Fake apps, mule accounts, crypto trail: Bengaluru police uncover fraud network

The Bengaluru police have arrested Amit Mishra (left), Parashuram Sadanand Kannanavar (centre), and Tausif Ahmed (right) in connection with the alleged cyber fraud. (Express Photo)

The Bengaluru cyber police have arrested three men in connection with an alleged large-scale online trading and investment fraud that cost a city resident nearly Rs 94 lakh. In the process, they also uncovered a sprawling network involving over 500 mule bank accounts and digital trails leading to Kolkata, Hong Kong, and California.

The case began with a complaint filed by a Peenya resident on May 28 this year, who claimed he was forced to transfer Rs 93,58,555 to multiple bank accounts as part of the alleged scam.

The probe also revealed details connected to 507 bank accounts allegedly procured from various individuals and supplied to the cyber fraud network.

Investigators said approximately Rs 13 lakh in fraud proceeds moved through a government-owned bank account, while more than Rs 38 lakh passed through a specific private bank current account.

A web of associates

Although the police had almost no leads in the case, they found a mobile phone and traced it to a building in Lucknow, Uttar Pradesh. The police then found that a man, Amit Mishra, a resident of East Singhbhum district in Jharkhand, was behind the crime.

“We were tracking him for nearly two months and on September 8, he arrived in Bengaluru. We arrested him from the hotel where he was staying,” a police officer said.

During the investigation, the police came across two names — Tausif Ahmed and Parashuram Sadanand Kannanavar, alias Pavan Kumar, who were living in Bengaluru.

Story continues below this ad

“Initially, we thought they could be victims but on September 8 when the technical analysis of Amit Mishra was being done, we found they were his partners. We arrested both of them on September 9,” a police officer said.

The police also recovered six mobile phones from the three accused.

A fourth suspect, identified as Anoop alias Julpi, along with individuals operating under the Telegram handles “@zhangxueyou123 ” and “@SZNKM, ” remain untraced, and efforts are underway to identify and locate them.

The probe has also mapped out several other associates allegedly linked to the case, including individuals identified as Sumon, Nick, Dilawar, Iftikhar, Abhinav, and Vivek, said to be connected to the “ZNPAY” platform and linked to Mishra.

Story continues below this ad

Mishra in turn is allegedly connected to others identified as Nawaz, Shihab Boy, Dinesh, Sulpikar, and Ashraf, with further links reportedly extending to individuals named Jayakumar, Pavan Kumar, and Tausif Ahmed.

The police said they are investigating each individual””s specific role and extent of involvement.

Bank accounts, fake apps and a hotel

During the probe, they found that the accused operated by procuring current, corporate, and trust bank accounts along with net banking credentials and linked SIM cards from various individuals, offering them commissions in exchange.

According to the probe, they operated from a hotel in Kachuvanahalli, which served as a makeshift operations centre.

Story continues below this ad

“They used to lure people owning current accounts, especially trust bank accounts and corporate bank accounts, promising them huge donations. All they needed to do was go to the hotel, stay there a whole day, from where the money was being re-routed to multiple accounts through the current account, ” a police officer said.

These account holders were allegedly put up in hotels, where fraudulent apps — described as “ZNPAY ” and SMS-forwarding APKs — were installed on their phones.

These apps allegedly intercepted banking OTPs and SMS alerts sent to the linked SIM cards and forwarded them to the fraudsters, allowing the accused to remotely access and operate the bank accounts to funnel proceeds of the fraud. The accused, along with other “bank account suppliers” and intermediaries, allegedly received a cut of the proceeds for their role.

“The account holders were not allowed to step out of the place during these transactions. They sent money to multiple accounts and later to a Binance crypto wallet. The mule account owners were being paid Rs 1.5 to 2 lakh,” the officer added.

Story continues below this ad

Details of the fake apps along with 51 other suspicious APK files have been forwarded to the Indian Cybercrime Coordination Centre (I4C) for technical analysis of their functionality and usage.

Digital forensics on Telegram, Botim, and WhatsApp accounts used by the accused and other absconding suspects reportedly revealed IP addresses associated with Kolkata, Hong Kong, and California in the United States.

The police said verification is underway with the relevant service providers and that preliminary findings suggest the fraud network may extend beyond India””s borders and rely on foreign IP infrastructure.