An NRI’s e-filing account, a fabricated return, and a network of mule accounts stretching from Panchkula to Karnataka — what the arrest of the alleged kingpin reveals about the gaps in India’s cyber-fraud and tax-refund architecture, and the law now built to close them.

ANALYSISARRESTED: DALIP B.R. ALIAS DALIP RAJGODAREMAND: 8 DAYS POLICE CUSTODY

01 The Facts on Record

On the strength of information extracted from an earlier arrest, the Panchkula Cyber Crime Police tracked and detained Dalip B.R. alias Dalip Rajgoda, a mechanical engineering graduate, in Karnataka — identifying him as the alleged kingpin behind a fraud that saw the e-filing account of a UK-based NRI from Panchkula compromised, a fabricated income tax return filed in the victim’s name, and a refund of roughly ₹2.26 crore diverted into an account that was never his.

According to The Tribune’s reporting on the case, an earlier accused, Kanhaiya Lal, had already been arrested with ₹5 lakh in cash recovered at his instance; it was information from him, combined with technical investigation, that led the police to Rajgoda. Investigators say the diverted refund was not banked in one place — it was pushed through a chain of shell bank accounts and corporate accounts, with commissions skimmed at each hop before the remainder was allegedly delivered in cash to the principal accused. A laptop and mobile phone were seized on arrest. Eight similar cases already stand registered against him in Bengaluru, and he has been remanded to eight days of police custody so investigators can map the wider network, the fake accounts, and the money trail.

A note on presumption: everything above is an allegation under active investigation. Under Indian criminal law, an accused is presumed innocent until the prosecution proves guilt beyond reasonable doubt at trial. This piece analyses the legal framework the allegations engage — it does not pronounce on Rajgoda’s guilt.

02 What Actually Happened, Legally Speaking

Strip away the cash and the courier-style delivery, and the case is really three offences stacked on top of one another, each governed by a different statute:

• Unauthorised access. Gaining entry to the NRI’s e-filing account on the Income Tax portal without consent is, on its own, a distinct wrong — the digital equivalent of picking a lock before anything is taken.
• Falsification of a return. Filing or altering a return to manufacture a refund claim that did not exist is a forgery of a statutory document, compounded by its use to extract money from the exchequer.
• Laundering the proceeds. Routing the payout through mule and shell-company accounts before extracting cash is not incidental — it is the step that converts a traceable digital fraud into anonymous currency, and it is usually where such networks unravel.

The Information Technology Act, 2000

Section 66 — read with Section 43

Dishonestly or fraudulently accessing or securing access to a computer resource — here, the e-filing portal — without the permission of the person in charge attracts imprisonment up to three years, a fine up to ₹5 lakh, or both.

Section 66C

Fraudulent use of another person’s unique identification feature — a PAN-linked login, password, or e-filing credential — to authenticate a transaction is punished separately as identity theft, up to three years’ imprisonment and a fine up to ₹1 lakh.

Section 66D

Cheating by personation using a computer resource — impersonating the NRI to the Income Tax system itself — carries up to three years’ imprisonment and a fine up to ₹1 lakh, and typically runs alongside Section 66C rather than replacing it.

Bharatiya Nyaya Sanhita, 2023 (in force from 1 July 2024)

Because the FIR was registered in 2024, the case sits at the transition between the old Indian Penal Code and its replacement, the BNS — investigators will need to fix the exact date of the offending acts to know which regime governs the general-law charges layered onto the IT Act.

Section 318, BNS (cheating; erstwhile IPC §420)

Cheating and dishonestly inducing delivery of property — here, inducing the Income Tax Department to release a refund it would not otherwise have paid — carries up to seven years’ imprisonment where the cheating involves property, plus a fine.

Sections 336–340, BNS (forgery; erstwhile IPC §§463–471)

Preparing and submitting a fabricated return as though it were genuine, and using that forged document to draw a refund, engages the forgery provisions, with enhanced punishment where the forged document purports to be one made to a public servant or a court.

Section 61, BNS (criminal conspiracy; erstwhile IPC §120B)

A multi-hop operation of this kind — hacker, mule-account handlers, cash couriers, and a coordinating “kingpin” — is close to the textbook case for a conspiracy charge, since the offence lies in the agreement itself and does not require every conspirator to have touched the money personally.

The money-laundering layer

Prevention of Money Laundering Act, 2002 — Section 3

Passing proceeds of a scheduled offence (cheating and forgery both qualify) through layered bank and corporate accounts to disguise their origin is, definitionally, money laundering — and it is what turns a state cyber-crime FIR into a case the Enforcement Directorate can independently take up.

03 The Charge Sheet, Mapped

Prosecutors building the eventual charge sheet in a case like this typically layer offence-specific IT Act provisions over general cheating and forgery law, then add conspiracy to bind the network together. Here is how the alleged conduct is likely to map onto that structure:

Illustrative Charge Mapping

Based on publicly reported facts · not an official document

Provision	Head of Charge	Alleged Conduct It Targets
IT Act §66C	Identity theft	Fraudulent use of the NRI’s e-filing login credentials
IT Act §66D	Cheating by personation	Impersonating the account holder before the tax portal
BNS §318(4)	Cheating, property involved	Inducing the IT Department to release the refund
BNS §§338–340	Forgery & using forged document	Fabricated return filed to justify the claim
BNS §61(2)	Criminal conspiracy	Coordinated roles across hacking, banking, and cash handling
PMLA §3	Money laundering	Layering the refund through mule and shell-company accounts

04 Custody, Evidence, and the Road to Trial

The eight-day police remand granted by the local court is not incidental to the legal story — it is the mechanism through which most of the case will actually be built. Under Section 187 of the Bharatiya Nagarik Suraksha Sanhita, 2023 (the successor to CrPC Section 167), police custody allows investigators to interrogate the accused directly, which matters enormously in a case like this because the real evidentiary battle is not “did money move” — bank records already answer that — but who controlled the accounts, who owns the devices, and who gave the instructions.

“The laptop and phone recovered on arrest are not just exhibits — they are the most likely repository of the login trail, the chat logs with co-conspirators, and the wallet or banking apps used to route the refund.”ON THE EVIDENTIARY WEIGHT OF SEIZED DEVICES

Digital evidence, done right

Anything recovered from the seized laptop or phone will only be usable at trial if it clears the certification bar under Section 63 of the Bharatiya Sakshya Adhiniyam, 2023 (the successor to Evidence Act Section 65B) — a certificate confirming how the electronic record was produced and that the device was functioning properly. Cyber-fraud prosecutions in India have collapsed before on exactly this technicality, so the manner in which the devices are imaged and the chain of custody is documented from this point forward will matter as much as what is found on them.

Jurisdiction across three states

The offence touches Haryana (where the victim’s account and the FIR sit), Karnataka (where the accused was arrested and where eight prior FIRs are pending), and potentially further states through the mule-account network — plus a victim resident in the United Kingdom. Section 178 of the BNSS permits trial in any jurisdiction through which the offence, or its consequences, extended, which is likely to see the Bengaluru and Panchkula cases either consolidated or tried in parallel with evidence shared between them.

05 Why This Case Is Bigger Than One Refund

Two structural features of this case are worth sitting with, because they recur across India’s cyber-fraud caseload and point to where the system is still exposed.

The NRI account is a soft target

Non-resident accounts on the e-filing portal are frequently dormant for long stretches, checked only around filing season or when a refund notification arrives — which is precisely the window in which a compromised login goes unnoticed long enough for a return to be filed and processed before the real account holder ever sees the notice. The Income Tax Department’s own two-factor authentication and Aadhaar-linking safeguards reduce this risk for resident filers with active mobile numbers, but NRIs with foreign SIMs and inconsistent OTP access remain a structurally weaker point in the system.

The “kingpin” model of mule-account laundering

What separates this case from a simple phishing scam is the layered account structure — refund into a fraudulent account, onward transfer into company accounts, commission deducted at each stage, cash delivered upward to the principal. This is the same architecture regulators have flagged repeatedly in UPI-mule investigations: a coordinating figure who never touches the compromised account directly, insulated by several cut-outs, reachable only through the financial trail rather than the digital one. It is also why conspiracy and money-laundering charges tend to matter more in convicting the organiser than the underlying IT Act sections, which are calibrated for the person who actually clicks the keys.

06 Where This Likely Goes

Expect three things to happen in parallel over the coming weeks. First, the police custody period will be used to trace the fraudulent bank account and the corporate accounts it fed into, likely triggering requests to freeze balances under the Code’s attachment provisions or a parallel PMLA reference to the Enforcement Directorate, given the scale involved. Second, the Bengaluru cases and the Panchkula FIR will need to be reconciled — either through a consolidated charge sheet or coordinated trials — since they appear to implicate the same principal accused across a pattern of similar frauds. Third, and least visible but most consequential, the Income Tax Department’s own internal controls around refund processing for foreign-address filers are likely to face scrutiny, since a fraud of this size clearing without early flags points to a gap upstream of the criminal conduct itself.

Reading this as precedent: nothing here should be treated as legal advice for an individual matter. If you hold an NRI or dormant e-filing account, the practical takeaway is procedural, not punitive — enable two-factor authentication where available, monitor refund status directly on the portal each filing season, and report any unrecognised login or return activity to the Income Tax Department’s helpline and local cyber-crime cell immediately rather than after a refund has already moved.