Background and Timeline: The Gujarat CID Crime’s specialized cyber unit dismantled a significant criminal network in Surat following a high-level intelligence tip-off. The action took place in January 2026 after the Financial Intelligence Unit (FIU) in Delhi shared critical data regarding suspicious transaction surges in Gujarat-based accounts. The bust focused on the domestic infrastructure that supports international cyber syndicates, particularly those operating with “Chinese” backend support.

Modus Operandi: The accused operated as “mule aggregators,” actively managing and supplying large numbers of bank accounts to international Chinese cyber mafias. These accounts were used to receive fraud proceeds, which were then swiftly transferred to secondary accounts and withdrawn as cash to erase the digital trail—a classic laundering technique. Investigators also uncovered that the syndicate utilized hawala networks and cryptocurrency transactions to move large sums of illegal funds to their foreign handlers.

Victims and Financial Impact: The syndicate facilitated the movement of millions of rupees generated through various cyber scams, including investment and digital arrest frauds across India. Investigation confirmed that cyber fraud proceeds had been deposited in every single suspicious account under their management at the time of the raid. By providing the banking exit points for Chinese cyber fraud networks, this Surat-based group enabled massive financial siphoning that impacted victims nationwide.

Investigation and Agencies Involved: The operation was a coordinated effort between the Gujarat CID Crime unit, the Gandhinagar Cyber Centre of Excellence, and the Financial Intelligence Unit (FIU), Delhi. Technical teams tracked the movement of funds from the suspicious accounts into foreign endpoints via covert channels and encrypted messaging apps. The investigation revealed a highly organized structure where the local accused were in constant communication with their international handlers.

Arrests and Suspects: Eight fraudsters were arrested in Surat for their involvement in operating and supplying these mule bank accounts for international syndicates. These individuals were found to be the primary domestic link for several international cyber fraud networks operating from Southeast Asia. Authorities seized evidence of hawala ledger accounts and crypto-wallet addresses from the suspects’ devices, which are now being analyzed to trace the final destination of the siphoned money.

Broader Implications and Trends: The involvement of Chinese cyber mafias in the Indian “mule market” indicates a growing transnational threat where domestic criminals act as the gateway for foreign entities. This case underscores the importance of inter-agency cooperation between the FIU and state CID units in detecting large-scale laundering operations. Authorities have emphasized that the use of hawala and crypto by these networks represents a significant challenge to traditional financial oversight and national security.