ED sends letters rogatory abroad, seeks info on foreign operatives

New Delhi: To identify foreign players allegedly involved in a multi-crore "sophisticated transnational cyber fraud network" involving mule bank accounts and shell entities, the Enforcement Directorate (ED) has shot off letters rogatory (LRs) to foreign shores, including the UAE, seeking relevant information, people in the know told ET.

Read more: ED initiates FEMA investigation against Mumbai-based film producer

The case pertains to a large-scale transnational cyber fraud and money laundering syndicate operating through an organised financial and technological infrastructure spanning multiple jurisdictions. People quoted above said ED's investigation established that "Indian victims were defrauded through fraudulent investment schemes, part-time job scams, task-based fraud, gaming and betting platforms, instant-loan applications and other cyber-enabled fraud, following which the proceeds of crime were systematically laundered through mule bank accounts, shell and conduit entities, overseas fintech platforms, Dubai cash withdrawals, hawala channels and cryptocurrency transactions before being transferred to private and unhosted digital wallets controlled by foreign beneficiaries". ED's investigation resulted in the "identification of 216 mule bank accounts, reconstruction of laundering involving approximately ₹303.24 crore in identified proceeds of crime, detection of fresh banking credits of approximately ₹571.65 crore, analysis of more than 10,000 PYYPL-linked bank accounts, seizure of ₹47 lakh in cash".

Also, ED has attached bank balances aggregating ₹8,69,20,157 and arrested ten accused and filed two prosecution complaints (equivalent of a chargesheet) against 45 accused individuals/entities. The latest prosecution complaint was filed two months back by the ED. Sources said one of the most significant technological breakthroughs achieved during the investigation was the "detection of a sophisticated mechanism adopted by the foreign cyber fraud syndicate for remotely operating Indian mule bank accounts without physical possession of the registered SIM cards or mobile devices".

A senior officer, on the condition of anonymity, said ED's investigation revealed that "after procurement of mule accounts, the banking credentials were shared through Telegram and other encrypted communication platforms, while dedicated Zoho email accounts and SMS-forwarding applications were configured on the mobile phones linked with the bank accounts". This, he elaborated, enabled real-time forwarding of banking SMS alerts, OTPs and transaction authentication messages to the overseas operators, allowing them to remotely authenticate transactions, monitor incoming credits and operate the accounts from outside India. "The probe established not merely isolated instances of cyber-enabled fraud, but the existence of a sophisticated and coordinated financial infrastructure designed for the systematic receipt, layering, concealment and cross-border movement of the proceeds of crime", he added.

Read more: ED freezes Rs 440 crore in Trinamool Congress bank accounts under PMLA

The case in question is the same case which earned India's Financial Intelligence Unit (FIU-IND) international recognition in its effort to combat financial crime. ED had launched a probe, by registering an ECIR under PMLA, into the transnational cyber fraud and cryptocurrency money laundering syndicate in March 2024 based on two FIRs registered by the CBI relating to large-scale cyber-enabled fraud perpetrated against Indian citizens. The federal agency had also received actionable financial intelligence from the FIU-IND relating to the UAE-based fintech platform PYYPL. The FIU had shared multiple Operational Analysis Reports indicating that approximately ₹641 crore had been siphoned through PYYPL during September-November 2023 using Indian-issued debit cards, people quoted above added. "The investigation achieved significant breakthroughs through robust international cooperation that established the routing of approximately ₹641 crore through the UAE-based PYYPL platform and approximately ₹900.42 crore through 17 IndusInd Bank accounts, leading to conversion of approximately 36.784 million USDT through entities controlled by the syndicate," people quoted above added.