The Enforcement Directorate (ED) has dismantled a sophisticated transnational cyber fraud and money laundering syndicate, arresting 10 individuals and seizing assets after uncovering operations that laundered over ₹303 crore through a complex network of mule bank accounts, shell companies, overseas fintech platforms like PYYPL, and cryptocurrency exchanges. This syndicate victimized Indian citizens through various online scams, including fake investment schemes, job scams, and loan applications, before moving illicit proceeds abroad, with investigations revealing that the network continued to operate even after initial enforcement actions, with fresh banking credits of approximately ₹571.65 crore detected. The ED's probe, initiated in March 2024 based on CBI FIRs and FIU-IND intelligence, highlighted how overseas operators remotely controlled Indian mule accounts by intercepting OTPs and banking alerts via technologies like Zoho email and SMS-forwarding apps, enabling immediate fund transfers and evading detection. The laundered money was further layered through shell entities and converted into cryptocurrency before reaching foreign beneficiaries, leading to searches across 14 locations which resulted in the seizure of cash, cryptocurrencies, and the freezing of bank balances, with the ED now expanding its prosecution to 45 accused and continuing its investigation to identify further links to the syndicate.

The Enforcement Directorate (ED) has dismantled a sophisticated transnational cyber fraud and money laundering syndicate, arresting 10 individuals and seizing assets after uncovering operations that laundered over ₹303 crore through a complex network of mule bank accounts, shell companies, overseas fintech platforms like PYYPL, and cryptocurrency exchanges. This syndicate victimized Indian citizens through various online scams, including fake investment schemes, job scams, and loan applications, before moving illicit proceeds abroad, with investigations revealing that the network continued to operate even after initial enforcement actions, with fresh banking credits of approximately ₹571.65 crore detected. The ED's probe, initiated in March 2024 based on CBI FIRs and FIU-IND intelligence, highlighted how overseas operators remotely controlled Indian mule accounts by intercepting OTPs and banking alerts via technologies like Zoho email and SMS-forwarding apps, enabling immediate fund transfers and evading detection. The laundered money was further layered through shell entities and converted into cryptocurrency before reaching foreign beneficiaries, leading to searches across 14 locations which resulted in the seizure of cash, cryptocurrencies, and the freezing of bank balances, with the ED now expanding its prosecution to 45 accused and continuing its investigation to identify further links to the syndicate.

The Enforcement Directorate (ED) has dismantled a sophisticated transnational cyber fraud and money laundering syndicate, arresting 10 individuals and seizing assets after uncovering operations that laundered over ₹303 crore through a complex network of mule bank accounts, shell companies, overseas fintech platforms like PYYPL, and cryptocurrency exchanges. This syndicate victimized Indian citizens through various online scams, including fake investment schemes, job scams, and loan applications, before moving illicit proceeds abroad, with investigations revealing that the network continued to operate even after initial enforcement actions, with fresh banking credits of approximately ₹571.65 crore detected. The ED's probe, initiated in March 2024 based on CBI FIRs and FIU-IND intelligence, highlighted how overseas operators remotely controlled Indian mule accounts by intercepting OTPs and banking alerts via technologies like Zoho email and SMS-forwarding apps, enabling immediate fund transfers and evading detection. The laundered money was further layered through shell entities and converted into cryptocurrency before reaching foreign beneficiaries, leading to searches across 14 locations which resulted in the seizure of cash, cryptocurrencies, and the freezing of bank balances, with the ED now expanding its prosecution to 45 accused and continuing its investigation to identify further links to the syndicate.

The Enforcement Directorate (ED) uncovered an alleged transnational cyber fraud and money laundering syndicate that laundered over ₹303 crore through a web of mule bank accounts, shell companies, overseas fintech platforms and cryptocurrency, leading to the arrest of 10 accused and the attachment and seizure of cash and digital assets.

The agency said its investigation revealed an organised network that cheated Indian victims through fake investment schemes, part-time job scams, task-based frauds, online gaming and betting platforms, and instant-loan applications before moving the proceeds through multiple layers of financial transactions to beneficiaries abroad.

According to the ED, the investigation identified 216 mule bank accounts through which approximately ₹303.24 crore in proceeds of crime were laundered. Investigators also detected fresh banking credits of around ₹571.65 crore during the probe, indicating that the network continued to operate even after enforcement action had begun. More than 10,000 bank accounts linked to the UAE-based fintech platform PYYPL were analysed during the investigation.

The probe was initiated under the Prevention of Money Laundering Act (PMLA) in March 2024 on the basis of two CBI FIRs relating to large-scale cyber fraud. The investigation later gathered momentum after the Financial Intelligence Unit-India (FIU-IND) shared intelligence indicating that nearly ₹641 crore had been routed through PYYPL using Indian-issued debit cards. Subsequent financial intelligence pointed to another ₹900.42 crore flowing through 17 IndusInd Bank accounts linked to entities allegedly involved in fake e-commerce, betting and gambling operations.

The ED said victims were contacted through fraudulent websites, mobile applications, WhatsApp accounts and Telegram groups by individuals using fictitious identities such as Jennifer, Oscar, Tom Support and Country Manager. They were promised high returns through investment and task-based schemes, and initially received nominal payouts to gain their confidence. Once they invested larger sums, they were allegedly asked to pay additional taxes, verification charges and security deposits before communication was cut off.

Investigators said one of the biggest breakthroughs in the case was uncovering how overseas operators remotely controlled Indian mule bank accounts. Banking credentials were allegedly shared through Telegram, while Zoho email accounts and SMS-forwarding applications enabled real-time transmission of OTPs and banking alerts, allowing foreign operators to authenticate transactions without possessing the registered mobile phones.

“This technological arrangement enabled immediate transfer of funds upon receipt, significantly reducing the possibility of recovery, debit freeze or law-enforcement intervention,” the ED said.

According to the agency, the money was layered through shell entities using fabricated invoices and circular banking transactions before being diverted through overseas fintech platforms and converted into cryptocurrency using exchanges such as Binance, GetBit and Carretx. The cryptocurrency was then transferred to private digital wallets allegedly controlled by foreign beneficiaries.

Searches conducted at 14 locations across Delhi, Gurugram, Rajasthan, Gujarat, Telangana, Maharashtra and West Bengal resulted in the seizure of ₹47 lakh in cash, freezing of around 1,60,339 USDT, 118.73 SOL and 563 ETH, besides recovery of mobile phones, laptops and financial records. The ED has attached bank balances worth over ₹8.69 crore and expanded the prosecution from 18 to 45 accused persons and entities.

The agency alleged that several accused attempted to destroy evidence by deleting Telegram chats, WhatsApp communications, cryptocurrency wallet details and transaction records after the investigation commenced.

Describing the case as one involving a highly organised, professionally managed and technologically sophisticated transnational cyber-fraud and money laundering syndicate, the ED said further investigation is underway to identify additional foreign operators, cryptocurrency wallets, shell companies and assets linked to the network.