Delhi Police busts APK cyber fraud syndicate, 3 held in Ahmedabad
Synopsis
Delhi Police has cracked an APK-based cyber fraud ring with an unexpected international twist — WhatsApp numbers linked to the United States, fraud proceeds converted into USDT cryptocurrency, and an alleged insider from IDBI Bank among the three arrested. The case reveals how domestic mule networks and cross-border handlers are increasingly working in tandem to launder digital fraud proceeds.
Key Takeaways
Delhi Police's Cyber South unit arrested three accused — Mohd.
Ismail Ansari , Shaikh Mohammed Nuren , and Tarique Ahmad — from Ahmedabad, Gujarat .
Victim Vikas Kumar was allegedly defrauded of ₹6,57,715 via a malicious APK link sent through SMS.
Police traced ₹4 lakh of the fraud proceeds through two transactions linked to the accused's credit cards.
11 credit cards and 3 mobile phones were recovered from the arrested individuals.
Fraud proceeds were reportedly converted into USDT cryptocurrency; WhatsApp numbers linked to the United States were found in the network.
Ismail Ansari , is reportedly a contractual employee of IDBI Bank ; investigation into US-based handlers is ongoing.
Delhi Police's Cyber Police Station, South District, has dismantled an organised syndicate operating APK-based cyber fraud, arresting three accused from Ahmedabad, Gujarat. The syndicate allegedly routed fraudulent proceeds through multiple credit cards and converted funds into cryptocurrency, with technical links traced to the United States.
How the Fraud Operated
According to police, the syndicate induced victims to download malicious APK (Android Package Kit) files sent via fraudulent SMS messages. Once installed, these applications allegedly enabled unauthorised access to victims' mobile devices and banking information. The proceeds were then routed through credit cards arranged on a commission basis and subsequently converted into USDT, a cryptocurrency-based digital asset, to obscure the money trail.
The Complaint That Cracked the Case
The investigation was triggered by a complaint filed by Vikas Kumar, who alleged he was defrauded of ₹6,57,715 after clicking on a fraudulent link received via SMS. Following the complaint, e-FIR No. 309/2026, dated 21 May 2026, was registered at PS Cyber South under Section 318(4) of the Bharatiya Nyaya Sanhita (BNS). Investigators traced ₹4 lakh of the total fraud proceeds through two transactions linked to credit cards held by the accused.
Who Was Arrested and What Was Recovered
The three arrested individuals — Mohd. Ismail Ansari, Shaikh Mohammed Nuren, and Tarique Ahmad, all residents of Ahmedabad — were each allegedly involved in supplying and arranging credit cards to route fraudulent funds. Notably, Mohd. Ismail Ansari is reportedly a contractual employee of IDBI Bank, raising concerns about insider facilitation of financial fraud. Police recovered 11 credit cards and 3 mobile phones from the accused.
The Investigation Team
The operation was carried out by a dedicated team comprising Sub-Inspector Raj Kumar Singh, Head Constable Sunil Kumar Bairwa, and Head Constable Rajkumar Bairwa, constituted under the leadership of Inspector Hansraj Swami, SHO of PS Cyber South, and under the overall supervision of ACP/Operations Balram Singh Beniwal.
International Angle Under Probe
The investigation has uncovered a potential cross-border dimension. Technical analysis revealed that certain WhatsApp numbers associated with the network were linked to the United States. The accused were reportedly coordinating with other handlers through WhatsApp and Telegram groups. Police said the exact roles and identities of the US-based handlers, as well as the complete structure of the international network, remain under investigation. This comes amid a broader national surge in APK-based scams, which have defrauded thousands of Indians in recent years by exploiting the widespread adoption of Android devices.
Point of View
Or are voluntarily participating, in credit card mule networks that feed large-scale cyber fraud operations. The crypto-conversion step, shifting proceeds into USDT before any recovery effort can freeze them, is now a standard playbook for fraud syndicates and represents a serious gap in India's cyber law enforcement toolkit. The US-linked handler angle, if substantiated, will test the limits of India's cross-border cybercrime cooperation frameworks. APK fraud has been rising sharply across India's tier-2 and tier-3 cities; until the origination networks — not just the domestic mules — are dismantled, arrests of card suppliers will remain insufficient deterrents.
NationPress
21 Sept 2026
Frequently Asked Questions
What is APK-based cyber fraud?
APK-based cyber fraud involves tricking victims into downloading malicious Android application files (APKs) sent via fraudulent SMS or messaging links. Once installed, these apps can grant attackers unauthorised access to the victim's mobile device and banking credentials, enabling financial theft.
How much money was lost in the Delhi APK fraud case?
Victim Vikas Kumar was allegedly defrauded of ₹6,57,715. Of this, police traced ₹4 lakh through two credit card transactions linked to the arrested accused.
Who are the three accused arrested by Delhi Police?
The three accused are Mohd. Ismail Ansari, Shaikh Mohammed Nuren, and Tarique Ahmad, all residents of Ahmedabad, Gujarat. Ansari is reportedly a contractual employee of IDBI Bank. All three allegedly supplied or arranged credit cards on a commission basis to route fraudulent proceeds.
What is the international angle in this cyber fraud case?
Technical analysis during the investigation revealed that WhatsApp numbers associated with the fraud network were linked to the United States. The accused were reportedly coordinating with handlers through WhatsApp and Telegram groups. Police are still investigating the identities and roles of the US-based handlers.
Why were fraud proceeds converted into USDT cryptocurrency?
According to police, the syndicate converted fraud proceeds into USDT — a stablecoin cryptocurrency — as part of the process of moving and concealing the funds. This method is increasingly used by cyber fraud networks because cryptocurrency transactions can be harder to freeze or trace through conventional banking channels.
