Mumbai Police Cyber Cell officers froze 143 bank and UPI mule accounts on Monday linked to a ring that promised IPO allotment “wins” through fake lottery portals, extracting ₹25,000–₹2 lakh per victim in staged stamp-duty and securities-deposit fees. Deputy Commissioner of Police Cyber Rashmi Karandikar said the freeze orders followed a month-long trace of payment flows from investors in Maharashtra, Gujarat, and Delhi who believed they had secured shares in recent main-board listings.
The script victims heard
According to investigators, targets received WhatsApp or Telegram messages congratulating them on winning a quota in high-demand issues—often name-dropping real companies that had recently closed books. Links led to cloned registrar pages with ticker scrolls and fake allotment PDFs bearing forged seals. To “unlock” shares, victims were told to pay refundable stamp duty through UPI to accounts labeled as depository participants.
Once the first payment cleared, callers posing as relationship managers demanded larger “margin deposits” citing SEBI rules. When victims hesitated, dashboards were altered to show falling allotment ranks. Police said the gang used VoIP numbers with Mumbai STD codes even though handlers operated from cyber cafes in Mira Road and Thane outskirts.
How mule accounts were layered
Freeze lists reviewed by InfoHandle show accounts opened within the past 90 days at several private-sector banks, many with immediate UPI throughput limits raised after small inbound test transfers. Money moved in hours through three-hop chains: victim UPI to student mule, to jewellery-trader shell, to crypto off-ramp wallets tracked on offshore exchanges.
Karandikar said 28 account holders were college students paid ₹3,000–₹5,000 per KYC package, a pattern Mumbai cyber units have seen in parcel and customs scams. Physical verification of several addresses found empty flats used only for document signings. Police have not ruled out collusion with rogue agents who photocopied Aadhaar packets at photocopy shops near railway stations.
What is confirmed about losses
Officials documented ₹4.7 crore across 96 complaint affidavits filed in Mumbai jurisdiction alone; other cities are forwarding cases through the Indian Cyber Crime Coordination Centre portal. SEBI cautioned again that allotments are published only on registrar and exchange sites, never through lottery draws. No legitimate issuer collects stamp duty via personal UPI handles.
Police have arrested six people for account facilitation; masterminds remain at large. Devices seized include bulk-SIM routers and laptops running cloned registrar templates. Forensic accountants are matching IP logs from fake sites to hosting payments made through stolen cards.
Investor habits that fed the fraud
Many victims had applied for IPOs through legitimate apps but misunderstood the allotment timeline. Scammers exploited that gap with messages arriving on listing day. Others searched “IPO result” and clicked sponsored links that mirrored exchange colour schemes. Cyber Cell advisers said any page asking for upfront payment to receive shares is fraudulent regardless of branding.
Banks told police that victims often ignored beneficiary-name warnings because callers stayed on the line coaching them through UPI PIN entry—a tactic that defeats app friction prompts designed to slow fraud.
What happens after a freeze
Account freezes are interim measures under the Criminal Procedure Code and payment-aggregator agreements. Victims must file FIRs and approach courts for restitution; recovery rates vary when funds already left the banking system. Mumbai Police plan joint outreach with BSE and NSE investor protection cells at suburban malls this week.
The case does not allege compromise of exchange allotment systems; it is pure social engineering with mule plumbing. For retail investors watching the primary market, the operational lesson is narrower than “avoid IPOs”: verify allotments only on registrar URLs typed manually, and treat any request for UPI payment to an individual as a exit signal—not a compliance step.
Coordination with regulators
SEBI’s investor helpline added a scripted response for IPO lottery calls this month, and depositories told brokers to flash warnings on allotment days. Payment aggregators said they are tightening onboarding for merchants whose names resemble financial institutions—a rule change that will take weeks to show in fraud statistics. Mumbai Police asked the Telecom Regulatory Authority of India to trace bulk SIM activations in the Mira Road belt; results have not been made public.
Karandikar’s unit is also sharing hashed VPA lists with other metro cyber cells so freezes in Mumbai propagate before mules drain balances in Bengaluru or Hyderabad. That cooperation matters because many victims are HNI retirees who bank nationally while living part-time in Maharashtra.
