Woman Ringleader Among Six Held for Supplying Mule Bank Accounts to Cyber Fraud Gangs in Varanasi

Police in Varanasi have arrested six people, including a woman accused of leading the operation, on charges of supplying fraudulently opened bank accounts to cyber fraud syndicates operating across India, according to the Times of India. Investigators from the Sigra police station and the city’s Cyber Crime Cell allege the gang forged Aadhaar addresses to open accounts in bulk, then used a postal employee to intercept debit cards and chequebooks before they reached the addresses on record. The case matters beyond one Uttar Pradesh neighborhood because it exposes, at street level, the account laundering layer that keeps a large share of India’s cyber fraud economy moving.

What happened	Six people, including a woman accused of running the group, arrested for allegedly supplying fraudulently opened bank accounts to cyber fraud syndicates.
When	Arrests reported July 26 to 27, 2026.
Where	Sigra police station jurisdiction, Mahmoorganj, Varanasi, Uttar Pradesh, India.
Who is accused	An alleged ringleader named Kumari (reported as Arti Kumari by Amar Ujala), a second woman named Mala, Anil Kumar, Umang Kumar, Jitendra Kumar Kannaujiya, and postal worker Shobhnath.
Scale	21 linked cyber fraud complaints totaling roughly $88,000 (₹76.44 lakh), according to police.
Status	All six in custody; investigation ongoing under the Varanasi Cyber Crime Cell.

What Did Police Allege Against the Six Accused?

The Times of India named the accused as Anil Kumar, Umang Kumar, Jitendra Kumar Kannaujiya, a postal worker identified as Shobhnath, and two women, one described as the gang’s kingpin and identified as Kumari, the other named Mala. The Hindi daily Amar Ujala, which also reported on the arrests, identified the alleged ringleader by the fuller name Arti Kumari and confirmed the other five names, reporting that the group targeted economically vulnerable people, paying them small sums in exchange for their identity documents and control of their bank accounts.

DCP (Crime) Neetu Kadian told reporters the raid took place near the Om Public School tri junction in Mahmoorganj, within Sigra police station’s jurisdiction, after the Cyber Crime Cell developed intelligence on the group, the Times of India reported. Officers recovered chequebooks, passbooks and debit cards from several banks, six mobile phones, two PAN cards and three forged Aadhaar cards, the outlet said. Amar Ujala reported additional recovered material, including sealed chequebooks and debit cards that had not yet been activated, and said the operation was carried out under a state-wide cyber crime initiative called Cy-Vajra, led by Police Commissioner Mohit Agarwal.

How Did the Gang Turn Aadhaar Cards Into a Bank Account Pipeline?

Both outlets describe a scheme built around a single weak point: address verification. According to the Times of India, the group altered the permanent address on Aadhaar cards to show false residency in the Sigra area, which let them clear KYC checks and open accounts across multiple banks using that falsified documentation. Amar Ujala’s reporting adds that the gang specifically recruited poor and financially needy individuals, offering cash for the use of their identity rather than stealing it outright.

That distinction matters. A forged address does not trip the same alarms as a stolen identity, because the account holder is a real, willing person who simply never intends to use the account themselves. Once a fabricated address clears onboarding, the account exists on the bank’s books as an ordinary customer relationship, with nothing in the paperwork to flag it as part of a laundering network. It is the same exploitation of financial need and weak verification that underpins human risk management failures inside organizations, just aimed at the public rather than employees.

Why Does a Postman Matter to a Cybercrime Supply Chain?

The most distinctive allegation in the case involves Shobhnath, described in both reports as a postal employee. According to the Times of India, he allegedly intercepted the physical bank kits, chequebooks, passbooks and debit cards, before they could be delivered to the address on record, then passed them, along with SIM cards linked to the accounts, to the gang for onward courier to the cyber fraudsters actually using them.

That step is the reminder security teams tend to underweight: a fraud pipeline is not purely digital. A bank account is only useful to a scam operation once the physical card and the SIM tied to it are in the fraudster’s hands, and in this case a trusted role inside India’s postal delivery system allegedly became the point where that handoff happened. Banks routinely model onboarding risk and transaction risk. Few model the courier and delivery chain that sits between the two.

How Much Money Moved Through the Accounts?

The Times of India reported that the accounts supplied by the gang are linked to 21 cyber fraud complaints totaling roughly $88,000 (₹76.44 lakh). Amar Ujala corroborated the same complaint count and rupee figure and added that the linked complaints originate from police jurisdictions in Karnataka, Rajasthan, Punjab, Tamil Nadu, Bihar, Haryana, Assam and Manipur, a spread that illustrates how a small operation in one Uttar Pradesh neighborhood can service fraud victims across most of the country.

That geographic reach is the whole economics of the mule account trade. A scammer running a fake investment scheme, a bogus loan offer, or a boss scam wire transfer request, of the kind Indian regulators have separately warned about, does not need to open the account that receives stolen funds. They only need to buy or rent one from a supplier like the Varanasi gang, move the money out through ATM withdrawals or onward transfers, and abandon the account once a bank or the National Cyber Crime Reporting Portal flags it. The same laundering logic increasingly supports scams that begin with AI voice cloning and deepfake impersonation, where the deception happens on a phone call but the stolen money still has to land somewhere.

What Should Security and Fraud Teams Do With This?

• Treat an Aadhaar or KYC address change immediately followed by a new account opening as a scoring signal, not routine housekeeping.
• Audit the physical delivery chain for bank kits, couriers, postal staff and third party logistics, as a fraud control point, not just the digital onboarding flow.
• Correlate new SIM issuance with new account openings in the same postal or telecom circle; mule account rings and SIM fraud increasingly share the same recruiters.
• Loop in the relevant cyber crime cell early. This case shows mule networks feeding fraud complaints across eight states from a single local operation, so isolated, single branch fraud reviews will miss the pattern.

Cases like this rarely make headlines the way a breach at a multinational does, but the enforcement pattern is consistent with what regulators are pushing for. Indian authorities have been tightening expectations around KYC accountability and executive liability for cyber failures, part of a broader shift reshaping how Indian CISOs and compliance leaders are expected to answer for fraud exposure. Law enforcement takedowns of fraud infrastructure, whether it is a six person mule account ring in Varanasi or the €140 million investment fraud network dismantled in Spain this month, point to the same conclusion: the account that receives the money is as much a target for disruption as the scam that generates it.

The Varanasi case remains under investigation, and police have not said whether further arrests are expected. What is already clear from the two accounts of the raid is that the gang’s business model depended on gaps that exist well outside any single bank’s fraud dashboard: a weak address check, a compromised postal handoff, and a nationwide market of scammers willing to buy an account with no questions asked.

Frequently asked questions