Mule Accounts in 2026: Inside I4C’s AI-Powered Detection Push

The MOU was signed in May 2026 by Smt Roopa M (Inspector General, Admin, I4C) and Shri Sahil Kinni (CEO, RBIH). RBI Deputy Governor Shri Rohit Jain and senior MHA officials were present.

It is an intelligence-sharing and analytical-support arrangement. It is not a new detection system.

Under its terms, I4C will share mule-account-related intelligence and suspect identifiers from its Suspect Registry with RBIH, and RBIH will use that data to train and improve its AI/ML fraud-risk models, including MuleHunter.AI. The aim is that those models can identify suspicious banking activity and hidden mule-account networks faster.

Union Home Minister Amit Shah described the collaboration as designed to “swiftly detect and cull hidden mule accounts by feeding the data from the I4C’s Suspect Registry to the AI-driven fraud detection system.”

None of the coverage of the MOU itself names a specific rupee or account-count figure as the agreement’s own achievement. Some numbers circulate in the same news cycle: ₹9,518 crore and 27.37 lakh flagged accounts. They are sometimes read as something the MOU has already prevented. They aren’t.

Those are the I4C Suspect Registry’s own cumulative totals as of 31 January 2026. They were reported in a Lok Sabha written reply from the Ministry of Home Affairs, months before the MOU was signed. Public coverage of that reply does not name the responding minister. They are not an MOU-specific result.

The Suspect Registry’s most recent public figures come from a Lok Sabha reply given by Union Minister of State for Home Bandi Sanjay Kumar on 12 August 2026, covering activity through 30 June 2026. As of that date, the Registry had:

• Received suspect-identifier data on 30.48 lakh individuals from banks.
• Shared 32.08 lakh Layer-1 mule accounts with participating entities, helping decline transactions worth ₹25,698 crore.

The same reply reported that the government had:

• Blocked 3,718 fraudulent mobile apps (including fraudulent loan apps), 15.75 lakh SIM cards, and 5.77 lakh IMEIs.
• Processed 32.80 lakh complaints through the Citizen Financial Cyber Fraud Reporting and Management System, saving more than ₹11,158 crore.

A Money Restoration Module and a Grievance Redressal Module became operational in April 2026.

BioCatch’s “Digital Banking Fraud Trends in India 2026” report, covered in Indian media in late July 2026, found that fraudsters are increasingly routing stolen funds through India-based mule accounts instead of accounts based overseas.

The report attributes this to enforcement crackdowns led by the United Nations Office on Drugs and Crime against scam centres in Myanmar, Cambodia, and Laos. The crackdowns displaced those networks rather than dismantling them. They pushed the networks toward more distributed infrastructure built on domestic Indian cash-out systems, SIM cards, and payment networks.

BioCatch describes this as “mule-as-a-service” infrastructure. It consolidates stolen funds, converts them to cryptocurrency, and routes them to wallets associated with scam centres.

The same report’s India-specific session data adds detail: attempted fraud sessions fell 12% while the value of attempted fraudulent payments rose 35%. It also found:

• Text-message-based scams surged 146%.
• Mobile-banking fraud sessions rose 67% (iOS up 86%, Android up 35%), while web-based fraud sessions fell 10%.
• Average fraud-call duration fell 31%.
• The median fraudulent transfer value rose 1.7 times per session.

Gujarat Police’s Cyber Centre of Excellence (CID Crime) closed out “Operation Mule Hunt 2.0” in early July 2026 having arrested 55 people over the preceding month. It was a statewide initiative aimed at the financial infrastructure behind cybercrime rather than individual fraudsters alone.

The arrested individuals’ bank accounts were linked to 1,117 cybercrime complaints registered nationwide, involving an estimated ₹802 crore in fraud. The complaints spanned 22 states and Union Territories. Maharashtra recorded the highest number of linked complaints (56), followed by Karnataka (28) and Gujarat (23).

Case: three accounts, 253 complaints

One case from that operation shows how concentrated the damage from a small number of accounts can be. Police allege that Vishal Sureshbhai Dodiya, an Ahmedabad resident, registered a bogus firm named “Chamunda Communication” and opened three bank accounts in its name. Those three accounts alone were linked to more than 253 cybercrime cases nationally, involving an estimated ₹161 crore in fraudulent transactions.

Three other individuals were arrested in the same operation:

• Mohammad Khaliq Ghulam Husain of Surat is accused of operating accounts that received stolen funds from a bank-hacking case.
• Shoaib Gulabnabi Rana, also of Surat, is accused of facilitating transfers of the illegally accessed funds.
• Afzal Pir Mohammad Mansuri of Ahmedabad is accused of managing mule accounts and withdrawal operations. Police say his accounts were linked to 60 accounts across 132 complaints.

A related case in the same operation, the hacking of Bhavnagar District Cooperative Bank, involved ₹7.34 crore siphoned off.

A smaller case at individual scale

A separate, smaller case published in July 2026 illustrates the same problem at individual scale.

In Siddharthnagar district, Uttar Pradesh, police arrested a 20-year-old undergraduate, Nasim Ahmad. Six bank accounts opened in his name were found linked to 17 cyber-fraud complaints across multiple states. The accounts were at Union Bank, an Urban Cooperative Bank, Punjab National Bank, Axis Bank, State Bank of India, and India Post Payments Bank.

The cumulative reported fraud value across all connected complaints was ₹22.55 crore. Police clarified that only about ₹14 lakh was directly traced as having passed through Ahmad’s own accounts.

Investigators said Ahmad allegedly first received money through online gaming platforms before routing it onward. Cybercrime expert Prof. Triveni Singh, quoted in the coverage, warned that sharing banking credentials in exchange for money “can itself attract criminal liability regardless of whether the account holder personally profited.”

On 4 August 2026, as reported by most outlets covering the order, a Supreme Court bench led by Chief Justice of India Surya Kant, with Justices Joymalya Bagchi and V. Mohana, acted in a suo motu proceeding (Suo Motu Writ Petition (Criminal) No. 3 of 2025, originally triggered by a senior-citizen couple’s complaint about a “digital arrest” scam). It directed RBI to formally adopt and circulate an SOP within four weeks.

The SOP must prescribe what banks must do to place temporary debit holds on amounts or accounts linked to mule activity and cyber-enabled fraud. Copies must be furnished to the Registrar General of every High Court.

The same order directed several other steps:

• States, Union Territories, and law-enforcement agencies must operationalise existing cyber-fraud grievance-redressal and Money Restoration Module mechanisms and raise public awareness of them.
• State Cyber Crime Coordination Centres must adopt the “e-Zero FIR” mechanism with I4C within the same four-week window.
• An Inter-Departmental Committee will examine a shared-liability and victim-compensation framework.
• Courts are to expedite account-freezing matters arising from cyber-fraud cases.

The Court noted that:

• “Digital arrest” complaints on the National Cybercrime Reporting Portal fell from 1,23,672 in 2024 to 58,249 in 2025 and further to 16,377 through 30 June 2026.
• The grievance-redressal mechanism already covers 1,23,590 branches of 69 banks.
• The Money Restoration Mechanism Portal has 57 participating banks across every state and Union Territory.

The matter returns for a further hearing on 16 September 2026.

RBI did not issue a final SOP by the four-week mark. On 11 September 2026 it instead released a draft for public consultation (press release 2026-2027/1109), as part of the proposed Reserve Bank of India (Know Your Customer) Amendment Directions, 2026. Comments were invited until 2 October 2026.

RBI says the draft applies to commercial banks (including small finance banks, payments banks, regional rural banks and local area banks) and urban co-operative banks. Final directions will be issued separately for each type of regulated entity.

One published summary of the draft reports:

• An immediate temporary debit hold on a suspected mule transaction or account, with notice to the holder.
• 20 days for the holder to explain.
• A 60-day cap on a hold unless authorities direct otherwise.

Those details come from that summary, not from RBI’s press release, and may change. As of 15 October 2026 we found no final version.

One analysis of the order, by the law firm AMLEGALS, suggests three things about the eventual SOP:

• It will likely need to define the scope of a “temporary debit hold” (a specific amount within an account versus the whole account).
• It may extend obligations beyond banks to payment aggregators and prepaid-instrument issuers.
• It is likely to formalise expectations already informally in place: continuous transaction monitoring, enhanced KYC and due diligence for remote onboarding, AI-assisted detection paired with human review, and cross-institutional coordination through a standardised framework.

That is one firm’s read written before any draft existed, not confirmed SOP content, and the September draft should be read directly.

This order addresses the freeze-authority gap: banks’ inability to freeze suspect accounts without court or law-enforcement authorisation. RBI’s four-week deadline from the widely reported 4 August 2026 order date fell on or around 1 September 2026. The September draft is RBI’s first published response.

Also in motion: RBI’s liability overhaul and MuleHunter.AI’s growing footprint

On 6 March 2026, RBI issued for public consultation a draft “Review of Framework of Limiting Customer Liability in Digital/Unauthorised Electronic Banking Transactions,” expanding the scope of its existing 2017 liability instructions to more categories of fraudulent electronic transactions. The draft:

• Aims to reduce complaint-processing time.
• Introduces, for the first time, a compensation mechanism for small-value fraudulent transactions: 85% of the loss amount or ₹25,000, whichever is lower, as a once-in-a-lifetime benefit per customer.
• Is set to take effect from 1 January 2027.

The same RBI communication reiterated that MuleHunter.AI, the RBIH-developed detection tool, was live in 26 banks as of that announcement and being scaled further. That is up from the 23-bank figure reported in a December 2025 RTI response.

The communication also said RBI has advised banks to deploy real-time transaction-monitoring software and use AI/ML and network analytics against suspicious transaction patterns.

What the 2026 developments add up to

Read together, the 2026 developments above point to a shift in what’s still open versus what’s now underway. Detection capacity kept expanding on multiple fronts this year:

• MuleHunter.AI’s bank footprint grew from 23 to 26.
• The I4C-RBIH MOU adds a formal channel for training those models on fresher Suspect Registry data.
• The Registry itself scaled from 27.37 lakh to 32.08 lakh flagged mule accounts between January and June.

What took a court order to move was the process question the sibling piece to this one had already flagged as unresolved. That question is what a bank is actually authorised to do the moment its own systems, or a shared registry, tell it an account looks like a mule account. The Supreme Court’s SOP order is the first dated 2026 instruction aimed squarely at that gap.

What compliance and fraud teams should take from this

Once RBI issues the SOP in final form, it is worth reading closely rather than treating as a formality. AMLEGALS’s analysis cited above suggests it may extend beyond banks to payment aggregators and prepaid-instrument issuers. It may also formalise expectations, such as pairing AI-assisted detection with human review, that many institutions already operate informally.

Two other points matter for account-opening teams:

• The BioCatch finding suggests mule infrastructure is shifting toward domestic Indian cash-out systems. The accounts an institution’s monitoring needs to catch are increasingly opened inside India rather than routed abroad. That is also the population the I4C-RBIH data-sharing arrangement is built to help models learn from.
• The Gujarat operation’s Chamunda Communication case, three accounts absorbing 253 cybercrime complaints, is a reminder that the account-opening stage still carries weight even as freeze-and-hold procedures get formalised after the fact.

A faster SOP for what happens once a mule account is found doesn’t reduce the value of catching it before it opens.