TGCSB arrests 2 in Khammam mule account crackdown, 121 accounts flagged
Synopsis
Khammam's cyber fraud pipeline runs deeper than earlier operations suggested. TGCSB's latest sweep — 40 officers, 11 teams, 121 mule accounts, ₹7.84 crore in traced transactions — points to an organised local network with direct links to foreign-based Chinese operators running illegal gaming channels on Telegram. Two more arrests bring the total to 54 accused across the two cases.
Key Takeaways
TGCSB arrested Badisa Murali Krishna and Vadlamudi Sainivas on 3 September for providing 10 mule bank accounts to cyber fraudsters.
The operation identified 121 mule accounts across 30 bank branches and 273 accounts linked to high-value ATM withdrawals in Khammam district .
Total traced transactions stood at ₹7.84 crore , with ₹6.23 crore disputed across all-India and Telangana cybercrime cases.
Accounts were also used for illegal online gaming pay-ins and pay-outs via Telegram groups linked to foreign-based Chinese operators .
25 FIRs were registered across eight police stations ; total arrests in the two linked cases now stand at 54 .
In February 2026 , 'Operation Crackdown 1.0' had already netted 25 accused and flagged 75 mule accounts in the same district.
The Telangana Cyber Security Bureau (TGCSB) arrested two individuals in Khammam district on 3 September for allegedly providing 10 mule bank accounts used to route cyber fraud proceeds, as part of a sweeping multi-day operation targeting financial crime networks across the district. The arrests bring the total accused count in the linked cases to 54.
Operation Details
Acting in coordination with the Law and Order Police of Khammam Unit, TGCSB deployed 11 teams comprising 40 police officers across multiple bank branches, ATM centres, and suspect locations on 2 and 3 September. The drive resulted in the registration of 25 FIRs across eight police stations in the district.
The two newly arrested accused — Badisa Murali Krishna and Vadlamudi Sainivas — are alleged to have furnished bank account credentials that were used to receive and move cyber fraud funds. Prior to their arrest, 52 accused had already been detained in the two foundational cases that triggered the investigation.
Scale of the Financial Network
TGCSB's analysis uncovered 121 mule accounts spread across 30 bank branches, along with 273 accounts linked to high-value ATM withdrawals and 12 accounts involved in cheque withdrawals above ₹20,000. Investigators also flagged 25 suspect locations across the Khammam Unit.
Total transactions traced through the identified accounts amounted to ₹7.84 crore, of which ₹6.23 crore is disputed — indicating the scale of funds potentially siphoned through the local network. The accounts were found to be linked to several all-India and Telangana cybercrime cases.
Chinese Operator Links and Telegram Channels
According to the bureau, the mule accounts were not only used to route cyber fraud proceeds but were also deployed for illegal online gaming pay-ins and pay-outs facilitated through Telegram groups operated in coordination with foreign-based Chinese operators. Investigators say the layered transaction pattern was designed to conceal the movement of funds across multiple accounts.
The profile of those arrested across both cases reflects a cross-section of the local population: 10 were engaged in business, nine were labourers, six were in private employment, six were unemployed, and four were former CSB Bank employees.
Background: Operation Crackdown 1.0
This is not the first time TGCSB has targeted Khammam's cyber fraud infrastructure. In February 2026, the bureau conducted 'Operation Crackdown 1.0', identifying 75 mule bank accounts across six bank branches in the same unit. That operation led to 75 FIRs and the arrest of 25 accused persons.
The latest drive signals that despite earlier enforcement, the organised network facilitating mule accounts in Khammam has persisted — and expanded. TGCSB's ongoing investigation is expected to surface further financial linkages as the bureau deepens its scrutiny of the district's banking ecosystem.
Point of View
The unemployed, even former bank employees — are being recruited as the last-mile layer of sophisticated transnational fraud networks. Two successive TGCSB operations in the same district, months apart, suggest the mule-account supply chain is resilient and locally embedded. The Telegram-and-Chinese-operator angle is particularly concerning — it places a district-level financial crime squarely within a cross-border organised crime framework that Indian law enforcement has limited jurisdiction over. The real question is whether banks' KYC and transaction-monitoring systems are flagging these accounts in real time, or whether TGCSB is doing the work that financial institutions should be doing first.
NationPress
4 Sept 2026
Frequently Asked Questions
What is a mule bank account and why is it used in cyber fraud?
A mule bank account is a legitimate bank account whose credentials are handed over — often for payment — to fraudsters, who use it to receive and layer stolen funds. In the Khammam cases, such accounts were also used for illegal online gaming transactions routed through Telegram groups linked to foreign operators.
Who were the two accused arrested by TGCSB on 3 September?
The two accused arrested on 3 September are Badisa Murali Krishna and Vadlamudi Sainivas, both from Khammam district. They are alleged to have provided 10 mule bank accounts used to facilitate cyber fraud transactions.
How large is the financial network uncovered in Khammam?
TGCSB identified 121 mule accounts across 30 bank branches, 273 accounts linked to high-value ATM withdrawals, and 25 suspect locations. Total transactions traced amounted to ₹7.84 crore, of which ₹6.23 crore is disputed across multiple cybercrime cases.
What was 'Operation Crackdown 1.0' and how does it relate to the current drive?
Operation Crackdown 1.0 was a TGCSB operation conducted in February 2026 in Khammam that identified 75 mule bank accounts across six bank branches, leading to 75 FIRs and 25 arrests. The current operation is a follow-up, indicating the fraudulent network persisted despite earlier enforcement action.
What is the connection between the Khammam mule accounts and Chinese operators?
According to TGCSB, the mule accounts were used not only to route cyber fraud proceeds but also to process pay-ins and pay-outs for illegal online gaming platforms. These platforms were operated through Telegram groups coordinated by foreign-based Chinese operators, according to the bureau's investigation.
