Crime New Delhi

Rs 12.84 crore siphoned from Hero FinCorp; five arrested

The Delhi Police IFSO unit said it has busted an interstate cybercrime syndicate accused of siphoning Rs 12.84 crore from the corporate bank account of non-banking financial company Hero FinCorp Ltd. DCP Gaurav Tyagi said the accused made 317 unauthorised transactions and routed the money to 34 accounts. Five people, including a private bank relationship manager, were arrested and about Rs 1.7 crore placed on hold. A case was registered on August 21 following the company's complaint.

Written by AI from Indian Express — Cities · not yet reviewed by an editor · Published 16 Sept 2026, 11:03 pm IST

Source

Indian Express — Cities · read the original report ↗

#cybercrime#delhi police#hero fincorp#fraud#ifso

Desk check · compared with the source

What the desk checked (5)

Rs 12.84 crore was siphoned off from Hero FinCorp Ltd's corporate bank account via 317 unauthorised transactions routed to 34 accounts. — Attributed to Delhi Police IFSO and DCP Gaurav Tyagi; figures appear in source.
Five people, including an RBL Bank relationship manager in Jaipur, have been arrested. — Attributed to police; names and home towns of the five listed in source.
About Rs 1.7 crore has been placed under lien or hold in various accounts. — Attributed to IFSO officers; figure stated as approximate in source.
An accused was in contact with Chinese Telegram groups and proceeds were converted into Tether cryptocurrency and sent abroad. — Alleged by investigators and quoted officer; unverified allegation, suspicion only.
FIR registered on August 21 under BNS sections 308, 318(4), 319 and 340 at Special Cell police station. — Quoted from a police officer; year not specified in source.

Written by AI from Indian Express — Cities · not yet reviewed by an editor · How we use AI · Report an error

Analysts’ view opinion

AI Legal Analyst

This is not framed merely as a hacking case: the FIR invokes Bharatiya Nyaya Sanhita provisions for extortion (308), cheating (318(4)), cheating by personation (319) and forgery (340), suggesting investigators see an organised financial-crime chain rather than a single intrusion. The arrest of a private bank relationship manager is the legally significant element — if the allegation of insider help in opening accounts holds up, it raises questions about KYC and due-diligence obligations. The lien placed on about Rs 1.7 crore is a preservative step; final restitution or confiscation will depend on court orders, not police action.

The structure of 317 transactions routed to 34 primary accounts means the prosecution will likely have to establish criminal intent transaction-by-transaction and account-by-account, not as one undifferentiated offence.
If the alleged conversion of proceeds into Tether and transfer abroad is borne out, the matter could attract money-laundering law, though the story does not state that any such case has been registered.
How much the alleged account-holders (mule accounts) actually knew is the central legal question; the alleged commission payments could become key to proving knowledge and intent.
All five are accused, not convicted, and retain standard procedural rights — remand scrutiny, bail, statutory default-bail timelines and a chargesheet within the prescribed period.
Suspects said to be based abroad, including in Dubai, can typically be pursued only through slower extradition and mutual legal assistance routes.

What to watch — Watch whether a chargesheet is filed within the statutory period, whether courts order the frozen Rs 1.7 crore released to the complainant company, and whether the alleged bank-insider role triggers a regulatory or internal inquiry.

Everything here is a police allegation at this stage — whether the internal server was in fact hacked, where responsibility for any lapse lies, and each accused person's precise role remain to be tested and proved in court.

Deep dive

Research brief · 8 facts · 5 dates · exam-ready

The brief

Context

The Delhi Police's Intelligence Fusion and Strategic Operations (IFSO) unit says it has broken an interstate cybercrime syndicate that siphoned Rs 12.84 crore from the corporate bank account of Hero FinCorp Ltd, a non-banking financial company offering loans. Officers suspect the company's internal server was hacked, after which 317 unauthorised digital transactions were made without the knowledge of the company's management. The money was routed through 34 primary-layer bank accounts, with part of it allegedly converted into the cryptocurrency Tether and sent to fraudsters abroad. Five people, including a private bank relationship manager, have been arrested and about Rs 1.7 crore placed on hold.

Key facts

Rs 12.84 crore was allegedly siphoned off from Hero FinCorp Ltd's corporate bank account, according to Delhi Police's IFSO unit.
Around 317 unauthorised digital transactions were allegedly made and the money routed to 34 primary-layer bank accounts.
A case was registered on August 21 on Hero FinCorp Ltd's complaint at the Special Cell police station.
The FIR invokes Bharatiya Nyaya Sanhita sections 308 (extortion), 318(4) (cheating), 319 (cheating by personation) and 340 (forgery).
IFSO placed a lien or hold on approximately Rs 1.7 crore across various accounts, preventing further diversion.
Five arrested: Abhay Kumar Solanki (Bulandshahr), Lovely (Kurukshetra), Naman Kumar (Jaipur), Harman (Bikaner) and Vikas (Jaipur).
Amounts traced: Rs 60,000 credited to Solanki's account and withdrawn via ATM; Rs 80 lakh into a 'Property Gallery' account at Central Bank of India, Thanesar; Rs 40 lakh into a Yes Bank account and Rs 70 lakh into an IndusInd Bank account operated by Naman.
Naman's second (IndusInd) account was linked to 43 complaints on the National Cybercrime Reporting Portal; recoveries included cheque books, five mobile phones and rubber stamps of 'Property Gallery'.

Timeline

Before the FIR (exact dates not stated in the source)Company's internal server suspected hacked; 317 unauthorised transactions made from Hero FinCorp's corporate account to 34 accounts.
August 21FIR registered at Special Cell police station on Hero FinCorp Ltd's complaint under BNS sections 308, 318(4), 319 and 340.
During investigationIFSO analysed bank account details, mobile phone records and fund flows; placed a hold on about Rs 1.7 crore.
SubsequentlyRaids at multiple locations across the country; five accused arrested.
Wednesday (as announced)IFSO announced the syndicate had been busted; suspects in India and Dubai identified, arrests being pursued.

Who has a stake

Hero FinCorp Ltd — The NBFC that lost Rs 12.84 crore from its corporate account and filed the complaint; recovery limited so far to about Rs 1.7 crore on hold.
Delhi Police IFSO unit — Investigating agency; team led by Sub-Inspector Ankit under ACP Prem Chandra Khanduri and DCP Gaurav Tyagi, tasked with tracing funds and arresting absconders.
The five arrested accused — Face charges under BNS provisions for extortion, cheating, cheating by personation and forgery over operating mule accounts and facilitating transfers.
RBL Bank (through relationship manager Vikas) — A serving relationship manager in Jaipur allegedly helped open accounts and introduced accused to each other, raising insider-risk and KYC questions.
Banks holding the mule accounts (Central Bank of India, Yes Bank, IndusInd Bank) — Accounts in their branches allegedly received crime proceeds; one account was tied to 43 cybercrime portal complaints.
Overseas handlers and Dubai-based suspects — Alleged final beneficiaries via Tether transfers; Chinese groups on Telegram are under scanner, complicating jurisdiction and recovery.

Why it matters

A single suspected server breach allowed 317 transactions to drain Rs 12.84 crore from a regulated NBFC, showing how corporate banking channels and mule-account networks can be exploited at scale. That crime proceeds were converted into Tether and moved to fraudsters abroad, with suspects in India and Dubai, makes recovery difficult and turns a local FIR into a trans-border enforcement problem. The alleged involvement of a bank relationship manager also highlights insider facilitation of account-opening fraud.

UPSC angle

Prelims pointers

IFSO stands for Intelligence Fusion and Strategic Operations, a specialised cybercrime unit of Delhi Police.
The FIR uses Bharatiya Nyaya Sanhita sections 308 (extortion), 318(4) (cheating), 319 (cheating by personation) and 340 (forgery).
Hero FinCorp Ltd is a non-banking financial company (NBFC) offering loan facilities.
Tether is a cryptocurrency linked to the US dollar; it was allegedly used to move proceeds abroad.
The National Cybercrime Reporting Portal recorded 43 complaints against one IndusInd Bank account in the case.
Delhi Police advisory: be cautious of suspicious calls and messages, including 'digital arrest' scams, and report them immediately.

Mains framing

The Hero FinCorp case illustrates the anatomy of large-value cyber financial fraud in India: a suspected intrusion into a company's internal server, rapid layering through 317 transactions into 34 primary-layer accounts, use of mule accounts opened in the names of shell-like entities such as 'Property Gallery' and 'Infirmity Services', insider facilitation by a bank relationship manager, remote control of accounts through an APK file, and conversion of proceeds into dollar-linked cryptocurrency (Tether) for transfer to handlers abroad, coordinated partly through Telegram groups. The causes lie in weak enterprise cyber hygiene around corporate banking access, KYC and account-monitoring gaps that let one account attract 43 separate cybercrime complaints, and the low cost of recruiting commission-based account holders (Harman allegedly earned about Rs 1.5 lakh). Implications include erosion of trust in digital corporate payments, systemic risk to NBFCs, and enforcement difficulty once value is on-chain and beneficiaries sit in Dubai or overseas. The way forward, as the case itself suggests, is faster fund-flow analysis and lien on suspect accounts, tighter bank-side red-flagging of mule accounts and insider accountability, integration of cybercrime portal data with bank monitoring, and cross-border cooperation for crypto tracing and arrests.

Key terms

IFSO (Intelligence Fusion and Strategic Operations): Delhi Police specialised unit that investigates cybercrime and financial cyber fraud; it probed this case under DCP Gaurav Tyagi.
NBFC: Non-banking financial company; Hero FinCorp Ltd, the victim entity here, provides loan facilities as an NBFC.
Mule / primary-layer account: Bank account opened or lent by a person to receive and pass on crime proceeds; 34 such accounts received the siphoned money.
Tether: A cryptocurrency pegged to the US dollar, allegedly used to convert and transfer proceeds to fraudsters abroad.
APK file: An Android application package; Harman allegedly used one to operate another person's bank account remotely.
Lien or hold on accounts: Freezing of funds in suspect accounts by investigators; about Rs 1.7 crore was held to stop further diversion.

Practice questions

Discuss how mule bank accounts and insider facilitation enable large-scale cyber financial fraud in India, using the Hero FinCorp case as an illustration. What regulatory and banking-side safeguards are needed?
Cross-border conversion of crime proceeds into cryptocurrency has weakened traditional investigative tools. Examine the challenges this poses for Indian law enforcement and suggest measures.
What institutional mechanisms exist for reporting and investigating cybercrime in India, and how can coordination between police units, banks and the National Cybercrime Reporting Portal be improved?

Grounded only in the source report — figures and dates are the source's, not inferred.

Next storyRetailers' body flags 0.4% UPI merchant fee from October 15 →

← All stories