Around noon on January 11, 2025, a 32-year-old man walked into IV Town police station in Nizamabad. He looked ashen. “Everyone in the police station noticed him,’’ a police officer remembered.

Three days earlier, on January 8, the man had invested Rs 1.04 lakh — money he carefully saved after working in a company for a year — in an investment app that promised attractive returns. By the time he realised the app was fraudulent and told the police, the money was gone — it was all he had.

This fraud wasn’t very big, an investigator recalled, but once the police officers learnt that this meagre amount was all his savings, they were sympathetic. “He had put together this money from the salary he earned at his new job at a private company in a small town, about 200 km from Hyderabad,” a police officer said.

Let’s call him Citizen L, to protect his identity.

As police officers began digging deeper, the case took an unexpected turn. This didn’t seem to be a run-of-the-mill cyber fraud.

First, they found a phone number linked to the fraudulent investment app. Then, they unearthed a current account at a private bank’s Nizamabad branch, used as a mule account.

This first mule account that was busted led to another mule account 56820000100031001. This mule account sat at the heart of a web of illicit transactions and was a money mule hub. Soon police found out that this mule account was linked to proceeds of cybercrimes in four states: Uttar Pradesh, Bihar, Gujarat, and Telangana. However, the initial revelations were just the tip of the iceberg. Telangana Police, subsequently, busted a country-wide cybercrime racket involving 46 such mule accounts with links to crimes in 14 states and transactions worth Rs 152.18 crore.

The story of the mule account, 56820000100031001, however, didn’t begin in Nizamabad. Two years earlier, on June 14, 2024, a complaint had been filed against this current account number on the National Cybercrime Reporting Portal (NCRP). It was used in fraudulently transacting close to Rs 4 lakh — proceeds of investment fraud — from a victim based in Noida, Uttar Pradesh. A probe was initiated and then abandoned. “The account couldn’t be traced by Uttar Pradesh Police because it wasn’t registered in the state,” a UP police officer said.

“There were a lot of accounts to which the proceeds were sent. We weren’t able to locate all the accounts as they were registered in different states,” said the officer, posted at Noida Sector 49 station.

It was Citizen L’s complaint in Nizamabad that finally led to the expose.

Like everyone else, Citizen L wanted to make the most out of his meagre salary and kept parking his money in fixed deposits. But seeing others his age were investing, he decided to give it a shot. He found an investment broker online and called him up.

Police said the broker, who was a scamster, added him to a WhatsApp group and encouraged him to make payments. Citizen L transferred Rs 5,000 at first and was shown handsome returns. This encouraged him to invest more — Rs 10,000 to Rs 50,000 in different instalments. He was already down Rs 1.04 lakh when he realised he was not able to withdraw the money.

By then, the money had been transferred to the account number of a private bank in Nizamabad. Police traced this account and requisitioned for an immediate freeze.

The account, police said, was registered in the name of Mohammad Abdul Jawed from Bodhan in Nizamabad district. They retrieved almost all of the money, close to Rs 1 lakh, which Citizen L had lost. Police nabbed Jawed. Once questioned, he spilled the beans, leading to the arrest of his handler Gudumala Nithish. Nithish too hailed from Nizamabad. They were named accused 1 and 2 and remanded to judicial custody.

Once the police cracked the case, the investigation went dormant. “We thought this was the end of it,” Station House Officer of IV Town Police Station, Sadula Satheesh, who led the investigation in the case, told The Indian Express. “But this was only the beginning”.

A year later in February 2026, Telangana police’s Cyber Security Bureau launched what they called Crackdown 1.0 — an effort to cull out mule accounts and arrest those who hold them, and their handlers. In 2025, 76% of India’s cybercrimes were linked to investment fraud.

“When we had questioned Jawed, he’d said Nithish was his handler; he had only opened the bank account and given the details to Nithish. Nithish was linked to several cyber scamsters, who were given the account details to route money from different frauds, including investment fraud,” Inspector Satheesh explained.

Jawed’s account number was linked only to one fraud involving Citizen L.

“But Cyber Crime police station, Nizamabad (which reports to Telangana’s Cyber Security Bureau), realised that Jawed’s account number was just one in a series of accounts opened at a private bank in Nizamabad,” SP Cyber Security at the Cyber Security Bureau, B Saisri, told The Indian Express.

“Nithish’s phone had data on 13 bank accounts — all current accounts — which had transactions of Rs 31.07 crore linked to different cyber crimes. We realised that 11 of these accounts were from one particular bank (where Jawed too had an account),” Saisri said.

The Nizamabad police asked the bank manager to provide him details of all current accounts opened between 2024 and 2026 — there were 106, out of which 46 turned out to be linked to crimes on the NCRP.

“The handler had colluded with bank authorities to open these many accounts to facilitate cybercrimes. We have apprehended seven individuals, all connected to these fraudulent accounts, and remanded them to judicial custody. “Efforts are on to trace the remaining six account holders, who are currently absconding,” Saisri said.

Among the 46 accounts, Account Number 56820000100031001 continued to stand out. Now frozen, it has been linked to multiple frauds across the country.

One of them involved a 29-year-old — Citizen M — from Uttar Pradesh’s Noida. Two years ago, in June 2024, Citizen M was chatting with his investment advisor Ankita Lao, a woman who claimed to have “inside information in IPO stock trading”.

She first told the young IT professional to invest Rs 60,000 on an investment app. He was shown returns of 30% soon after. Enthused, M invested Rs 96,000 more on the app. Then he was encouraged to invest Rs 20,000, Rs 2 lakh and more.

Within a week’s time, Citizen M lost Rs 3.9 lakh to investment fraud. “I thought I was investing for a better future. I still can’t believe I was duped two years ago,” Citizen M told The Indian Express. The Rs 4 lakh, which Citizen M in UP lost, landed in the Nizamabad account — 56820000100031001.

Citizen M has not got the money back. “The money has changed hands and reached other accounts from the Nizamabad account. Hence, we have not been able to trace it,” an officer from the Noida Sector 49 police station told The Indian Express.

Citizen M was only one among the people, who were duped to transfer money to the account.

In Buxar, Bihar, Citizen N, a 39-year-old homemaker, got a call from an unknown number. “When I picked up the call, I was told by a woman that she had accidentally transferred money to my account and would like it back. I was also sent a message which read that money has been credited to my account. I believed it,” Citizen N said.

The calls did not stop. “She kept on insisting that she would like her money back and I transferred Rs 32,000 from my account to the account she asked me to transfer it to,” Citizen N rued.

The Rs 32,000 ended up in the Nizamabad account number. Citizen N has not got the money back even though the case is active.

“We cannot retrieve the money because this account number is only one among the mule accounts which were traced. From this account, the money would have gone to some other account,” a Buxar police officer told The Indian Express.

Other than Citizen M and Citizen N, a 54-year-old — Citizen O — in Gujarat’s Vadodara was also duped in 2024. “I got a call from a relative who asked me for some money. When I heard the voice, I was sure that I was talking to my relative. But it was a cybercriminal, who was impersonating my relative,” Citizen O told The Indian Express.

Citizen O transferred Rs 96,962 to a mule account and the money reached the Nizamabad account too. Citizen O has not got his money back. “I am tired of doing the rounds of the police station in Vadodara,” he said.

In Hyderabad, Citizen P, a 55-year-old government official, meanwhile, was sure that he was investing in the stock market in 2024. “I had downloaded the app from Google Play Store and believed it would be genuine. First, I transferred Rs 1,000. It seemed to work,” Citizen P rued.

He went on to transfer more money over the next two months. “It is when I lost Rs 13 lakh in total that I realised something was wrong. It was my hard-earned money,” Citizen P told The Indian Express.

He, too, has not got his money back as it was transferred to different bank accounts, and reached the Nizamabad account.

“Money reaches a mule account from different crimes or criminal syndicates. A single mule account could be sold to different criminal syndicates and could be functioning on behalf of anyone,” Shikha Goel, director of Telangana’s Cyber Security Bureau, told The Indian Express.

Back in Nizamabad, the probe didn’t stop. Constable Narayana is still searching for the account holder of 56820000100031001.

“The address given, associated with the bank account and mobile number, was not traceable. We went and searched for the account holder but he is now considered absconding,” Narayana said.