The Intelligence Fusion and Strategic Operations (IFSO) unit of the Delhi Police Special Cell has uncovered a major cyber fraud targeting non-banking financial company Hero FinCorp Ltd, with investigators tracing the movement of nearly Rs 12.84 crore through dozens of bank accounts.
Police said five key suspects have been arrested following coordinated raids across multiple states. The investigation has also revealed an international network in which Indian operatives were connected with Chinese cybercrime groups through Telegram.
According to the investigation, the fraud involved 317 unauthorised digital transactions from Hero FinCorp’s corporate bank account. The total amount allegedly siphoned off was Rs 12,84,09,997.
The money was quickly distributed across 34 bank accounts, allegedly to make the transactions harder to trace and prevent the funds from being recovered. Acting on the financial trail, the IFSO team placed a hold and lien on around Rs 1.70 crore in suspected accounts.
How the money moved
Investigators found several layers between the corporate account and the alleged operators.
A key facilitator identified as Vikas, a Relationship Manager with RBL Bank in Jaipur, allegedly helped co-accused Naman Kumar open accounts with Yes Bank and IndusInd Bank. Vikas subsequently introduced Naman to another operative, identified as Harman.
Police allege that Harman managed Naman’s accounts in return for a commission of around Rs 1.5 lakh.
The investigation uncovered multiple transactions linked to the network.
Rs 60,000 was allegedly transferred to the account of Abhay Kumar Solanki and withdrawn through an ATM.
Around Rs 80 lakh was credited to an account opened by accused Lovely on the alleged instructions of absconding accused Satya.
Naman’s Yes Bank account received Rs 40 lakh.
His IndusInd Bank account received nearly Rs 70 lakh.
Police also found an APK file on Naman’s mobile phone, which investigators suspect was used in the movement of the illicit funds.
The IndusInd Bank account was also reportedly linked to 43 complaints across India on the National Cyber Crime Reporting Portal, adding another layer to the investigation.
Chinese cybercrime link through Telegram
The investigation reportedly uncovered an international component involving Chinese cybercrime groups operating through Telegram.
According to police, Harman maintained regular communication with Chinese groups on Telegram. He was allegedly in contact with Devendra Singh Chauhan, who was based in Rajasthan.
Investigators allege that Devendra converted the proceeds of the fraud into USDT cryptocurrency, facilitating the movement of funds outside India.
The use of cryptocurrency allegedly added another layer to the money trail, as the stolen funds could be converted from bank transfers into digital assets before being moved across borders.
Hotel used to operate bank account
The investigation also traced Naman’s activities to Delhi.
Police allege that Naman was brought to the national capital, where his Yes Bank account was operated from Hotel Nirvana Residency in Krishna Nagar.
The location and electronic evidence are now part of the investigation into how the bank accounts were controlled and how the stolen money was moved through the network.
Police recover phones and documents
During the raids, investigators recovered five mobile phones, a chequebook and a rubber stamp.
Police have identified additional suspects believed to be operating from different parts of India and Dubai. Searches are continuing for those who remain absconding.
The investigation is focused on establishing the complete money trail, identifying the individuals who allegedly coordinated the transactions and determining the extent of the network’s international connections.
The case also highlights the alleged use of mule bank accounts, messaging platforms, malicious APK files and cryptocurrency in organised financial cybercrime.
