Three Arrested for Alleged Investment Fraud Using 507+ Mule Bank Accounts

Three men have been arrested for their alleged involvement in an investment fraud racket that procured mule bank accounts and facilitated the transfer of cyber-fraud proceeds using malicious APK-based applications, police said on Monday.

The accused have been identified as Amit Mishra, a resident of East Singhbhum in Jharkhand, and Bengaluru residents Tausif Ahmed and Parashuram Sadanand Kannannavar alias Pavan Kumar.

The arrests followed a complaint filed by a Bengaluru resident on April 29, 2026. The complainant allegedly received a WhatsApp link and was added to a group called “EL Investment Strategies Discussion”. Members shared trading-related investment messages daily, after which he was asked to open a demat account and initially invested Rs 50,000.

The complainant was subsequently allegedly induced to invest Rs 93.58 lakh in installments through various bank accounts. He received neither returns nor a refund, police said. A case was registered under relevant provisions of the IT Act and Section 318(4) of the Bharatiya Nyaya Sanhita (BNS). During the investigation, the accused were arrested from a hotel in Kasavanahalli based on technical inputs. Police said they procured current, corporate and trust bank accounts, net-banking credentials and linked SIM cards from individuals by offering commissions.

The account holders were allegedly accommodated in hotels, where the ZNPAY application and malicious SMS-forwarding APKs were installed. These enabled banking OTPs and SMS messages to be forwarded to cyber-fraudsters, allowing remote operation of accounts and transfer of illicit proceeds.

Examination of six seized mobile phones revealed that the accused had allegedly procured more than 507 mule bank accounts and used over 51 APK files. Police said some linked accounts had cyber-fraud cases registered in Delhi, Maharashtra, Karnataka and other states. The accused allegedly used Binance wallets, WhatsApp, Telegram and Botim to coordinate transactions. Technical analysis indicated possible network links to Kolkata, Hong Kong and California, though verification is ongoing. Further investigation is underway to identify other intermediaries and key members of the alleged network.