upfront payment of Rs 10,000 to Rs 20,000. Current or corporate accounts fetch significantly higher payouts due to their larger transaction limits. "The chain runs deep," Sahariya explained. "Main agents in metro cities hire sub-agents. A savings account pays Rs 10,000. A corporate account? Rs 4 crore to Rs 5 crore. If an account has a Rs 100 crore limit, they will pay Rs 5 crore."The operation gamifies crime, ranking top earners and incentivising speed. Some mule account holders earned as much as Rs 1.2 crore in commissions for transferring stolen funds within 10 minutes. Sahariya said analysis of data from a single tracked app, similar to Xhelper, revealed 3.98 lakh individual fund movements, averaging 33,000 transactions per month and around 1,100-1,300 transactions daily over a 12-month period.Once an account holder is recruited, agents typically take control of debit cards, cheque books and SIM cards. For corporate accounts, shell companies are created using forged or stolen PAN and Aadhaar documents to make transactions appear legitimate. Powering the entire system are illegal payment gateways — custom-built platforms operating outside Reserve Bank of India regulations, many suspected to be of Chinese origin.CloudSEK has flagged gateways including Bsdpay, Dragonpay, Magicpay, Jdpay and Luckypay. These gateways issue app IDs and secret keys, allowing scammers to automatically assign and rotate mule accounts every 7-10 minutes, evading anti-money laundering checks. The platforms mimic legitimate fintech firms, offering dashboards that enable operators to manage transactions and multiple bank accounts from a single interface.CloudSEK managing editor and Future Crime Research Foundation co-founder Shashank Shekhar said banks cannot evade accountability. "If their accounts are being misused, banks must face action. Fake accounts and fake SIMs are the two pillars of this racket," he told TOI. Warning that the true scale remains hidden, Shekhar added: "Those 45,000 accounts are just the tip of the iceberg. Early monitoring could save crores, but cybercrime cases are exploding and police resources are stretched thin."