Mule account hotspots in India, mapped before they make news

A mule account is a bank account used to receive and move the proceeds of fraud or cyber crime. The account holder is a real, KYC-verified person who was paid, tricked or coerced into handing over access. Mule accounts sit between a scam victim's transfer and the fraudster's withdrawal, which is why the money is usually gone before a complaint is filed.

A money mule is the person, a mule account is the instrument they hand over. Money mules split into three types: complicit mules who knowingly sell account access, witting mules who suspect something is wrong and continue, and unwitting mules recruited through fake job offers, loan promises or welfare scheme pitches.

Mule account detection works best at onboarding, before the account transacts. Transaction monitoring only flags an account after fraud money has already passed through it. Video-KYC rejection signals catch the attempt at entry: impersonation, document tampering, third-party prompting during the call, and coached or scripted behaviour. Cluster those rejections by district and the recruitment hub becomes visible.

You identify mule accounts by looking for coordination, not individual applicants. Repeated device or IP fingerprints across unrelated applications, another voice coaching the applicant during Video-KYC, reused or tampered documents, and a sudden concentration of applications from one pin code. Each application looks legitimate alone. The pattern appears only when rejections are aggregated geographically.

IDfy spots mule accounts at onboarding, inside the Video-KYC session itself. Checks flag impersonation, tampered or reused documents, third-party prompting and coached behaviour before the account opens. Every rejection is then aggregated to district level, which turns individual declines into a map of where mule accounts are being recruited. Banks and NBFCs use both layers: the block at entry, and the geographic signal for watchlists.

As of June 2026, ten Indian districts show rising mule account activity without enforcement attention yet: Varanasi (14.03%), Bareilly (13.37%), Lakhimpur Kheri (12.32%), Saharanpur (10.32%), Muzaffarnagar (9.77%), Panipat (9.52%), Firozabad (8.81%), Jodhpur (7.61%), Lucknow (6.00%) and Ghaziabad (5.91%). Figures are Video-KYC rejection rates. Uttar Pradesh, Haryana and Rajasthan dominate the current list.

No, they relocate. Across 15 months and roughly 130 districts, 81% of district risk spikes lasted a single month before shifting, and the next hotspot was in the same state 39% of the time, averaging 190 km away. The Nuh cluster spread across Haryana into western Uttar Pradesh. The Surat cluster moved through Botad to Amreli and Jamnagar.

Yes, usually within a quarter. Flagged districts tend to reignite around three months after going quiet. In the current quarter, 11 active hotspots had already been flagged earlier in FY26. A district cooling off means the local recruitment network is dormant, not dismantled, so dropping it from a watchlist after 30 quiet days is premature.

The main money mule red flags at onboarding are a second voice coaching the applicant through a Video-KYC call, shared device or IP signatures across unconnected applications, documents showing signs of reuse or tampering, an applicant who cannot explain why they need the account, and an application spike from a single district or pin code.

MuleHunter.AI is an AI and machine learning model built by the Reserve Bank Innovation Hub, a subsidiary of the RBI, to detect mule bank accounts. It was piloted at two public sector banks and analyses transaction and account data. Onboarding-stage detection is complementary: it flags the account before it receives fraud proceeds for a transaction model to spot.

AML transaction monitoring examines money that has already moved. Mule account detection at onboarding examines who is trying to open the account and from where. Transaction monitoring asks whether a payment looks suspicious. Onboarding detection asks whether the customer was recruited. Institutions running only the first usually learn about a mule network from a chargeback or a police notice.

Allowing your bank account to move fraud money is a criminal offence in India. Mule account holders face account freezing, being named as an accused in cyber fraud and money laundering proceedings, and losing banking access across institutions. Not knowing the money was stolen is not an automatic defence. Both the Varanasi and Malappuram cases ended in arrests of account holders alongside agents.

Contact your bank branch or grievance officer for the specific reason and the lien-marking authority, then approach the police or cyber cell that raised the request. IDfy does not hold, freeze or unfreeze individual bank accounts. IDfy supplies mule account detection infrastructure to financial institutions and cannot access, review or release a personal account.