Mule accounts: why renting out your bank account can end in arrest

AI-generated editorial illustration by CyberShitty. Not a photograph or a document from the organisations named.

Recruiters offer a commission, a loan or a job for the use of your bank account, and sometimes your SIM. The Suspect Registry has flagged 32.08 lakh Layer-1 mule accounts, and police are arresting account holders. How it works, and what to do if you are in it.

01 / What a mule account is, layer by layer

A mule account is a bank account that receives or moves money from a fraud on someone else's behalf. The Reserve Bank of India's draft KYC amendment of September 2026 defines it as an account used "knowingly or unknowingly" to receive, layer or transfer the proceeds of cyber-enabled fraud.

• Layer-1 is the account a victim pays into first. It is the number the Home Ministry counts in Parliament.
• Layer-2, Layer-3 and beyond are the accounts the money is split into next, to make it harder to trace. At the end of the chain it is withdrawn as cash, or converted to crypto and sent abroad.

In a Gujarat case from April 2026, police said account details were passed to contacts in Dubai over WhatsApp and Telegram. The person whose name is on the account is the one investigators can find first.

02 / How people are recruited

Police and agency case reports from 2025 and 2026 show five common routes:

• A cut of the money. In September 2026, Delhi's East District cyber police arrested a labourer and two 22-year-old college students over a fake "Government Scholarship Scheme" fraud of ₹97,708. Police allege one student arranged the mule account in return for a 10% commission on the cheated amount, according to an IANS report.
• Commission for opening an account. In a Bengaluru case, police said suspects deceived "people in need of money" by promising commissions, then opened accounts in their names. Twelve people were arrested and 242 debit cards seized. Police estimate the fraud at ₹240 crore across 9,000 mule accounts (Deccan Herald, January 2026).
• A loan or a job. In the S.P. Oswal digital-arrest case, the Enforcement Directorate (ED) says the mule accounts that received the money in small amounts were opened by "inducing economically vulnerable individuals with false promises of arranging loans or providing employment" (ED press release, 1 October 2026).
• Account and SIM kits. Gujarat's CID Crime arrested 16 people over a ₹77 crore fraud linked to 375 cases. Police said the group procured "bank account kits" and SIM cards using forged or third-party identities, and seized 82 passbooks, 115 debit cards and 126 SIM cards (Business Standard, with PTI, April 2026).
• Weak checks at the branch. In Operation Chakra-V (June 2025), the CBI said about 8.5 lakh mule accounts had been opened without proper KYC or risk assessment at more than 700 bank branches. Those arrested included middlemen, agents, account holders and bank correspondents.

03 / Handing over your SIM or phone: OTP-forwarding apps

Banks send OTPs and alerts to the mobile number linked to an account. Whoever has the login and reads those messages can move the money. Two recent cases show how gangs get those messages: by getting hold of the SIM linked to the account, or by putting a forwarding app on the account holder's own phone.

• Phones that pass OTPs to Nepal. In the S.P. Oswal case, ED says SIM cards linked to the bank accounts of a company, Rigglo Ventures, and other entities were put into phones that came pre-loaded with APK files (Android apps installed from outside the Play Store). Once the apps were switched on, associates based in Nepal could read the OTPs and other SMS on their own devices. ED says this let the fraud money move through the accounts faster (press release, 1 October 2026; also reported by The Tribune).
• Account holders kept in hotels. In September 2026 Karnataka police arrested three men in an investment-fraud case. Police said the gang got current, corporate and trust accounts, with net-banking logins and the linked SIM cards, from people it paid a commission. The account holders were kept in hotels, and 'ZNPAY' and other SMS-forwarding APKs were installed on their phones, so the gang could read banking OTPs remotely. Six phones seized from the accused linked them to more than 500 mule accounts (Deccan Herald and Hindustan Times, 21 September 2026).

These are allegations by ED and the police; no court has ruled on them. Our report on the arrest: ED arrests the man it calls the 'principal handler' in the S.P. Oswal case.

04 / The scale, and what the numbers do not say

The Indian Cybercrime Coordination Centre (I4C) runs a Suspect Registry, launched with banks on 10 September 2024. Home Ministry replies to Parliament give these running totals of Layer-1 mule accounts shared with the banks and other entities in the registry:

• 24.67 lakh, with ₹8,031.56 crore of transactions declined (Lok Sabha reply, 2 December 2025).
• 26.48 lakh up to 31 December 2025, with ₹9,055.27 crore declined (Rajya Sabha reply, 11 February 2026).
• 32.08 lakh up to 30 June 2026, with ₹25,698 crore declined (Lok Sabha reply of 12 August 2026, as reported by the Free Press Journal).

Read these with care. "Shared" means flagged to other institutions. It does not mean frozen, and it does not mean the holder has been charged. The value declined nearly tripled in six months, and the replies do not explain why. The CBI's figure of 8.5 lakh comes from one investigation and is counted on a different basis. None of these replies says how many account holders have been prosecuted.

05 / What happens to the account holder

Account holders are being arrested alongside the organisers. The CBI listed account holders among those it arrested in Chakra-V. In the Delhi scholarship case, police registered the case under Sections 112(2) and 318(4) of the Bharatiya Nyaya Sanhita, according to the IANS report. We have not checked the text of those sections against the official statute, so we do not describe them here. None of the cases above has reported a conviction yet. Each is an allegation until a court rules.

Even without an arrest, the account is at risk. A flagged account can be frozen when police trace a victim's money, and the Suspect Registry passes it on to other institutions. The government replies do not say how, or whether, an account is ever taken off that list.

If money you did not expect lands in your account and it gets frozen, see our guide: Bank account frozen by cyber police? What to do. This article is not legal advice. If you are questioned or served a notice, speak to a lawyer.

06 / What banks and RBI are doing

• MuleHunter.AI. This machine-learning tool from the Reserve Bank Innovation Hub flags likely mule accounts. An RTI reply reported by MediaNama said 23 banks had implemented it as of 10 December 2025, up from 15 in August 2025. RBI refused to disclose how many mule accounts the tool had found. Later, higher bank counts appear online, but we could not match them to an official source.
• Supreme Court order. On 4 August 2026, in the suo motu case on digital arrest scams, the court told RBI to adopt an SOP within four weeks. The SOP was to cover temporary debit holds on amounts or accounts linked to money-mule activity, and a "lagged credit" mechanism that delays some incoming credits (SCC Online).
• RBI's draft rules. Draft KYC Amendment Directions, 2026 would let a bank hold a suspected mule transaction of ₹1,000 or more. The account holder would get 20 days to explain, the bank would decide within 10 days of the reply, and a hold would not normally last beyond 60 days. Comments closed on 2 October 2026, and the proposed start date is 1 April 2027 (Business Standard). These are proposals, not final rules. Update, 30 October 2026: comments closed on 2 October and RBI has not yet issued final directions. At the Supreme Court on 29 October, the Attorney General said RBI's measures were likely to be in place by December, LiveLaw and Business Standard reported (our report).

07 / How to protect yourself

• Never rent, sell or "lend" your bank account, UPI ID, debit card, cheque book, net-banking login or SIM card, whatever the offer.
• Never put your SIM into a phone someone gives you, and never install an app, especially an APK file, that someone sends you to "forward" SMS.
• Be wary of any loan or job offer that asks you to open a new account, or to hand over your SIM, debit card or net-banking login.
• Never open an account, or a current account for a "company", at someone else's request.
• If a job or side gig asks you to receive money and pass it on, you are being asked to launder money for someone else.
• Do not hand your KYC documents to agents who say they will open accounts for you.

If you have already done it:

• Stop now. Do not withdraw or forward any money that arrives.
• Block the debit card, change the net-banking password and UPI PIN, and remove any phone or app you did not set up.
• If you handed over a SIM, ask your operator to block it and issue a replacement, and check the SIM cards in your name on Sanchar Saathi.
• Go to your branch and explain in writing. Ask for a receipt.
• Go to your local cyber police station early, before they come to you. Take the chats, numbers and payment records that show who approached you. You can also report on 1930 or at cybercrime.gov.in.
• Do not pay anyone who offers to "clear your name" or unfreeze the account for a fee.

08 / Sources and updates

Confirmed (official documents): the Lok Sabha and Rajya Sabha replies of 2 December 2025 and 11 February 2026, and ED's press release of 1 October 2026. What ED describes is its allegation and has not been tested in court. Reported (media): the registry figure up to 30 June 2026, the police cases in Delhi, Bengaluru, Gujarat and Karnataka, Chakra-V, MuleHunter.AI, the Supreme Court order and RBI's draft rules, from the outlets listed below.

Update, 2 October 2026: new section 03 covers how gangs get hold of the SIM cards linked to bank accounts, and SMS-forwarding apps that pass on bank OTPs, from ED's press release of 1 October 2026 in the S.P. Oswal case and police statements in a Karnataka case. Section 02 adds loan and job offers as a way people are drawn in. Section 07 adds tips on SIMs, SMS-forwarding apps and loan or job offers, and a step for anyone who has handed over a SIM.