The Government Needs to Focus on ‘Mule Accounts’ to Curb Cyber Scams

How often do you read or watch cyber fraud news? Quite frequently, right? Cyber crime has skyrocketed over the years, especially during and after the COVID-19 pandemic in 2020. Sometimes scammers allure people by giving loans on a low interest and later blackmail them to recover money at a much higher interest. Sometimes frauds extract money by impersonating police, using the trope of a 'digital arrest'. Sometimes they create fake audio of near and dear ones to convince their family that they are in police custody for committing a crime. So on and so forth.

The government and law enforcement agencies seem to be lagging miles behind cyber scammers who come up with new ideas to scam innocents every few months. The question is, why are law enforcement agencies unable to control or curb cyber crime? And is there a way to stop such crime?

A cyber scammer primarily requires two things. One, gadgets like a mobile phone with a SIM card or a laptop to connect with people remotely, and second, a mule bank account to receive money from the victim.

What is a mule bank account?

A mule account, as defined by the experts of the banking sector, is a bank account used by scammers to move stolen money. The person owning the bank account is called the ‘money mule’. The owner rents out their bank account to the scammer for a fixed commission. The person who owns the account may or may not know that their account is being used for illegal transactions. In some cases, scammers deceive poor people and allure them with money to use their bank accounts.

Money mules fall for scammers' offers for ‘easy money.' For instance, fraudsters could offer a fixed commission on every transaction that goes through a mule account. Cyber fraudsters assist money mules in opening new bank accounts with the help of their IDs in the bank of a scammer's choice. Once the account is opened, the scammer takes away all the documents and control of the bank account is in the scammer's hands.

Why do scammers use mule accounts?

A scammer generally shares a UPI code or bank details to victims to receive money.

Once the money is received in the account, scammers bounce it from one bank account to another, making it difficult for the investigating agency to track the money. By the time the victim files a police complaint with the bank details and other information, the money has bounced across several bank accounts. A senior police officer shared that it is often the private banks that take time in sharing these details with the police, thus delaying the whole process. By the time the police get hold of something concrete, the scammer has already parked the money in a safe account, making it very difficult for the police to nab them. Since the money mules are the bank account holders, it is they who are nabbed by the police to reach the real scammers. In most cases, money mules will only have scammers’ phone numbers – which will have been switched off by then.

Can scammers operate without mule accounts?

No.

Scammers cannot receive money in their own bank accounts as they can be traced by police and money they have made would be instantly seized.

Secondly, scammers do not operate in cash. So they can operate only if they receive money through online transactions. The government should come up with stringent regulations instructing all banks, including private and government, and financial institutions, to follow a strict process in opening bank accounts. This would certainly become a deterrent for the scammers in opening multiple mule accounts. No mule accounts would mean no online transactions to receive money. This would effectively mean that no one will be scamming people online.

How difficult is it to track mule accounts?

Neelesh Purohit, an independent cyber investigator, while probing into various Chinese applications allegedly involved in fraudulent activities like online betting, loan apps and so on, identified around 4,000 mule accounts in the form of UPI and bank accounts used by these applications to receive money. He and his team collected this data by using sophisticated open-source intelligence techniques and advanced search algorithms. "Our data collection methods were designed to ensure that we can provide banks and fintech companies with real-time actionable intelligence that can be used to prevent fraud, investigate suspicious accounts and take prompt action to disrupt illegal financial activities," said Purohit.

In this investigation, Purohit found these 4,000 mule accounts were opened in 32 banks and financial institutions, of which 10 were government banks. Purohit wrote to authorities and a few government banks informing them about the mule accounts and how such accounts can be tracked. He received lukewarm responses.

Purohit said all banks and private institutions should educate their staff on how to look for mule accounts in their bank branches. Generally, the inflow and outflow of money in a mule account is quick because scammers use them as a temporary stop.

In some cases, the bank employees conspire with scammers in opening mule accounts. There is a report from August 2024, on how a State Bank of India (SBI) branch manager in Hyderabad and his associates were arrested by the police in a fraud case worth Rs 175 crore. The bank manager colluded with scammers and facilitated the opening of current bank accounts, allowing funds transactions and withdrawals in exchange for commissions. In another media report, the Enforcement Directorate busted 15,000 mule accounts after arresting a Chartered Accountant and scammers involved in illicit transactions.

More often than not, police or enforcement agencies end up arresting mule account holders who are the lowest in the hierarchy.

The top bosses who run the illicit online applications, possibly operating from some other countries, are off limits for the agencies due to limited resources.

The need of the hour is that the government adopt stringent measures to regulate the 'Know Your Customer' process and hold banks accountable if mule accounts are operating through their banking platform. Until the government cracks a whip on banks and financial institutions, curbing cyber crimes in India could be a distant dream.

The Wire is now on WhatsApp. Follow our channel for sharp analysis and opinions on the latest developments.