Surat Police bust ₹410 crore cyber fraud ring tied to Dubai-based Chinese gang
Synopsis
A civil engineering student studying in Lithuania and a catering labourer from Uttar Pradesh were arrested in Surat for allegedly running mule bank accounts for a Dubai-based Chinese cybercrime gang — a network linked to ₹410 crore in online fraud across 20 Indian states, with USDT crypto used to move money out of the country.
Key Takeaways
Surat City Police arrested Abdul Rehman , 23, and Mohsin Khan alias Tuksu , 38, on 22 October 2026 in connection with a ₹410 crore cyber fraud case.
The fraud operated through fake share-trading apps HB Ultra and IISL Sec , with victims across 20 states and Union Territories filing 338 complaints .
Rehman allegedly ran a fictitious firm, Mansuri Digital Trading , and converted fraud proceeds into USDT cryptocurrency for transfer to a Dubai-based Chinese gang.
A search of Rehman's iPhone uncovered details of 96 bank accounts , 30 debit cards , and Telegram chats with alleged gang members.
Maharashtra topped the complaint tally with 66 , followed by Karnataka (51) and Tamil Nadu (49).
Police have warned citizens against lending their bank accounts for commissions, noting it carries criminal liability.
Surat City Police have arrested two men allegedly connected to an international cybercrime network operating out of Dubai, in a case involving online fraud estimated at ₹410 crore across 338 complaints filed in 20 states and Union Territories, police said on Saturday, 24 October 2026. The arrests mark a significant breakthrough in one of the largest multi-state cyber fraud investigations in recent memory, with a Dubai-based Chinese gang allegedly at the centre of the operation.
How the Fraud Operated
The investigation was triggered after a complainant reportedly lost ₹23.38 lakh through two fake share-trading applications — HB Ultra and IISL Sec. The accused allegedly promised high returns, persuaded victims to open trading accounts on these platforms, and induced them to transfer money into multiple bank accounts before blocking all withdrawal attempts.
A case was registered at the Cyber Crime Police Station, Surat under Sections 318(4), 336(2), 338, 336(3), 340(2), 61(2) and 3(5) of the Bharatiya Nyaya Sanhita, 2023, and Section 66(D) of the Information Technology Act, 2000 (as amended in 2008).
Who Was Arrested
The two accused have been identified as Abdul Rehman, 23, a civil engineering student currently in his second year at Kaunas University of Technology in Lithuania, and Mohsin Khan alias Tuksu, 38, a labourer in the catering sector originally from Sheikhpura village in the Khatauli police station area of Muzaffarnagar district, Uttar Pradesh.
'Both were apprehended near Civil Char Rasta in Surat on 22 October following three to four days of technical investigation,' police said. Rehman had reportedly returned to India three months ago and had travelled to Dubai on at least one occasion, according to investigators.
The Money Trail and Mule Accounts
Investigators allege that Rehman set up a fictitious firm, Mansuri Digital Trading, registered in Mohsin Khan's name, to funnel the proceeds of cyber fraud. The firm allegedly operated accounts across Central Bank of India, Bank of Maharashtra, Canara Bank, and Axis Bank — with four current accounts and 12 savings accounts reportedly opened across these institutions.
An account of Mansuri Digital Trading at the Central Bank of India alone recorded transactions totalling ₹1.19 crore between 24 August and 16 September 2026, with an initial check of the National Cyber Crime Reporting Portal linking 18 online complaints across different states to that single account, officials said.
Police further allege that Rehman converted fraud proceeds into USDT cryptocurrency and transferred the funds to the Dubai-based Chinese gang through wallets registered in third-party names, receiving commissions in return for arranging the mule accounts.
Digital Evidence Seized
A search of Rehman's iPhone reportedly yielded details of 96 bank accounts, 30 debit cards issued in different individuals' names, applications of 13 banks, and login credentials for 11 email IDs. Investigators also found Telegram chats purportedly showing communication with members of the alleged Chinese gang over the past year. Two USDT wallets on the device had recorded transactions worth ₹19.14 lakh.
During searches of the accused's residence, police seized 12 mobile phones, 17 debit cards issued by Lithuanian and Indian banks, and two cheque books. Four additional mobile phones were recovered directly from the accused.
Scale of the Network Across India
According to the National Cyber Crime Reporting Portal, the 338 complaints linked to recovered bank accounts span 20 states and Union Territories. Maharashtra recorded the highest number with 66 complaints, followed by Karnataka with 51 and Tamil Nadu with 49. Uttar Pradesh logged 22 complaints and Gujarat reported 19. Complaints also came in from Andhra Pradesh, Kerala, Delhi, Odisha, Madhya Pradesh, Punjab, Rajasthan, Uttarakhand, Meghalaya, Bihar, Jharkhand, Assam, Telangana, Haryana and West Bengal.
This comes amid a growing pattern of Chinese-linked cyber fraud networks using Indian mule accounts and cryptocurrency corridors to siphon money — a trend documented in multiple high-profile busts across the country in recent years. Surat City Police have urged residents not to allow others to use their bank accounts in exchange for commissions, warning that account holders could face criminal prosecution if their accounts are used to route proceeds of cybercrime. The investigation is ongoing.
Point of View
Exploiting regulatory gaps in current-account opening, and using USDT as an off-ramp that bypasses conventional banking surveillance. What stands out here is the accused's profile: a 23-year-old engineering student in Europe, not a hardened criminal, suggesting these networks are actively recruiting from Indian student communities abroad where financial pressure is high and oversight is low. The 338-complaint footprint across 20 states also underlines a critical gap: fragmented state-level cyber units still struggle to connect the dots across jurisdictions, which is precisely what these gangs exploit. The Central portal data helped here — but it came after the fraud, not before.
NationPress
25 Oct 2026
Frequently Asked Questions
What is the Surat cyber fraud case involving a Dubai-based Chinese gang?
Surat City Police arrested two men on 22 October 2026 for allegedly acting as mule account operators for a Chinese cybercrime gang based in Dubai, in a case linked to ₹410 crore in online fraud across 338 complaints filed in 20 Indian states and Union Territories. The fraud was carried out through fake share-trading apps named HB Ultra and IISL Sec.
Who are the two men arrested in the Surat cybercrime case?
The arrested men are Abdul Rehman, 23, a civil engineering student in his second year at Kaunas University of Technology in Lithuania, and Mohsin Khan alias Tuksu, 38, a labourer from Muzaffarnagar district in Uttar Pradesh. Both were apprehended near Civil Char Rasta in Surat following three to four days of technical investigation.
How did the accused allegedly move the money out of India?
According to police, Abdul Rehman allegedly collected fraud proceeds into mule bank accounts, converted the funds into USDT cryptocurrency, and transferred them to the Dubai-based Chinese gang through wallets registered in third-party names, earning commissions in return. Transactions across one firm account alone totalled ₹1.19 crore in under a month.
Which states reported the most complaints in this cyber fraud case?
Maharashtra recorded the highest number of complaints at 66, followed by Karnataka with 51 and Tamil Nadu with 49. Uttar Pradesh had 22 complaints and Gujarat had 19, with the remaining complaints spread across 15 other states and Union Territories.
What should citizens do to avoid being implicated in cybercrime as mule account holders?
Surat City Police have warned that allowing others to use your bank account in exchange for commissions or financial inducements can result in criminal prosecution. Citizens should refuse such requests and report suspicious approaches to the National Cyber Crime Reporting Portal or their local cyber crime police station.
