Mule bank accounts and SIM cards: how fraud rings use ordinary people, and what to do if yours was misused

When we picture a cyber fraud we picture a stranger with a laptop. What we do not see is the long chain of ordinary people whose bank accounts, SIM cards and OTPs make the fraud possible. They are called mules. A few know exactly what they are doing. Many are told it is a part-time job, a favour or a quick commission. When the police trace the stolen money, it is usually the mule’s name that turns up first, not the organiser’s. This page explains how people get pulled in, what the Reserve Bank and the Home Ministry say, and what to do if your account or SIM has already been used. Checked 10 November 2026.

In short

• A money mule is someone whose bank account is used to receive stolen money and pass it on. The RBI describes mules as people duped by fraudsters into laundering stolen or illegal money through their accounts (BE(A)WARE booklet, March 2022).
• A SIM card or a WhatsApp OTP can be used the same way. In the Vadodara case, police say four men supplied SIM cards, activation OTPs and a crypto route to a network behind fake share-market groups.
• Never let anyone use your account, SIM or OTP for a fee, a commission or a favour.
• If yours was used, act the same day: call 1930, report on the national cyber crime reporting portal, tell your bank in writing, check the SIMs in your name on Sanchar Saathi, and keep every message and receipt.
• This is general information, not legal advice. If the police have called you, speak to a lawyer.

How an ordinary person gets pulled in

The RBI’s BE(A)WARE booklet describes the pattern plainly. Fraudsters contact people through emails, social media and similar channels and persuade them to receive money into their bank accounts in return for attractive commissions. The mule is then told to send the money on to another mule’s account, which starts a chain that ends in the fraudster’s account. Or the mule is told to withdraw cash and hand it over to someone. When the fraud is reported, the booklet says, the mule becomes the target of the police investigation for money laundering.

In our reading, the pitch is dressed up as something ordinary: a part-time job, a payment you only have to pass on, a favour for a friend of a friend, or a small sum for a SIM card or an OTP. Students, jobseekers and anyone short of money are the natural targets. We could not find an official count of how many people are used this way, so we do not give one.

What the Vadodara case shows

On 5 November 2026 ETV Bharat Gujarati reported that Vadodara Cyber Crime Police had arrested four men whom they say supplied the SIM cards, the WhatsApp activation OTPs and a cryptocurrency route for a network running fake share-market groups. Police linked the four to 87 complaints on the National Cyber Crime Reporting Portal in several states, with a reported Rs 33.04 crore. Reports give the SIM count as 359 or as more than 400. The accused are alleged and not convicted, and we give no names. Our case study of the Vadodara network has the full account, including how one complainant lost Rs 1.57 crore.

The part that matters for you is the supply chain. One man allegedly supplied SIM cards, one got OTPs for WhatsApp activation, one passed activation OTPs to others and one received USDT and passed it on for a commission. Police said the OTPs were used from Hong Kong, Malaysia and the US, which means the SIMs were arranged here and the accounts were run from elsewhere. The police advice, as ETV Bharat reported it, was not to give your bank account, SIM card or documents to strangers, and to call 1930 if you are cheated. Earlier cases on this site show the other end of the chain: the Goa digital-arrest fraud and its laundering network and the SD Pay and Apna Pay wallet scheme.

How big is it, according to the Home Ministry

A Lok Sabha reply released by the Ministry of Home Affairs on 28 July 2026 says the Suspect Registry, launched by the Indian Cyber Crime Coordination Centre (I4C) with banks and financial institutions on 10 September 2024, had shared 32.08 lakh Layer 1 mule accounts with its participating entities up to 30 June 2026, and declined transactions worth Rs 25,698 crore. A reply of 24 March 2026 gave 27.37 lakh such accounts up to 31 January 2026. The same release says the Citizen Financial Cyber Fraud Reporting and Management System has saved more than Rs 11,158 crore in more than 32.80 lakh complaints, and that the toll-free helpline 1930 exists to get help in lodging cyber complaints. These are cumulative counts of flagged accounts, not of people convicted, and they do not say how many account holders were unaware.

The SIM side

A SIM card taken on your papers is a ready-made tool for a fraud ring. The government’s Sanchar Saathi portal has a service called Know Mobile Connections in Your Name, which lets you check the number of mobile connections taken in your name and report those that you did not take or no longer need. It is worth five minutes once or twice a year, especially if you have ever handed a photocopy of your Aadhaar or other ID to a shop for a SIM. The RBI booklet adds a warning from the other side: never share the identity details of your SIM, and if your phone has no network for a long time in a normal area, call your operator at once to make sure no duplicate SIM has been issued for your number. One more detail from the same portal: Chakshu is for reporting suspected fraud calls, SMS and WhatsApp messages, but the portal says plainly that it is not for financial fraud or cyber-crime cases where money has been lost. For that, use 1930 or the national portal.

If your account or SIM has been misused

• Step 1. Stop. Do not move any more money for anyone, and do not send money back to a stranger who asks for it. This is our advice, not an official step.
• Step 2. Call 1930 and report on the national cyber crime reporting portal. The RBI booklet lists both as the place to report after a fraud, and the PIB note describes 1930 as the helpline for lodging cyber complaints. Give the dates, amounts, UPI or bank references and the numbers you were contacted on.
• Step 3. Tell your bank in writing. Visit the branch or use the customer care number printed on the bank’s own website, and ask for an acknowledgement. The RBI booklet advises blocking cards and freezing debits in the linked account after a fraud, and checking that net banking and mobile banking are safe.
• Step 4. Check your SIMs. Use Know Mobile Connections in Your Name on Sanchar Saathi and report any number you did not take. Tell your operator if you suspect a duplicate SIM.
• Step 5. Keep proof. Save chats, call logs, screenshots, your statement and any receipt of what you were promised. Do not delete the conversation, even if it embarrasses you.
• Step 6. If the police call you, go with the facts and the papers, and take legal advice first if you took any money. We cannot tell you how a court would treat an unknowing account holder.
• If your account is frozen, ask the bank in writing which complaint or agency it relates to and keep every reply. The PIB note says the central SOP for the portal covers grievance redressal and the removal of lien markings, but we found no public step-by-step guide for account holders.

What not to do

• Do not rent, lend or sell your bank account, UPI ID, SIM card or OTP, whatever the commission. The RBI booklet says not to allow others to use your account to receive or transfer money for a fee.
• Do not accept a job that asks you to receive payments and forward them.
• Do not give your KYC papers, selfie or Aadhaar copy to a stranger or an agent you cannot trace.
• Do not ignore a bank notice or a call from the police.

Do these today

• Open Sanchar Saathi and check the connections in your name.
• Tell your family, especially students and anyone looking for work, that a commission for an account, SIM or OTP is a trap.
• Save 1930 on your phone.
• Read our guides on how to report a cyber fraud on 1930 and the national portal, WhatsApp stock-tip groups and fake trading apps and digital arrest.

What we could not confirm

We found no official count of ordinary people used as mules and no public guide written for an account holder whose account has been frozen. The national cyber crime reporting portal and the RBI Kehta Hai money-mule page did not return readable text to our tools, so the reporting steps rest on the RBI booklet and the PIB releases. We saw a search-result mention of an RBI draft procedure on suspected mule accounts dated 2026, but we did not open the document and do not describe it. We did not review how the law treats an unaware account holder. The Vadodara figures are as reported by news outlets and police and may change. We did not watch the videos in full.