Fraudsters use layers of bank accounts to rapidly move stolen money, making detection, tracing and recovery increasingly difficult for enforcement agencies.
Key Highlights
- Mule accounts are used to receive, transfer or conceal money obtained through cyber fraud.
- Account holders may knowingly rent their accounts or be deceived, coerced or lured with commissions.
- Fraudsters quickly split stolen funds across several accounts to hide the financial trail.
- More than 2.47 million Layer-1 mule accounts had reportedly been flagged by early 2026.
- Frequent transfers, sudden transaction spikes and multiple counterparties are common warning signs.
- Banks, police and regulators are expanding transaction monitoring and coordinated enforcement.
- Victims should immediately contact their bank and report fraud through the cybercrime helpline at 1930.
News Story
New Delhi, June 25, 2026: Mule bank accounts have emerged as a critical component of India’s cybercrime ecosystem, allowing fraudsters to rapidly move stolen money through the formal banking system before victims or enforcement agencies can intervene.
These accounts act as an intermediary layer between victims and the criminals controlling the fraud. Once money is transferred by a victim, it is often divided and moved through several mule accounts within minutes, making the original trail increasingly difficult to follow.
The issue has gained renewed attention following a series of arrests and enforcement operations across the country.
On June 23, Delhi Police arrested a 40-year-old man from Amritsar for allegedly acting as a mule-account holder in a cyber fraud case involving former Member of Parliament Naresh Gujral.
Investigators reportedly traced the stolen money from four primary recipient accounts into dozens of second-layer accounts, illustrating how fraud networks use multiple banking layers to conceal the final destination of illicit funds.
Gujarat Police has also conducted extensive operations against mule-account networks allegedly used to launder proceeds from digital-arrest scams, investment fraud, UPI fraud and other online crimes.
What Is a Mule Account?
A mule account is a bank or payment account used to receive, transfer or withdraw money generated through illegal activity.
The account may belong to a person who knowingly collaborates with criminals in exchange for a commission. In other cases, the holder may have been deceived into sharing banking credentials, debit cards, cheque books, SIM cards or identity documents.
Some people are recruited through job advertisements, social-media messages or offers of easy income. Fraudsters may ask them to receive money on behalf of a supposed business and transfer it elsewhere after keeping a small percentage.
Accounts may also be opened using stolen or misused identity documents without the genuine individual fully understanding how the account will be operated.
How Mule Networks Move Stolen Money
After a successful cyber fraud, the victim’s money is usually transferred into a first-layer mule account.
From there, the amount may be divided into smaller sums and routed through several second- and third-layer accounts. It can then be withdrawn in cash, used to purchase digital assets, transferred to shell businesses or moved through other payment channels.
This process, commonly known as layering, is designed to create a complex transaction trail between the victim and the criminals ultimately controlling the funds.
The faster the money moves, the harder it becomes for banks and police to freeze it in time. Victims may take hours to realise they have been defrauded, while criminals can move the funds through multiple accounts within minutes.
Common Warning Signs
Mule accounts frequently display transaction behaviour that differs significantly from the account holder’s normal financial profile.
Common indicators include:
- A sudden increase in transaction value or frequency
- Money being transferred immediately after it is received
- Payments involving an unusually large number of unrelated parties
- Multiple transactions occurring within a short period
- Activity inconsistent with the customer’s income or occupation
- Frequent cash withdrawals following digital transfers
- Newly opened accounts receiving large amounts from different locations
Individual warning signs do not necessarily prove criminal activity, but a combination of these patterns can trigger closer scrutiny by banks and investigators.
Why Recovering Stolen Money Is Difficult
Recovery depends heavily on how quickly the victim reports the fraud.
By the time a complaint is filed, the stolen amount may already have passed through several accounts, been converted into another form or withdrawn in cash.
Investigators must then coordinate with multiple banks and payment platforms to identify each transaction, freeze the remaining balance and establish who controlled the accounts.
The account holder may also be only a small participant in a larger network, while the primary operators are based in another state or outside India.
Regulatory and Banking Response
Banks are expected to strengthen Know Your Customer checks, monitor unusual transaction behaviour and investigate accounts showing signs of misuse.
The Reserve Bank of India, law-enforcement agencies and financial institutions are also working to improve information sharing and fraud-detection systems.
Technology-based monitoring can help identify abnormal fund flows, interconnected accounts and transaction patterns that may indicate coordinated laundering activity.
However, automated systems must distinguish genuine high-frequency activity from suspicious transactions to avoid wrongly restricting legitimate customers.
What Customers Should Do
Account holders should never allow another person to use their bank account, UPI ID, SIM card, debit card or online-banking credentials.
People should be cautious of anyone offering money in exchange for receiving or transferring funds. Even when the account holder is not directly involved in the original fraud, knowingly facilitating the movement of criminal proceeds can lead to account freezes, police investigation and prosecution.
Victims of cyber fraud should immediately inform their bank and report the incident through the national cybercrime helpline 1930 or the official cybercrime reporting portal.
Rapid reporting can improve the possibility of freezing funds before they are moved through additional mule accounts.
