Mule accounts: why renting out your bank account can end in arrest

AI-generated editorial illustration by CyberShitty. Not a photograph or a document from the organisations named.

Recruiters offer students and job seekers a commission to "use" their bank account. The Suspect Registry has flagged 32.08 lakh Layer-1 mule accounts, and police are arresting account holders. How the racket works, and what to do if you are already in it.

01 / What a mule account is, layer by layer

A mule account is a bank account that receives or moves money from a fraud on someone else's behalf. The Reserve Bank of India's draft KYC amendment of September 2026 defines it as an account used "knowingly or unknowingly" to receive, layer or transfer the proceeds of cyber-enabled fraud.

• Layer-1 is the account a victim pays into first. It is the number the Home Ministry counts in Parliament.
• Layer-2, Layer-3 and beyond are the accounts the money is split into next, to make it harder to trace. At the end of the chain it is withdrawn as cash, or converted to crypto and sent abroad.

In a Gujarat case from April 2026, police said account details were passed to contacts in Dubai over WhatsApp and Telegram. The person whose name is on the account is the one investigators can find first.

02 / How people are recruited

Police case reports from 2025 and 2026 show four common routes:

• A cut of the money. In September 2026, Delhi's East District cyber police arrested a labourer and two 22-year-old college students over a fake "Government Scholarship Scheme" fraud of ₹97,708. Police allege one student arranged the mule account in return for a 10% commission on the cheated amount, according to an IANS report.
• Commission for opening an account. In a Bengaluru case, police said suspects deceived "people in need of money" by promising commissions, then opened accounts in their names. Twelve people were arrested and 242 debit cards seized. Police estimate the fraud at ₹240 crore across 9,000 mule accounts (Deccan Herald, January 2026).
• Account and SIM kits. Gujarat's CID Crime arrested 16 people over a ₹77 crore fraud linked to 375 cases. Police said the group procured "bank account kits" and SIM cards using forged or third-party identities, and seized 82 passbooks, 115 debit cards and 126 SIM cards (Business Standard, with PTI, April 2026).
• Weak checks at the branch. In Operation Chakra-V (June 2025), the CBI said about 8.5 lakh mule accounts had been opened without proper KYC or risk assessment at more than 700 bank branches. Those arrested included middlemen, agents, account holders and bank correspondents.

03 / The scale, and what the numbers do not say

The Indian Cybercrime Coordination Centre (I4C) runs a Suspect Registry, launched with banks on 10 September 2024. Home Ministry replies to Parliament give these running totals of Layer-1 mule accounts shared with the banks and other entities in the registry:

• 24.67 lakh, with ₹8,031.56 crore of transactions declined (Lok Sabha reply, 2 December 2025).
• 26.48 lakh up to 31 December 2025, with ₹9,055.27 crore declined (Rajya Sabha reply, 11 February 2026).
• 32.08 lakh up to 30 June 2026, with ₹25,698 crore declined (Lok Sabha reply of 12 August 2026, as reported by the Free Press Journal).

Read these with care. "Shared" means flagged to other institutions. It does not mean frozen, and it does not mean the holder has been charged. The value declined nearly tripled in six months, and the replies do not explain why. The CBI's figure of 8.5 lakh comes from one investigation and is counted on a different basis. None of these replies says how many account holders have been prosecuted.

04 / What happens to the account holder

Account holders are being arrested alongside the organisers. The CBI listed account holders among those it arrested in Chakra-V. In the Delhi scholarship case, police registered the case under Sections 112(2) and 318(4) of the Bharatiya Nyaya Sanhita, according to the IANS report. We have not checked the text of those sections against the official statute, so we do not describe them here. None of the cases above has reported a conviction yet. Each is an allegation until a court rules.

Even without an arrest, the account is at risk. A flagged account can be frozen when police trace a victim's money, and the Suspect Registry passes it on to other institutions. The government replies do not say how, or whether, an account is ever taken off that list.

If money you did not expect lands in your account and it gets frozen, see our guide: Bank account frozen by cyber police? What to do. This article is not legal advice. If you are questioned or served a notice, speak to a lawyer.

05 / What banks and RBI are doing

• MuleHunter.AI. This machine-learning tool from the Reserve Bank Innovation Hub flags likely mule accounts. An RTI reply reported by MediaNama said 23 banks had implemented it as of 10 December 2025, up from 15 in August 2025. RBI refused to disclose how many mule accounts the tool had found. Later, higher bank counts appear online, but we could not match them to an official source.
• Supreme Court order. On 4 August 2026, in the suo motu case on digital arrest scams, the court told RBI to adopt an SOP within four weeks. The SOP was to cover temporary debit holds on amounts or accounts linked to money-mule activity, and a "lagged credit" mechanism that delays some incoming credits (SCC Online).
• RBI's draft rules. Draft KYC Amendment Directions, 2026 would let a bank hold a suspected mule transaction of ₹1,000 or more. The account holder would get 20 days to explain, the bank would decide within 10 days of the reply, and a hold would not normally last beyond 60 days. Comments close on 2 October 2026, and the proposed start date is 1 April 2027 (Business Standard). These are proposals, not final rules.

06 / How to protect yourself

• Never rent, sell or "lend" your bank account, UPI ID, debit card, cheque book, net-banking login or SIM card, whatever the offer.
• Never open an account, or a current account for a "company", at someone else's request.
• If a job or side gig asks you to receive money and pass it on, you are being asked to launder money for someone else.
• Do not hand your KYC documents to agents who say they will open accounts for you.

If you have already done it:

• Stop now. Do not withdraw or forward any money that arrives.
• Block the debit card, change the net-banking password and UPI PIN, and remove any phone or app you did not set up.
• Go to your branch and explain in writing. Ask for a receipt.
• Go to your local cyber police station early, before they come to you. Take the chats, numbers and payment records that show who approached you. You can also report on 1930 or at cybercrime.gov.in.
• Do not pay anyone who offers to "clear your name" or unfreeze the account for a fee.