Why India's AI-Powered Scam Networks Now Look Like Organised Crime — and Where the Money Trail Breaks
Why India’s AI-Powered Scam Networks Now Look Like Organised Crime — and Where the Money Trail Breaks
Indians filed 21.77 lakh cyber fraud complaints and reported ₹19,813 crore in losses in 2025, according to I4C data. Offshore compounds, cheap AI tools, recruited mule accounts and layered laundering now give these operations the shape of a criminal enterprise.
The voice on the phone sounds like a police officer, then a customs official, then your bank. The video call shows a uniform and an office. The “investment advisor” in a messaging group posts screenshots of daily profits. Each scene feels like a lone con artist. Behind many of them, the evidence increasingly shows, sits something larger: recruiters, scriptwriters, technology suppliers, account renters and money movers, each paid for a specialised job.
That is the defining shift of the past two years. Cyber fraud in India has moved from opportunistic crime to an industry with divisions of labour, supply chains and cross-border operations, closer to how organised crime works than to how a hacker works. Artificial intelligence has lowered the cost of the most labour-intensive step, convincing a stranger. This piece maps the structure using official figures, shows where the money trail can be broken, and sets out what that means for you.
The Scale Behind the Phone Calls
Data from the Indian Cyber Crime Coordination Centre, compiled from the National Cyber Crime Reporting Portal and reported by IANS in January 2026, shows 21,77,524 complaints in 2025 with reported losses of ₹19,813 crore. In 2024 there were 19,18,852 complaints and ₹22,849.49 crore lost. Over six years, losses exceeded ₹52,976 crore. The first half of 2026 alone saw more than 12.71 lakh complaints and over ₹10,178 crore in alleged fraudulent transactions, the Indian Express reported in July.
The pattern in those numbers is telling. Complaints rose while total losses fell, which pushed the average loss per complaint down from about ₹1,19,079 in 2024 to about ₹90,989 in 2025 by our calculation. That fits a high-volume model: many more victims, smaller amounts each, which is exactly what automation and AI make cheap.
An Org Chart for a Crime Without a Godfather
Organised crime is defined less by violence than by structure: continuity, specialised roles, profit motive and the ability to launder proceeds. Mapped against those traits, the scam ecosystem described by investigators fits closely. The table sets each role against the evidence for it.
| Classic organised-crime role | Equivalent in fraud networks | What it does | Evidence on record |
|---|---|---|---|
| Leadership and financiers | Operators of offshore scam centres | Fund and run large calling operations | 45% of complaints traced to Cambodia, Myanmar and Laos (CFCFRMS via IANS) |
| Foot soldiers | Callers and chat operators, some trafficked | Work scripts to quotas | UNODC reports trafficked workers beaten for missing quotas |
| Recruiters | Mule-account middlemen in India | Rent bank accounts from locals | Holders approached with about ₹10,000 commission (CyberPeace) |
| Equipment suppliers | AI tool builders and sellers | Provide deepfake and document tools | Wrappers on open-source models shared on Telegram (Business Standard) |
| Money launderers | Layering networks, shell firms, crypto | Move and disguise proceeds | ED found over ₹12,000 crore routed this way (CyberPeace) |
| Corrupted insiders | Compromised staff at banks or telecoms | Open accounts or SIMs, bypass checks | Cases of bank insiders reported in mule-account probes (CyberPeace) |
UNODC put the international picture bluntly in March 2026. Networks run money laundering, build and deploy malware, use AI for deepfakes and voice cloning, and “sell cybercrime capabilities as services,” UN News reported from the Vienna Global Fraud Summit. Fraud is one layer of an ecosystem that also includes corruption, human trafficking and underground banking. US victims alone reported about $10 billion in losses to Southeast Asian operations in 2024.
What people often get wrong: many assume the person on the call is the criminal who benefits. Often that person is a low-level worker, sometimes trafficked, and the money passes through several Indian bank accounts owned by people who never met the victim. That is why arresting a caller or a single account holder rarely recovers money, and why reporting fast matters more than identifying the scammer.
What AI Actually Changed
AI did not invent phone fraud. What it changed is the cost and scale of persuasion. Business Standard reported in June 2026 that fraudsters mainly use customised tools built on open-source models rather than frontier systems, running on consumer hardware such as gaming PCs, and shared on Telegram and dark-web marketplaces. One executive told the paper that “fraudsters are not using the standard models.”
Before cheap AI
- Scripts in one or two languages
- Fake documents needed skilled forgers
- Video impersonation was rare
- Each call needed a trained human
With cheap AI
- Personalised lures in regional languages, per Quick Heal
- Synthetic bank statements and documents, per Business Standard
- Deepfakes used in video KYC; one NBFC case of ₹15 to ₹20 crore
- Cloned voices of trusted people in phone scams
The financial sector has felt it directly. Industry sources told Business Standard of deepfakes being injected during video KYC and of synthetic documents used to open accounts, including a ₹15 crore to ₹20 crore case at a non-banking finance company. The I4C has issued an advisory on AI techniques that bypass safeguards and urged onboarding systems, including fintech firms, to add deepfake detection. “Deepfakes are extremely hard to detect to a normal person,” Sandesh GS of Bureau told the paper.
Why that pushes fraud towards organisation
Tools that need setup, maintenance and distribution reward specialisation. One group builds and sells the tool, another runs calls, a third handles accounts. Quick Heal’s mid-2026 report describes attackers running “highly organised, multi-layered operations,” with contact starting by SMS or voice, moving to WhatsApp or Telegram, and ending in payment links that route money into mule accounts.
Following the Money: Where the Trail Can Be Cut
Every stage of the chain is also a chance to stop it. The figures below come from I4C data cited by Quick Heal and the Indian Express, and from CyberPeace’s analysis of the Suspect Registry.
The refund gap (our calculation): of ₹64,447 crore in losses reported from 2021 to May 2026, ₹10,718 crore, about 16.6%, was frozen, but only ₹323 crore, about 0.5%, reached victims as refunds. In the first half of 2026, banks placed liens on ₹2,968.85 crore of ₹10,178 crore reported, a rate of about 29.17%. Freezing is far more common than recovery, because releasing frozen money usually requires police and court processes.
For victims, this means the first call matters more than the last. A hold placed while money is still in the first or second account in the chain can be released back later; money that has already been withdrawn in cash or converted into cryptocurrency is far harder to trace, let alone return.
The mule account is the weakest link
Mule accounts are ordinary bank accounts, held by real people with valid KYC, that receive and pass on stolen money. Gujarat’s Operation Mule Hunt 1.0 in November and December 2025 traced ₹2,289 crore in fraudulent transactions, filed 565 FIRs, made 638 arrests and impounded 913 accounts linked to more than 4,000 cases, according to CyberPeace. In one Patan case, 13 current accounts handled ₹398.43 crore across 228 cybercrime cases.
Where the Money Goes Missing Most
Losses are concentrated in large, digitally active states. IANS, citing Indian Express analysis of I4C data, reported these 2025 losses.
Treating Scams as Organised Crime in Law
The legal framework has started to reflect the shift. The Bharatiya Nyaya Sanhita, which replaced the Indian Penal Code from July 1, 2024, includes cyber-crimes within its definition of organised crime under Section 111, alongside offences such as extortion and economic crime when committed by a continuing crime syndicate. That gives police a tool aimed at the network, not only at the individual caller or account holder.
The practical challenge is jurisdiction. The callers may sit in another country, the tool supplier in a third, the mule accounts in a dozen Indian districts and the laundered money in cryptocurrency wallets. UNODC officials quoted by UN News called for “following the money through financial investigations” to identify the networks behind scam operations, and noted that scam centres often relocate when one site is raided. A Philippine enforcement official put the evidentiary problem simply: “How do you prove a cybercrime in 36 hours? It is not possible.”
The human cost behind the numbers
The organised-crime frame also explains the harm on both sides of the phone. UNODC describes trafficked workers in Southeast Asian compounds who are beaten or tortured for missing targets. On the other end, victims are often educated and careful. Kim Sawyer, a former Melbourne university professor who lost over $2.5 million with her husband, told UN News that “the scammer was extraordinarily believable.” Her husband added: “The scammer works twice: they take your money and they take your soul.”
That emotional toll is one reason victims delay reporting, out of embarrassment or fear. Delay is exactly what the networks rely on, because every hour gives the money more time to pass through layers of accounts. Treating fraud as a crime done to you, rather than a mistake you made, is the first step to reporting it in time.
Why volume is the business model
Organised fraud does not need every attempt to succeed. Quick Heal’s mid-2026 report cites Seqrite’s count of 265.52 million threat detections in India over 12 months, about 505 every minute. At that scale, even a tiny success rate produces thousands of victims. AI matters because it raises the success rate of each attempt while cutting its cost, which is precisely the economics that lets an enterprise, rather than a lone scammer, profit.
How the Response Has Built Up
- September 2024I4C launches the Suspect Registry with banks to flag mule accounts.
- Nov to Dec 2025Gujarat’s Operation Mule Hunt 1.0: 638 arrests, ₹2,289 crore traced.
- January 2026I4C data shows ₹19,813 crore lost in 2025; Operation Mule Hunt 2.0 begins January 8.
- March 2026UNODC and INTERPOL convene the Global Fraud Summit in Vienna.
- June 2026I4C advisory on AI techniques; RBI finalises digital fraud compensation rules.
- July 2026Data shows 12.71 lakh complaints and ₹10,178 crore in the first half of 2026.
- January 1, 2027RBI’s new liability and compensation framework takes effect.
Protecting Yourself From an Industrial Scam
Because these operations run on volume, scripts and stolen trust, defence is about breaking the script and moving fast. The steps below are general guidance; they are not a guarantee against every scam.
- Treat any call or video call claiming to be police, customs, a court or “digital arrest” as a scam; no Indian agency arrests or demands money over a video call.
- Never move money because someone tells you to “verify” or “secure” it, however convincing the voice or face.
- Agree a family code word, since AI can clone the voice of a relative from short public clips.
- Never rent, sell or lend your bank account, SIM or UPI ID; mule-account holders face prosecution under the Bharatiya Nyaya Sanhita.
- If money leaves your account, call 1930 or report on cybercrime.gov.in at once, then call your bank’s fraud line.
A personal defence checklist
Questions Readers Are Asking
How much money did Indians lose to cyber fraud in 2025?
About ₹19,813 crore across 21.77 lakh complaints, according to I4C data reported by IANS. In 2024, losses were ₹22,849.49 crore.
How is AI being used in scams in India?
Reports describe AI-generated phishing in regional languages, cloned voices of trusted people, synthetic documents and deepfakes used in video KYC. Tools are often built on open-source models and shared on Telegram and dark-web markets.
What is a mule account?
A real bank account, held by a person with valid KYC, used to receive and pass on stolen money, often rented to fraudsters for a commission. Holders can face criminal prosecution.
Where do most cyber scams targeting Indians come from?
CFCFRMS data cited by IANS traced 45% of complaints to Cambodia, Myanmar and Laos, where UNODC has documented large scam centres. The money usually moves through Indian mule accounts.
What is the digital arrest scam?
A scam in which callers pose as police or other officials, often on video, and claim you are under investigation, pressuring you to transfer money. It accounted for about 8% of reported 2025 losses.
Can I get my money back after a cyber fraud?
Sometimes. Reporting immediately to 1930 or cybercrime.gov.in helps banks freeze funds, but only about 0.5% of losses from 2021 to May 2026 were refunded. From January 1, 2027, RBI rules add compensation of up to ₹25,000 for eligible losses up to ₹50,000.
What is the 1930 helpline?
It is the national cyber fraud helpline run under the Indian Cyber Crime Coordination Centre. Calling quickly lets authorities alert banks to put holds on stolen funds.
Is renting my bank account to someone illegal?
Yes. Mule account holders have been arrested and charged under the Bharatiya Nyaya Sanhita in operations such as Gujarat’s Operation Mule Hunt, which made 638 arrests in its first phase.
The Short Version
India’s cyber fraud has industrialised. In 2025, 21.77 lakh complaints reported ₹19,813 crore in losses, mostly from investment scams. Offshore scam centres, recruited mule-account holders, AI tools shared on Telegram and layered laundering give these networks the shape of organised crime. Enforcement has flagged 24.67 lakh mule accounts and frozen ₹10,718 crore, but only ₹323 crore has been refunded. For individuals, the defence is simple and urgent: refuse pressure, never rent your account, and report to 1930 within the first hour.
