Malaysian couriers allegedly used to route fraudulently activated SIM cards to Cambodian cybercrime operators

Massive Probe Triggered

The Enforcement Directorate has cracked open what investigators are calling one of the more elaborate cross-border cyber fraud operations linked to India in recent years. Acting under the Prevention of Money Laundering Act, the agency conducted raids across seven locations in Rajasthan and Punjab beginning June 5 — targeting a network that allegedly funnelled thousands of Indian SIM cards to Cambodia, where criminal outfits used them to run large-scale scams against Indian citizens.

The investigation was triggered by an FIR registered at the Jodhpur Cyber Police Station. Search operations spanned Kishangarh, Nagaur and Jodhpur in Rajasthan, as well as Ludhiana in Punjab. Agencies seized documents, digital evidence, multiple electronic devices and 14 mobile phones during the raids.

36,000 SIM Cards, 5,300 Fraud Links

The scale of the operation only became clear once investigators began analysing mobile data. Of roughly 2,30,000 suspicious numbers put under the scanner, nearly 36,000 Indian SIM cards were found to be active in Cambodia. Around 5,300 of those were directly traceable to cyber fraud cases filed in India — numbers used to facilitate scams running into hundreds of crores of rupees.

That's not a small leak in the system. It points to a sustained, organised supply chain that kept pushing Indian mobile numbers into foreign hands over a significant period.

How the Racket Was Structured

According to the ED, SIM vendors at the centre of this network exploited their access to telecom Point of Sale IDs to sign up targets. People — often from less educated or economically vulnerable backgrounds — were approached with offers of free SIM porting or new connections. What followed was straightforward but brazen: additional SIM cards were activated using the same documents, without the individuals' knowledge or consent.

Those extra SIM cards were then handed over to Malaysian nationals, who acted as couriers moving the cards out of India and into Cambodia. Once there, cybercrime operators used the Indian mobile numbers to carry out "digital arrest" frauds and various other online cheating schemes — all while appearing to contact victims from what looked like legitimate Indian numbers.

The 'Digital Arrest' Angle

The use of Indian SIM cards for digital arrest scams is particularly significant. In these frauds, callers impersonate law enforcement officials — CBI officers, customs agents, narcotics bureau personnel — and tell victims they are under investigation. Victims are kept on video calls for hours, sometimes days, told not to speak to anyone, and pressured into transferring large sums of money. The use of Indian mobile numbers lends the scam a veneer of credibility that makes victims less likely to hang up.

Having a local number flash on the screen has, in several documented cases, been the difference between a victim falling for the fraud or suspecting something off.

Rajasthan and Punjab in Focus

The geographic spread of the raids — covering both Rajasthan and Punjab — suggests the SIM activation network was not concentrated in one place. Kishangarh and Nagaur in Rajasthan, alongside Ludhiana in Punjab, are all areas with active telecom retail ecosystems, making them viable bases for POS-level fraud operations.

The ED has not yet named specific accused publicly, but the seizure of 14 mobile phones alongside digital evidence suggests the agency is working to establish communication chains and financial trails that could expand the scope of arrests.

What Comes Next

With money laundering charges in play, the ED's focus will likely shift toward tracing proceeds from the fraud network — identifying how payments moved from victims to the Cambodia-based operators, and whether any funds were repatriated or laundered through Indian accounts. Given the PMLA framework, asset attachment proceedings could follow as the investigation deepens.

For ordinary SIM card holders, the case is also a reminder that documents submitted even for routine telecom requests can, under the right conditions of negligence or fraud, end up enabling crimes thousands of kilometres away.

Raipur has been quietly earning a dangerous reputation. Just as Jamtara in Jharkhand became synonymous with phone scams a decade ago, Chhattisgarh's capital is now at the centre of a sophisticated, international cyber fraud operation — masterminded from Ahmedabad, Gujarat, and executed floor by floor in two Raipur commercial complexes.

In a major overnight operation on March 26, the Anti Crime and Cyber Unit of Raipur Police raided three illegal call centres operating from Pithaliya Complex in Subhash Nagar and Anjani Tower in New Rajendra Nagar. A total of 42 accused were arrested. Seized from their possession were 67 mobile phones, 18 laptops, 28 computer sets, and 3 Wi-Fi routers — devices collectively valued at over ₹16.53 lakh.

The Mastermind Sits in Ahmedabad

This was no fly-by-night operation. According to police, the entire network was controlled by masterminds based in Ahmedabad, Gujarat, who recruited supervisors on a monthly salary of ₹30,000 plus a 2% commission on every successful fraud. These supervisors in turn hired agents at ₹15,000 per month to make calls to the United States of America.

Three supervisors — identified as Rohit Yadav (alias Anil Kumar Yadav), Gaurav Yadav, and Saurabh Singh — ran the day-to-day operations across the three call centres. The masterminds, police say, remain at large and a hunt is on.

How the 5-Step Scam Worked

What makes this case remarkable is the clinical, assembly-line precision of the fraud. Police laid out a five-stage process during interrogation:

Step 1 — Target Acquisition: Employees sourced data of Americans who had applied for bank loans via WhatsApp and Telegram groups. Using scripted English prompts displayed on screen, they contacted these targets via internet calling apps, posing as loan officers.

Step 2 — Trust Building: Once a target expressed interest in a loan, agents collected their full bank account details and passed them up the chain. A "deposit team" then told the victim their credit score (CIBIL equivalent) was poor but could be fixed — and asked them to wait for a callback.

Step 3 — Fake Cheque Deposit: A technical group, reportedly operating from China, used the victim's account details to prepare a cloned cheque and deposit it into the victim's account. Foreign banks, following standard short-term credit practices, immediately credited small amounts — typically $100 — pending a 48-hour verification. The scam exploited this window.

Step 4 — The Hook: The calling group rang the victim back: "Your credit score has been fixed. We deposited $100 into your account to prove it — please check." The victim verified the amount, delighted. The gang then said: "That money belongs to our company. Please return it via gift card."

Step 5 — Cash Out and Hawala: Victims willingly purchased Apple, Google, Amazon, Crafin, or other gift cards and shared the card codes with the gang. A dedicated "redemption group" — again reportedly linked to China — instantly converted these cards into cash. The money then travelled back to the Ahmedabad masterminds via hawala channels.

The China-based technical group reportedly took a 10% cut of every successful fraud for their cloning and cash-out services.

'Digital Arrest' Used to Terrorise Victims

Beyond the loan scam, police also found fake arrest warrants prepared on the computers at both locations. These were used to terrorise victims who hesitated or asked questions — a tactic known as "digital arrest," in which fraudsters impersonate law enforcement officers and threaten immediate legal action unless payments are made immediately.

Prime Minister Modi had publicly warned about digital arrest scams in a Mann Ki Baat address last year. That this tactic was being actively deployed from Raipur underlines how widespread the problem has become.

Who Are the Accused?

The 42 arrested span multiple states. While the supervisors and several key operatives hail from Ahmedabad and other parts of Gujarat, rank-and-file employees were recruited from Uttar Pradesh (Prayagraj, Itawa, Deoria), Bihar, Punjab, Haryana, Maharashtra, Meghalaya, and Chhattisgarh itself. Most are between 19 and 35 years old.

During interrogation, the accused admitted they were fully aware the activities were illegal but were drawn in by the combination of a fixed salary and performance-based incentives tied to fraud amounts.

Cases have been registered under multiple sections of the Bharatiya Nyaya Sanhita (BNS) — including sections 61(2), 112(2), 316(2), 318(4), 319(2), 336(3), 337, 338, and 340(2) — as well as Sections 66(C) and 66(D) of the Information Technology Act.

A Warning for Job Seekers

This case carries a message beyond crime reporting. Many of the accused were young people from modest backgrounds, recruited with the promise of a "call centre job" in Raipur — with no clear explanation of who they would be calling or why. Several were living in rented flats together, clearly housed and managed by their handlers.

At a time when youth unemployment remains high and call centre work is seen as respectable urban employment, organised crime networks are actively exploiting that desperation. If a job offers unusually high commissions for making calls to foreigners with scripted English dialogues — and asks no questions — it almost certainly is not legitimate.

The Ahmedabad-Raipur-China Triangle

What Raipur Police have uncovered is not just a local crime story. It is a transnational cyber fraud pipeline with tentacles stretching from Ahmedabad to Raipur to the United States — with China-based technical operators providing the cloning and cash-out infrastructure. The masterminds remain free. The investigation is ongoing.

Raipur has enough going for it — as a growing capital city in the heart of India — to not want this kind of notoriety. The question now is whether law enforcement can follow the money all the way back to Ahmedabad, and beyond.