The mule economy: how India's account holders became the first link in the cyber-fraud chain

On 12 July 2026, officers attached to the Pune unit of the Maharashtra Cyber Crime department filed a chargesheet that puts a number on something most Indian banks have long suspected but rarely quantify. Across the city and its adjoining districts, investigators identified more than 11,300 bank accounts that had been opened nominally for one purpose and were then rented out, for fees typically ranging from half a percent to three percent of every rupee passing through them, to fraud operators based abroad. The accounts are called "mules"; the people who hold them are called "mule holders"; and the infrastructure that connects the two, recruiters, messaging-app groups, tier-one contact persons called "handlers", is now the subject of more than a thousand first-information reports logged with state police in the past quarter alone (https://ift.tt/brHue8i).

The Indian Express's Pune Crime Files series treats this economy not as a curiosity of street-level scamming but as a structural input into a global fraud market. A mule holder, often a college student, a small trader, or a domestic worker unaware of the wider chain, hands over control of an account; the account is then layered into a network that receives proceeds from so-called digital-arrest scams, trading-floor cons, cryptocurrency-investment pitches, and impersonation frauds run out of call centres in South-East Asia, the Gulf, and Eastern Europe. The mule's value is its normality: an account belonging to a real person, with a real PAN, a real address, and a real mobile-banking footprint, sits well below the radar of anti-money-laundering controls calibrated for shell companies.

What the Pune file shows

The chargesheet reconstructs one operational pattern in granular detail. A recruiter approaches a job-seeker, often through WhatsApp or Telegram, offering "data-entry" or "review-writing" work at seemingly above-market rates. Once the holder is enrolled, the recruiter walks them through opening a fresh bank account or activating mobile-banking credentials on an existing one. The account is then synced to a payment handle or UPI ID controlled by the handler, who in turn routes the credentials up a chain. When a fraud succeeds in, say, defrauding a Pune retiree of ₹28 lakh through a fake CBI notice, the money lands in thirty, forty, sometimes more than a hundred such accounts within hours, each making one or two small transfers before settling or being closed (https://ift.tt/brHue8i).

The economics reported by investigators are blunt. A mule holder typically retains one to three percent of every inflow; the recruiter takes a cut; the handler layers the remaining trail into cash withdrawals at ATMs in cities where branch staff raise fewer questions, or into cryptocurrency off-ramps that Indian agencies have not yet meaningfully surveilled. The accounts themselves are often closed within seventy-two hours of their first large deposit, which is also when most banks first flag them.

The bank-side counter

Indian lenders push back on the suggestion that they are passive. The Indian Banks' Association has, in successive submissions to the Reserve Bank of India, argued that mule detection is structurally harder than it looks: the accounts are not obviously synthetic, the inflows are not large in isolation, and the holders themselves pass standard know-your-customer checks because they are, in fact, real customers. A senior banker quoted in Indian financial press this spring described the present arrangement as "asking a cashier to spot a forged note in a stack the customer has just handed over", a fair fight for the cashier if the note is an obvious fake, an unwinnable one if it isn't. Banks have responded by tightening monitoring of so-called "dormant-turned-active" accounts, deploying mule-detection analytics from vendors including HDFC's in-house Falcon platform and a clutch of regtech start-ups, and deactivating accounts flagged by the cyber-crime portal cybercrime.gov.in. None of this has changed the top-line trajectory in the past six months.

The structural fact remains that mule accounts are useful to fraudsters precisely because they look like everyone else. A system built to onboard every adult Indian into formal banking, the Jan Dhan scheme has crossed half a billion accounts since 2014, generates, as a by-product, the very pool of legitimate-looking account holders the mule economy feeds on. No Indian regulator has yet been willing to publicly name that trade-off, which is itself a story.

How the trafficking chain

The chargesheet gives unusual visibility into the recruitment side. Handlers are typically based in cities with large migrant populations, Delhi, Surat, Mumbai, and increasingly Pune itself, where the operator can present the account opening as a routine step in onboarding a new employee. Mule holders are not, in most documented cases, complicit in the underlying fraud; many come forward after their accounts are frozen or their debit cards are declined. A subset, however, do know. The Indian Express reporting identifies a recurring figure: a college student who runs three or four accounts in parallel and treats the rental fee as a side income. For an account that clears a few lakh a month, that fee comes to several thousand rupees, a meaningful sum in the districts the file names (https://ift.tt/brHue8i).

The international half of the chain is harder to track. Indian agencies have, in recent years, secured a string of extraditions and deportations of accused operators from Cambodia, Vietnam, the Philippines, and the United Arab Emirates, but the upstream principals in the networks that consume these accounts tend to remain in jurisdictions beyond easy reach. Mule holders face the lowest risk in the chain: charges are typically bailable, and the sums involved are often below the threshold at which India's Prevention of Money Laundering Act is applied.

What the numbers don't tell

The Pune figure should be read with two qualifications. First, the 11,300 figure refers to accounts flagged within a specific Pune Cyber Crime investigation; it is not a national total, and the Maharashtra Cyber department's own submissions to the state assembly have acknowledged that the actual pool in circulation is "several multiples" larger. Second, the mule economy is not a single thing. The Indian Express reporting also identifies what investigators call "deposit-mule" accounts, used to absorb a single large transfer from one fraud victim, and "streaming-mule" accounts, which route a high volume of smaller sums across many counterparties. The two require different detection tactics, and Indian banks tend to be better at the first than the second.

The wider question, which the Pune file cannot answer on its own, is whether the mule economy is growing or merely being mapped more clearly. Two indicators point in opposite directions. The volume of cyber-fraud complaints in India rose sharply in the year to March 2026, with the cybercrime.gov.in portal logging cases faster than state police could acknowledge them. Against that, the average loss per successful fraud has reportedly fallen, which could indicate either more fraud of a smaller kind or more efficient interception.

What is clear is that the mule economy turns the much-celebrated success of Indian financial inclusion into a vulnerability it does not yet have a tool to plug. The same PAN, the same Aadhaar, the same mobile-banking app that pulled half a billion Indians into the formal economy are now being rented back, for cents in the rupee, to fraud operations that span the world. Until that is named in public as the systemic risk it now is, the Pune files will keep growing.

Desk note: The Indian Express's Pune Crime Files series, on which this piece leans, has set the editorial baseline for Indian cyber-crime reporting in 2026. Western wire desks have largely covered the human-interest end of the mule trade; the structural frame, the role of mass bank-account inclusion, and the bank-side counter-argument, is largely a domestic Indian story this publication has chosen to foreground.