Mule accounts: the money trail of cyber fraudsters

Account subscription benefits alongside Premium Stories, Editorials, Opinions and more. Unlock these with Subscription

Behind an online investment fraud, impersonation scam or “digital arrest” is a more basic logistical problem: how does the victim’s money reach the fraudster?

Unlike a direct transaction, scamsters run numerous “mule accounts” network, where the money passes through several accounts — sometimes spread across different banks and States — before being withdrawn or transferred further. Recent investigations by Mumbai Police illustrate the scale of such networks.

In one case, Dongri Police said they identified 110 bank accounts in an alleged interstate network supplying accounts for cyber fraud. In another, Khar Police traced 22 accounts that were linked to 42 cybercrime complaints involving around ₹7.42 crore.

Nationally, the Indian Cyber Crime Coordination Centre (I4C) had shared details of 32.08 lakh Layer-1 mule accounts with entities participating in its Suspect Registry as of June 30, 2026, according to the Union Ministry of Home Affairs (MHA).

What is a mule account? A mule account is essentially an account used as an intermediary to receive or move money connected to fraud.

If a victim is induced to transfer ₹5 lakh, for instance, the account number supplied by the fraudster may not belong to the person actually orchestrating the scam. It could belong to someone who has handed over control of the account, someone recruited to open one, or an individual whose identity or KYC credentials have been misused.

The account directly receiving money from the victim is commonly described as a Layer-1 mule account. Money can then be transferred from that account into additional accounts, creating further layers in the transaction trail.

The arrangement serves two purposes: it distances those controlling the fraud from the account initially receiving the proceeds and allows the money to be moved before the victim, bank or police can intervene.

An account appearing in such a trail, however, does not by itself establish that its holder knowingly participated in the fraud. Establishing whether the account was deliberately supplied, operated by somebody else or used without the holder’s knowledge remains part of the investigation.

Recent cases indicate that supplying bank accounts can itself operate as a separate layer of the cybercrime ecosystem.

In the Dongri case, for example, police alleged that intermediaries approached people who needed money, induced them to open bank accounts in exchange for incentives and subsequently obtained their banking documents. Three alleged agents were arrested, and police recovered 42 passbooks, 70 debit cards and 36 SIM cards, among other material.

Police said they identified 110 such accounts while investigating the network. Information initially received for 17 of those accounts linked them to 38 cybercrime complaints across several States and transactions of approximately ₹25.45 crore.

A separate Khar Police investigation similarly found what police described as a network of accounts allegedly being provided for cyber fraud.