Money-Mule Accounts in India: Criminalisation, Bank Liability and UPI Fraud Victim Compensation

Summary: Money-mule accounts have emerged as a critical enabler of cyber-enabled financial fraud in India, particularly in UPI scams, phishing, digital-arrest fraud, investment fraud and online impersonation, allowing criminals to receive, transfer and conceal illicit funds through accounts operated by third parties. Although the Prevention of Money-Laundering Act, 2002, the Information Technology Act, 2000, the Bharatiya Nyaya Sanhita, 2023, and RBI’s KYC and anti-money-laundering regulations provide mechanisms to address financial crime, the existing framework lacks a specific statutory offence expressly targeting the knowing rental, sale, transfer or operation of money-mule accounts. This legal gap creates difficulties in establishing criminal liability, detecting suspicious transactions, freezing fraudulent proceeds and compensating victims. The article examines the responsibilities of banks, payment intermediaries and account holders, highlighting the need for stronger customer due diligence, transaction monitoring, coordinated reporting and timely intervention. It also discusses judicial and regulatory developments emphasising bank accountability and victim compensation where fraud results from institutional due-diligence failures. The author proposes a comprehensive legal framework comprising explicit criminalisation of mule-account facilitation, enhanced penalties for organised recruiters, rebuttable presumptions based on objective evidence, enforceable banking obligations and proportionate liability across payment-system participants. A time-bound compensation mechanism is recommended, including preliminary intervention within 72 hours, investigation within 30 days and compensation decisions within 90 days. Importantly, the proposed reforms also emphasise safeguards against arbitrary account freezing and wrongful prosecution of innocent account holders, seeking to balance effective cybercrime prevention, financial accountability, victim restitution and procedural fairness.

Explicit Criminalisation of Money-Mule Accounts in India:
Bank Due Diligence, Shared Liability and Time-Bound Victim Compensation in UPI Fraud

Abstract

Money-mule accounts have become an essential infrastructure for cyber-enabled financial fraud in India. In phishing, digital-arrest, investment, impersonation and UPI-related frauds, offenders increasingly use bank accounts opened or controlled by third persons to receive, layer and withdraw proceeds of crime. Although the Prevention of Money-Laundering Act, 2002, the Reserve Bank of India’s Know Your Customer framework, the Information Technology Act, 2000 and the Bharatiya Nyaya Sanhita, 2023 collectively address money laundering, banking compliance, identity theft and cheating, India does not yet have a single, explicit statutory offence squarely criminalising the renting, selling, transferring or knowing operation of mule accounts. This gap weakens deterrence, complicates prosecution, delays freezing of fraudulent funds and leaves victims uncertain about compensation.

Using doctrinal and analytical legal research, this paper examines the operation of money-mule accounts in UPI-enabled fraud and evaluates the adequacy of India’s existing legal framework. It argues that India should expressly criminalise the knowing provision, rental, sale or operation of mule accounts; impose enforceable due-diligence duties on banks and payment-system participants; and create a time-bound victim-compensation and restitution mechanism. The paper also proposes safeguards to prevent the wrongful freezing of innocent accounts. The suggested reform would align criminal liability, regulatory supervision and victim protection within a coherent digital-payment fraud framework.

Keywords: money mule accounts; UPI fraud; cyber-enabled financial fraud; bank due diligence; victim compensation; Prevention of Money-Laundering Act; Information Technology Act; digital payments.

I. Introduction

India’s digital-payment ecosystem has expanded rapidly, with the Unified Payments Interface (UPI) becoming a principal medium for retail transactions. The same convenience, however, has created new opportunities for cyber-enabled financial fraud. Offenders use phishing messages, fake customer-care numbers, fraudulent investment platforms, QR-code scams, SIM-swap techniques, remote-access applications and “digital arrest” impersonation to induce victims to transfer money. Once the money enters the payment system, it is commonly moved through a chain of bank accounts to conceal its origin and frustrate recovery.

A money-mule account is a bank account, wallet or payment instrument used to receive and transfer funds derived from criminal activity on behalf of another person. The account holder may be a willing participant, a person deceived by a fake job offer, a student recruited through social media, or a person whose identity documents have been misused. The essential function of the mule account is not merely to hold money but to break the transactional link between the victim and the ultimate beneficiary.

Money-mule accounts therefore occupy a central position in cyber-enabled financial crime. They enable fraudsters to receive victim payments, split funds across several accounts, withdraw cash, purchase assets or convert proceeds into other forms. Because the ultimate fraudster may operate from another jurisdiction or behind anonymous digital identities, the mule account and the bank that operates it often become the most identifiable points in the investigation.

Indian law contains several relevant provisions. The Prevention of Money-Laundering Act, 2002 (PMLA) addresses laundering and proceeds of crime; the Reserve Bank of India (RBI) imposes KYC, transaction-monitoring and reporting obligations; the Information Technology Act, 2000 penalises identity theft and cheating by personation using computer resources; and the Bharatiya Nyaya Sanhita, 2023 (BNS) contains general offences of cheating and cheating by personation. Yet these provisions operate in different spheres and do not create a specific, easily enforceable offence for knowingly renting, selling, transferring or operating a mule account.

The problem has acquired regulatory and judicial attention. The Supreme Court has identified bank accountability and the continued use of mule accounts as key areas requiring intervention in digital-arrest and cyber-fraud cases. It has also emphasised that regulatory measures proposed by the RBI should require financial institutions to indemnify victims where fraud results from a failure of due diligence, with compensation not less than the amount lost. The RBI has likewise been directed to prepare a standard operating procedure dealing with mule accounts and cyber-enabled financial fraud.

This paper argues that India requires a coordinated legal response built on three pillars: first, a specific criminal offence targeting mule-account operators, recruiters and facilitators; second, clearly defined and enforceable due-diligence duties for banks and payment intermediaries; and third, a fair, time-bound compensation mechanism for victims. Such a framework must also protect innocent account holders from arbitrary freezing and preserve due process.

The central research question is whether India’s present legal framework is adequate to prevent, detect, prosecute and remedy fraud involving money-mule accounts. The paper answers that the framework is incomplete. It treats mule accounts principally as an anti-money-laundering and banking-compliance issue, whereas effective control requires an integrated criminal, regulatory and victim-protection framework.

II. Research Questions, Objectives and Methodology

A. Research Questions

1. What is a money-mule account, and how is it used in UPI and cyber-enabled financial fraud?

2. Which Indian legal provisions apply to mule-account operators, recruiters, banks and payment intermediaries?

3. Why are the existing legal provisions inadequate to prevent, detect, freeze and remedy mule-account fraud?

4. Should India expressly criminalise the renting, selling, transferring or knowing operation of mule accounts?

5. What due-diligence, reporting, freezing and compensation obligations should be imposed on banks and payment-system participants?

B. Objectives

The objectives of this paper are:

• To explain the concept, operation and relevance of money-mule accounts in digital-payment fraud.
• To analyse the application of the PMLA, RBI KYC directions, Information Technology Act, 2000, BNS, 2023 and related banking regulations.
• To identify gaps in criminal liability, bank accountability, fund tracing and victim compensation.
• To propose a legislative and regulatory framework for explicit criminalisation, bank due diligence and time-bound restitution.
• To suggest safeguards for innocent account holders whose accounts may be wrongly flagged or frozen.

C. Methodology

This paper adopts a doctrinal and analytical method of legal research. It examines primary sources, including the Information Technology Act, 2000; the Prevention of Money-Laundering Act, 2002; the Prevention of Money-Laundering (Maintenance of Records) Rules, 2005; the Bharatiya Nyaya Sanhita, 2023; the Banking Regulation Act, 1949; RBI Master Directions on Know Your Customer; and judicial directions issued by the Supreme Court.

Secondary sources include law-review articles, RBI materials, reports by professional and policy institutions, government press releases and credible reporting on judicial developments. The paper does not undertake primary empirical research through interviews or surveys. Its contribution lies in legal-framework analysis and the formulation of reform proposals capable of legislative and regulatory implementation.

III. Money-Mule Accounts in Digital-Payment Fraud

A. Meaning and Characteristics

A money-mule account may be defined as a bank account, prepaid payment instrument, wallet or other payment facility that is used to receive, hold or transfer proceeds of crime on behalf of another person. The person in whose name the account is opened may or may not be the beneficial user. In many cases, the account holder provides the account, debit card, internet-banking credentials, OTPs, SIM card or KYC documents to an organised fraud network.

Money-mule accounts typically display identifiable behavioural patterns. A dormant account may suddenly receive multiple credits from unrelated persons, followed by immediate transfers to other accounts or cash withdrawals. Transactions may be inconsistent with the account holder’s declared income, occupation or stated purpose of the account. The same mobile device, IP address or email address may be linked to several accounts. These indicators do not by themselves establish criminality, but they justify enhanced monitoring and investigation.

The legal and ethical assessment must distinguish between three categories of persons: the organised fraudster who controls the network; the knowing mule who deliberately rents or sells the account; and the deceived or innocent account holder whose credentials have been misused. A sound legal framework must punish the first two categories while protecting the third.

B. Operation in UPI and Cyber-Enabled Fraud

A typical UPI fraud involving mule accounts follows a predictable sequence. First, the offender contacts the victim through a fraudulent call, message, advertisement, dating profile, investment group or fake customer-care number. Second, the offender induces the victim to make a payment through urgency, fear, greed or impersonation. Third, the payment is received in a mule account. Fourth, the funds are rapidly transferred through several accounts, withdrawn in cash or converted into other assets. Finally, the trail becomes difficult to reconstruct because the funds have been layered across multiple banks, wallets and jurisdictions.

This structure explains why mule accounts are not merely incidental to cyber fraud. They are operational infrastructure. Without accounts capable of receiving and rapidly forwarding funds, large-scale digital fraud would be substantially more difficult to execute. Consequently, legal intervention should not focus only on the person who deceives the victim; it must also address the account network that enables the fraud to succeed.

C. Why Mule Accounts Are Attractive to Offenders

Mule accounts are attractive because they reduce the risk of identification and recovery. They allow offenders to separate the fraudulent act from the eventual withdrawal of funds. They also exploit the speed of digital payments: funds received in a mule account may be transferred onward within minutes. Further, recruitment of mules can be low-cost, particularly where offenders target unemployed persons, students or persons facing financial difficulty through fake job or commission offers.

The use of multiple accounts also creates evidentiary complexity. Investigators may need to obtain records from several banks, establish the flow of funds, identify devices and IP addresses, and prove the connection between each account and the fraud. Delay in reporting by victims further reduces the possibility of freezing funds before they are dissipated.

IV. Existing Legal Framework

A. Prevention of Money-Laundering Act, 2002

The PMLA is India’s principal legislation against money laundering. It obliges banking companies, financial institutions and intermediaries to maintain records, verify customer identity and report suspicious transactions. It also empowers authorities to investigate, attach and confiscate proceeds of crime in appropriate cases.

The PMLA is relevant to mule accounts because funds received through cyber fraud may constitute proceeds of crime, and their transfer through mule accounts may constitute laundering. However, the Act’s principal focus is on laundering and the proceeds of crime. It does not create a clearly defined, standalone offence expressly directed at the person who rents, sells or knowingly supplies an account for use as a mule. Prosecutors may therefore need to rely on general offences, laundering provisions and circumstantial evidence to establish the required knowledge or intent.

The Prevention of Money-Laundering (Maintenance of Records) Rules, 2005 and the RBI’s KYC framework require regulated entities to identify customers, monitor transactions and report suspicious activity. These obligations are important preventive tools, but they primarily operate as regulatory duties. Their effectiveness in securing victim compensation depends on whether the failure to comply can be translated into a clear civil or regulatory consequence in favour of the victim.

B. RBI KYC and Anti-Money-Laundering Directions

The RBI’s KYC Master Directions require banks to undertake customer identification, ongoing due diligence, risk categorisation and transaction monitoring. Banks are expected to follow guidelines on account opening and transaction monitoring to minimise the operation of mule accounts. RBI guidance specifically states that the operations of mule accounts can be minimised if banks adhere to KYC/AML/CFT guidelines, periodically update customer-identification data and monitor transactions.

These directions are significant because they recognise that banks are not passive custodians of accounts. They have a regulatory responsibility to detect unusual activity and prevent misuse of the banking system. However, the paper argues that regulatory compliance alone is insufficient. There should be a clearer statutory connection between a bank’s failure to perform required due diligence and its liability to compensate a victim whose funds were routed through a flagged or high-risk mule account.

C. Information Technology Act, 2000

The Information Technology Act, 2000 contains several provisions relevant to cyber-enabled fraud. Section 66C penalises fraudulent or dishonest use of another person’s electronic signature, password or other unique identification feature. Section 66D penalises cheating by personation using a computer resource or communication device. These provisions are directly relevant to phishing, fake profiles, impersonation and identity-based digital fraud.

However, the IT Act does not specifically criminalise the act of knowingly providing, renting or operating a bank account as a mule. A person who merely supplies an account may escape liability if the prosecution cannot establish that the person participated in impersonation, hacking or cheating. This evidentiary gap is particularly significant because organised fraud networks often separate the person who deceives the victim from the person who controls the receiving account.

Section 43 read with Section 66 addresses unauthorised access and computer-related offences. These provisions may apply where an offender gains unauthorised access to an account or computer system. But many UPI frauds involve authorised payments induced by deception rather than technical intrusion into the victim’s account. In such cases, the victim voluntarily authorises the transfer, although the consent is obtained by fraud. This distinction creates difficulty in applying a liability framework designed primarily for unauthorised transactions.

D. Bharatiya Nyaya Sanhita, 2023

The BNS, 2023 retains and modernises several general offences relevant to cyber fraud. Cheating and cheating by personation remain central provisions. Section 319 defines cheating by personation, which is applicable where an offender cheats by pretending to be another person or knowingly substitutes one person for another. These provisions may apply to digital-arrest scams, fake officials, fraudulent investment agents and impersonation frauds.

Nevertheless, general cheating provisions require proof of deceptive inducement and dishonest intention. They do not specifically address the role of a person who knowingly makes an account available for the reception and transfer of fraud proceeds. The absence of a targeted offence means that the law may fail to capture the full range of participants in a mule-account network, particularly recruiters, account sellers and persons who knowingly provide KYC documents or banking credentials.

E. Banking Regulation Act, 1949 and NPCI Framework

The Banking Regulation Act, 1949 empowers the RBI to issue directions to banking companies. The RBI has used this power to issue KYC and AML directions requiring banks to prevent misuse of accounts. The National Payments Corporation of India (NPCI) also prescribes operational rules for UPI participants, including banks, payment service providers and third-party application providers.

Despite this regulatory architecture, responsibility is fragmented. The victim may interact with one bank or application, while the fraudulent account may be held with another bank and operated through another payment intermediary. This fragmentation complicates freezing, tracing and compensation. A victim may be directed from one institution to another, while the funds continue to move through the system. A coherent statutory framework should therefore allocate duties and liability across all participants in the payment chain.

V. Gaps in the Existing Framework

A. Absence of a Specific Mule-Account Offence

The most important gap is the absence of an express offence criminalising the knowing opening, renting, leasing, selling, transferring or operation of a mule account. Existing provisions may capture some conduct, but they do so indirectly. This creates three problems: prosecutorial uncertainty, difficulty in establishing the required mental element, and inadequate deterrence for low-level participants who enable large-scale fraud.

The Government of India has recognised that the legal framework may need strengthening by explicitly criminalising the renting of mule accounts. This recognition supports the central argument of this paper: India should not continue to rely exclusively on general cheating, impersonation and money-laundering provisions to address a distinct and widespread form of financial facilitation.

A specific offence should cover the knowing provision of an account, wallet, payment instrument, debit card, SIM card, OTP, internet-banking credential or KYC document for use in receiving, transferring or concealing proceeds of cyber-enabled fraud. It should also cover recruitment, management and organisation of mule networks. The offence should distinguish between knowing facilitation and innocent possession or misuse of credentials by a deceived account holder.

B. Difficulty of Proving Knowledge

In many prosecutions, the central issue is whether the mule knew that the account was being used for criminal purposes. The fraudster may communicate through encrypted platforms, use different identities and avoid direct contact with the account holder. The account holder may claim ignorance even where the transaction pattern strongly suggests involvement.

The law should permit courts to draw reasonable evidentiary presumptions where objective red flags exist. For example, repeated high-value credits followed by immediate withdrawals, use of the same device across multiple accounts, prior warnings from the bank, or receipt of funds from multiple unrelated fraud complaints may justify a presumption of knowledge. The presumption should be rebuttable, preserving the accused’s right to establish innocence.

C. Fragmented Bank Liability

Indian banking law has developed a strong framework for unauthorised electronic transactions. However, many cyber frauds involve authorised but fraudulently induced payments. The victim may enter the UPI PIN or approve the transaction, but does so because of impersonation, fear, false promises or manipulation. In such cases, the victim’s loss may not fit neatly within the traditional category of an unauthorised transaction.

This creates uncertainty regarding bank liability. A bank may argue that the transaction was authorised by the customer, while the victim argues that the bank failed to detect an obviously suspicious receiving account. The law should clarify that due-diligence failure in monitoring or allowing a high-risk mule account to operate can constitute an independent basis for liability, irrespective of whether the victim’s payment was technically authorised.

D. Delay in Freezing and Tracing Funds

Recovery depends heavily on speed. Once funds enter a mule account, they may be transferred onward within minutes. If the victim reports the fraud late, or if banks require lengthy verification before freezing, the opportunity for recovery may be lost.

India requires a more coordinated real-time response mechanism. Upon a verified fraud complaint, banks and payment intermediaries should be able to place a temporary hold or lien on suspected funds, preserve transaction records and notify connected institutions. Such action must be subject to review, so that innocent account holders are not indefinitely deprived of access to their funds.

E. Uncertain Victim Compensation

Victim compensation in India has historically depended on the nature of the transaction, the bank’s internal policy, RBI directions and the facts of each case. This creates inconsistency. Two victims may suffer similar frauds but receive different outcomes depending on the bank involved, the speed of reporting and the evidence available.

The Supreme Court’s recent direction that regulatory measures should require financial institutions to indemnify victims where fraud results from due-diligence failure is an important development. It shifts the discussion from voluntary compensation towards a mandatory accountability framework. The proposed RBI KYC Amendment Directions, expected to be notified and operationalised in late 2026, will be significant in determining whether this principle becomes an enforceable regulatory standard.

VI. Judicial and Regulatory Developments

The Supreme Court’s recent intervention in digital-arrest and cyber-fraud matters reflects a shift towards systemic accountability. The Court identified two central concerns: accountability of banks and the continued use of mule accounts to receive and transfer proceeds of cybercrime. It observed that mule accounts, often operated or obtained through deceptive means, are used to move money between accounts and make tracing and recovery more difficult.

The Court directed that regulatory measures proposed by the RBI must mandate financial institutions to indemnify victims of digital arrest or cyber fraud through suitable compensation, not less than the amount lost, where the fraud is found to have resulted from a failure of due diligence. It also examined the proposed RBI Know Your Customer Amendment Directions, 2026, which were expected to be notified by November 30, 2026 and operationalised by December 31, 2026.

These developments are significant for three reasons. First, they recognise mule accounts as a systemic problem rather than an isolated enforcement issue. Second, they link bank due diligence to victim compensation. Third, they require the RBI to formulate operational procedures rather than rely solely on general compliance obligations.

However, judicial directions and regulatory amendments must be supported by clear legislation. A statutory offence would provide certainty to investigators, prosecutors, banks and victims. It would also ensure that accountability does not depend solely on continuing judicial supervision or administrative directions.

VII. Comparative Perspective

Other jurisdictions treat money mules as a distinct financial-crime risk. In the United Kingdom, payment-system regulation and ombudsman mechanisms have developed around reimbursement for certain authorised push-payment frauds, while banks are expected to detect and prevent suspicious transactions. In Singapore, enforcement authorities and financial institutions emphasise customer due diligence, transaction monitoring and rapid intervention in mule-account networks. European Union law also places substantial emphasis on payment-service-provider obligations, anti-money-laundering controls and consumer protection.

The comparative lesson is not that India should copy any single model. Rather, India should adopt an integrated approach: criminalise knowing mule-account facilitation, impose measurable due-diligence duties on regulated entities, and create an accessible compensation mechanism. A purely criminal approach may punish individuals but fail to recover funds; a purely regulatory approach may improve compliance but leave victims without effective remedy. An integrated framework addresses all three concerns.

VIII. Proposed Legal Reforms

A. Specific Criminal Offence

India should enact a specific offence targeting mule-account facilitation. A possible formulation is:

“Whoever, knowingly or having reason to believe that funds are proceeds of cyber-enabled fraud, opens, operates, rents, leases, sells, transfers control of, or provides any bank account, wallet, prepaid payment instrument, debit card, SIM card, OTP, internet-banking credential or KYC document for the purpose of receiving, holding, transferring or concealing such proceeds, shall be punished with imprisonment and fine.”

The offence should include aggravated liability for recruiters, organisers, repeat offenders and persons operating multiple mule accounts. It should also cover persons who knowingly provide identity documents or banking credentials to facilitate the scheme. At the same time, the provision must require proof of knowledge, reason to believe, or reckless disregard of obvious warning signs.

B. Rebuttable Presumption of Knowledge

To address evidentiary difficulty, the law may permit a rebuttable presumption of knowledge where objective indicators exist. Such indicators may include:

• Multiple unrelated credits followed by immediate withdrawals.
• Transactions inconsistent with the account holder’s declared income or occupation.
• Use of the same device, IP address or contact details across several accounts.
• Prior warning, restriction or suspicious-activity report relating to the account.
• Receipt of funds linked to multiple fraud complaints.

The presumption should not relieve the prosecution of its overall burden. It should merely allow the court to infer knowledge from conduct, unless the accused provides a credible explanation.

C. Bank Due-Diligence Duties

Banks and payment intermediaries should have statutory duties to:

• Conduct risk-based customer due diligence at onboarding and periodically thereafter.
• Monitor abnormal credits, rapid onward transfers and cash withdrawals.
• Identify accounts linked to common devices, IP addresses or contact details.
• Flag and restrict high-risk accounts promptly.
• Report suspicious transactions to FIU-IND and cooperate with law enforcement.
• Preserve KYC records, transaction logs, device identifiers and audit trails.
• Respond to verified fraud complaints within a fixed timeline.

These duties should be enforceable through regulatory penalties, supervisory action and, where due-diligence failure causes loss, victim compensation.

D. Shared Liability Framework

Liability should be allocated according to the role and degree of fault of each participant. A possible framework is as follows:

Actor	Liability trigger	Appropriate remedy
Mule-account operator	Knowing operation, rental, sale or transfer of account	Criminal prosecution, fine and account restriction
Recruiter or organiser	Recruiting, managing or profiting from mule networks	Enhanced punishment and proceeds confiscation
Bank or payment intermediary	Failure to perform required due diligence despite red flags	Victim compensation and regulatory penalty
Innocent account holder	No knowledge or involvement	Prompt unfreezing, grievance remedy and protection from prosecution

This model avoids imposing absolute liability on banks. It requires proof of a due-diligence failure, but it also prevents banks from escaping responsibility merely because the victim technically authorised the payment.

E. Time-Bound Victim Compensation

India should establish a time-bound compensation and restitution mechanism. Upon a verified complaint, the concerned bank or payment intermediary should be required to preserve funds, place a temporary hold where legally permissible, and initiate tracing procedures. Where investigation establishes that the fraud occurred because of the institution’s due-diligence failure, compensation should not be less than the amount lost, consistent with the Supreme Court’s recent direction.

A practical timeline could include:

• Immediate preservation of transaction records upon complaint.
• Preliminary action within 72 hours, including temporary restriction of suspected mule accounts.
• Investigation and tracing within 30 days.
• Final compensation decision within 90 days, subject to appeal.
• Fast-track review for claims of wrongful freezing.

The mechanism should be administered through the RBI Integrated Ombudsman Scheme or a dedicated digital-fraud redressal authority, with clear documentation requirements and appeal rights.

F. Protection of Innocent Account Holders

Strong enforcement must not become a tool for arbitrary account freezing. The law should require notice, reasons and an opportunity to respond before permanent closure or forfeiture. Innocent persons whose identities or KYC documents have been misused should have access to a fast-track grievance mechanism. Banks should be required to distinguish between accounts used knowingly for fraud and accounts compromised or misused without the holder’s knowledge.

This balance is essential. Overbroad freezing may harm legitimate customers, discourage financial inclusion and create new litigation. A fair framework must therefore combine strong enforcement with procedural safeguards.

IX. Implementation Suggestions

The proposed reforms should be supported by practical measures:

• Creation of a secure, centralised mule-account intelligence registry accessible to regulated entities, subject to data-protection safeguards.
• Real-time integration among banks, NPCI, cybercrime reporting portals and law-enforcement agencies.
• Mandatory fraud alerts for high-risk transactions and unusual account activity.
• Training for bank staff on mule-account indicators, suspicious-transaction reporting and victim assistance.
• Periodic RBI audits of bank compliance with KYC and transaction-monitoring obligations.
• Public-awareness campaigns in regional languages, including Tamil, targeting elderly users, students, unemployed persons and first-time digital-payment users.
• Publication of anonymised enforcement and compensation data to improve transparency and public trust.

These measures would complement criminal liability by improving prevention, detection and recovery.

X. Conclusion

Money-mule accounts are not a peripheral feature of cyber-enabled financial fraud; they are its financial backbone. They enable offenders to receive victim payments, obscure the trail of funds and defeat recovery. India’s existing legal framework contains important tools, but it addresses the problem in a fragmented manner through money-laundering law, banking regulation, cybercrime law and general offences of cheating.

This paper has argued that India should expressly criminalise the knowing provision, rental, sale, transfer or operation of mule accounts. It should also impose enforceable due-diligence duties on banks and payment intermediaries, clarify liability for fraudulently induced UPI payments, and create a time-bound compensation mechanism for victims. At the same time, the framework must protect innocent account holders through notice, review and grievance-redressal safeguards.

The recent judicial emphasis on bank accountability and victim indemnification provides a strong foundation for reform. What is now required is legislative clarity. A specific offence, enforceable regulatory duties and a fair compensation mechanism would transform India’s response from reactive investigation to systemic prevention. Such a framework would strengthen deterrence, improve recovery of fraud proceeds and enhance trust in India’s digital-payment ecosystem.

References

• Statutes: Information Technology Act, 2000; Prevention of Money-Laundering Act, 2002; Prevention of Money-Laundering (Maintenance of Records) Rules, 2005; Bharatiya Nyaya Sanhita, 2023; Banking Regulation Act, 1949.
• Reserve Bank of India, Master Direction – Know Your Customer (KYC), and related Master Circulars on KYC/AML/CFT.
• Reserve Bank of India, Master Circular on Know Your Customer/Anti-Money Laundering/Combating Financing of Terrorism, guidance on monitoring transactions to minimise operations of money-mule accounts.
• Government of India, Press Information Bureau, statements on cybercrime, cyber security and the need to strengthen the legal framework relating to mule accounts.
• Supreme Court of India, orders and directions in the suo motu proceedings concerning digital-arrest scams and cyber-enabled financial fraud, including directions on mule accounts, bank due diligence and victim compensation.
• Relevant secondary sources: law-review articles, RBI publications, FIU-IND annual reports, NCRB data, professional reports on money mules and digital-payment fraud.

****

Author: Kavichelvan G | Third-Year Law Student, Vinayaka Mission’s Law School, Chennai | [email protected]