Hero FinCorp’s ₹12.84-crore cyber fraud: 317 transactions, mule accounts and crypto trail

₹12.84 crore was drained from Hero FinCorp Ltd’s corporate bank account through 317 unauthorised transactions on August 21, setting off a cyber-fraud investigation that has now uncovered a sprawling network of mule accounts, cryptocurrency transfers and alleged links to Chinese Telegram groups and a Dubai-based handler.

The scale of the operation became clear as Delhi Police’s Intelligence Fusion and Strategic Operations (IFSO) unit followed the trail of the money across multiple bank accounts and states.

Five people have been arrested in raids across Uttar Pradesh, Rajasthan and Haryana, including a private bank relationship manager who allegedly helped facilitate the opening of mule accounts.

Police have so far managed to put ₹1.7 crore on hold in fraudulent accounts as the investigation continues to trace the remaining funds and identify other members of the syndicate.

How the fraud came to light

The case began with a complaint from Hero FinCorp, a registered NBFC, through its authorised legal representative.

The company detected suspicious activity in its corporate bank account after receiving system alerts from HDFC Bank.

What followed was the discovery of 317 digital transactions totalling ₹12,84,09,997, carried out without the knowledge or approval of the company’s management.

According to police, the money was initially distributed across 34 primary-layer bank accounts.

Investigators then began examining the account details, transaction trails and mobile phone records associated with the suspected recipients.

The case was registered on August 21 under provisions of the Bharatiya Nyaya Sanhita relating to extortion, cheating, cheating by personation, forged documents or electronic records, and using forged documents or electronic records as genuine.

A dedicated team was subsequently formed to trace the movement of the money and identify the people controlling the accounts.

The money trail

One of the trails led investigators to Abhay Kumar Solanki, a resident of Bulandshahar in Uttar Pradesh.

Police said ₹60,000 from the defrauded funds reached his account and was subsequently withdrawn through an ATM.

Another trail pointed to Lovely, a resident of Kurukshetra, Haryana.

Police said ₹80 lakh was credited to an account held in the name of Property Gallery with the Central Bank of India in Thanesar, Kurukshetra.

According to investigators, Lovely had opened the account after being allegedly lured by an absconding accused, Satyam, from Kaithal.

Police said Abhay and Lovely were operating separately and did not know each other.

Investigators then traced another layer to Naman Kumar, a Jaipur resident and account holder of Infirmity Services at Yes Bank in Jaipur.

Police said ₹40 lakh was credited to this account. Naman had also provided his IndusInd Bank account, through which around ₹70 lakh was allegedly routed.

That account had already surfaced in 43 complaints on the National Cyber Reporting Platform (NCRP) from different parts of the country, according to police.

From bank accounts to crypto

The investigation then led police to Harman, a resident of Bikaner, Rajasthan, whom Naman allegedly met through Vikas.

Police said Vikas operated Naman’s IndusInd Bank account for receiving and transferring the suspected fraud proceeds and allegedly installed an APK file on Naman’s mobile phone for the purpose.

Harman allegedly introduced Naman to Sourav, a Delhi resident. Police said Naman subsequently travelled to Delhi and stayed at Hotel Nirvana Residency in Krishna Nagar, where his Yes Bank account was allegedly operated using the same modus operandi.

Investigators also found an alleged cryptocurrency component to the operation.

Police said Harman was in contact with several Chinese groups on Telegram and was also directly communicating with Devender Singh Chauhan, a resident of Udaipur, Rajasthan.

According to a senior police officer, Devender allegedly converted the cheated funds into USDT, a cryptocurrency, before transferring them to fraudsters based abroad.

Police said the Telegram groups were allegedly involved in the sale and purchase of bank accounts, with accounts being offered in bulk for different purposes.

Harman allegedly obtained and operated Naman’s bank account on a commission basis and received around ₹1.5 lakh as commission from Devender Singh, investigators said.

Bank relationship manager under scanner

The investigation also led police to Vikas, a relationship manager at a bank in Jaipur.

Police allege that Vikas helped Naman open accounts with Yes Bank and IndusInd Bank and subsequently introduced him to Harman, who allegedly facilitated the movement of the fraud proceeds.

During the investigation, police recovered cheque books, mobile phones and rubber stamps bearing the name Property Gallery, officials said.

Five arrested, more suspects being traced

The five arrested have been identified as Abhay Kumar Solanki, Lovely, Naman Kumar, Harman and Vikas.

Police said the operation appears to have involved multiple layers, with the money being moved through different bank accounts before a portion was allegedly converted into cryptocurrency and transferred overseas.

‘The offence is grave, well-organised, and trans-state in nature, involving sophisticated cyber fraud, and systematic laundering of proceeds of crime,’ DCP (IFSO) Gaurav Tyagi said.

According to the police, key members of the network operating from Dubai and India have been identified.

Investigators are continuing efforts to arrest those absconding and recover the remaining funds.

The case has thus moved beyond a single unauthorised debit episode, with investigators now attempting to map the larger network behind the 317 transactions that moved ₹12.84 crore out of an NBFC's account.