Ahmedabad's Cyber Centre of Excellence has dismantled a cyber fraud network allegedly linked to 54 fraud cases totalling more than ₹2.86 crore across 18 states, arresting three accused on 17 July who allegedly operated fake companies, opened corporate bank accounts, and supplied mule accounts to cybercriminal networks. The three arrested — all residents of Ahmedabad — are identified as Nikunjkumar Patel, Dikshit Patel, and Sumit Soni.

How the Network Operated

According to investigators, the accused allegedly created two shell companies — Travelflux Private Limited and Travocrest Private Limited — and established offices at Oxford Avenue on Ashram Road and Yamuna-2 Estate near CTM in Ahmedabad. Neither firm conducted any legitimate business. Through these entities, the accused allegedly opened 12 corporate bank accounts across different banks and procured around 60 mule bank account kits along with SIM cards registered to those accounts, before supplying them to fraudsters operating online.

Police said the accounts were used to receive fraud proceeds, transfer funds through multiple layers, and withdraw money — with the accused earning commissions for each account facilitated. Investigators identified 72 mule bank accounts in total, of which 22 accounts were linked to 54 acknowledgements registered on the National Cyber Crime Reporting Portal (NCCRP). The remaining 50 accounts were identified before they could allegedly be activated for fraud.

Key Cases Linked to the Network

Officials noted that the fraud cases span a wide range of cybercrime methods. Among the most significant are an Internet Banking Deposit Scam involving ₹93 lakh in Bihar, an Investment Fraud of ₹70 lakh in Karnataka, and a Digital Arrest fraud of ₹38 lakh reported in Maharashtra. Police allege that Dikshit Patel played a central role in the Maharashtra case and have described him as the alleged mastermind behind the digital arrest fraud. Three acknowledgements were also registered within Gujarat.

Roles of the Accused

Police alleged that Nikunjkumar Patel, along with Dikshit Patel and an absconding accused, created the fake firms and opened the corporate bank accounts before handing them over to Dikshit Patel for financial gain. Dikshit Patel is alleged to have registered the companies in the names of Nikunjkumar Patel and another absconding accused, Govind Patel, obtained the corporate bank account kits, and supplied them to Sumit Soni, earning approximately ₹8 lakh in the process. Soni is alleged to have received the kits from Dikshit Patel and passed them on to a further absconding accused, receiving approximately ₹1 lakh in return.

New Modus Operandi: MID Accounts

Investigators uncovered what police described as a novel method involving merchant identification (MID) accounts. The accused allegedly worked with payment gateway approval agents to open 38 MID accounts in the names of the fake companies by paying large sums. These accounts were reportedly configured so that if a cyber fraud complaint was registered against a MID account, only that account would appear in the acknowledgement — shielding the linked mule accounts from detection and complicating the investigative trail.

Victims were allegedly contacted through SMS, WhatsApp, and Telegram using false identities, and lured with promises of higher earnings. The accused allegedly persuaded victims to download a file named 'dotp.apk' to harvest one-time passwords and carry out fraudulent transactions, with payments processed through 'Leo Pay'. Fraud methods reportedly included Digital Arrest, Investment Fraud, UPI-related Fraud, Deposit Fraud, Trading Fraud, Job Scam, Phishing through APK files, Online Shopping Fraud, and Internet Banking Deposit Scam.

Seizures and Investigation Status

During the operation, police seized six mobile phones, eight cheque books, 31 debit and credit cards, and one laptop. Investigations into the wider interstate and international dimensions of the network are ongoing, with at least two accused — including Govind Patel — still absconding.