Cambodia-Linked Digital Arrest Network in India Paid Mule Handlers in USDT, Used SMS-Forwarding APK to Steal OTPs
Delhi Police's IFSO unit has dismantled a digital arrest and investment fraud network tied to handlers in Cambodia and Southeast Asia, arresting 11 people and securing Rs 7.25 crore. The case shows a laundering chain that crosses borders: InDelhi Police's Intelligence Fusion and Strategic Operations (IFSO) unit has disdian mule accounts traded on Telegram, an SMS-forwarding APK relaying bank OTPs abroad, and handler commissions paid in USDT. It is linked to 78 complaints worth about Rs 73 crore.
Delhi Police's Intelligence Fusion and Strategic Operations (IFSO) unit has dismantled a cyber fraud network linked to handlers in Cambodia and other Southeast Asian countries.
It arrested 11 people and helped secure Rs 7.25 crore in a digital arrest case.
Another Rs 1.96 crore has been frozen in HDFC Bank and State Bank of India accounts.
The network is linked to 78 complaints on India's National Cyber Crime Reporting Portal across several states, involving about Rs 73 crore.
The Fraud
The case began with a complaint from a 69-year-old retired scientist and former director at the Ministry of Electronics and Information Technology.
On 14 August, callers posing as Delhi Police, Anti-Terrorism Squad and NIA officers told him his Aadhaar had been misused in a money-laundering case.
They kept him under continuous video surveillance and pressured him into sending Rs 1.25 crore by RTGS to three bank accounts.
In a linked case in Vijayawada, a 79-year-old man was defrauded of Rs 10.25 crore.
Coordination with Andhra Pradesh Police secured Rs 7.25 crore of it.
The Laundering Chain
- 1. Mule accounts traded on Telegram. Investigators identified seven Telegram channels used to trade mule bank accounts. One current account, opened in the name of M/s MR Traders at HDFC Bank, was traced to premises in Dwarka. It also received Rs 21 lakh from a separate investment fraud in West Bengal, and about Rs 5 lakh moved on before the account could be frozen.
- 2. An SMS-forwarding APK for OTPs. Seized phones carried an app called "SMS TOOLS," set up to forward incoming SMS messages, including bank one-time passwords, to other people. With an OTP relay like this, an account held by a mule in India can be operated remotely by handlers overseas, so the account holder never needs to touch a transaction.
- 3. Commission paid in USDT. The alleged main handler, Anish Khan, 31, managed the account and liaised with foreign associates. Police say he was paid a 5.5 percent commission in USDT, which he then converted to Indian rupees. He had been arrested in an earlier cybercrime case in Delhi.
Five accused were arrested at the Dwarka premises: Md. Mahfuzar Rahman, Izhar Alam, Altaf Hussain, Intekhab and Anish Khan.
Police seized six phones and a cheque book.
Why It Matters Globally
The case fits a model seen around the world.
Scam centres in Southeast Asia rent bank accounts in their victims' countries, control them remotely through OTP-relay apps, and pay local operators in stablecoins that move across borders outside the banking system.
Each link in the chain sits in a different jurisdiction: the victim, the mule account, the Telegram marketplace, the handler and the crypto off-ramp.
That makes cross-border cooperation and platform enforcement as important as domestic arrests.
The investigation into the money trail and the network's foreign links continues.