Money Laundering Typologies Research in 21st Century - India Perspective-1
The ED targets prevalent money laundering methods, informed by risk analysis and financial intelligence. Key typologies include:
Trade-Based
Money Laundering: Mis-invoicing or false documentation in international trade
to disguise flow of illicit funds.
Shell
Companies: Fictitious entities used to layer proceeds, obscuring ownership.
Real Estate Investments: Illicit funds
integrated into the legitimate economy through property purchases.
Cash-Intensive
Businesses: Retail or construction sectors exploited to mix illegal cash with
legitimate earnings.
These
crime typologies are addressed through close collaboration with FIU-IND and
other law enforcement agencies like the Central Bureau of Investigation (CBI)
and the use of advanced data analytics, enhancing the ED’s detection
capabilities.
Regional Risk Analysis
The FIU-Ind's each of the Regional Office is tasked with analyzing region-specific
risks, considering:
Prevalent
crime types (e.g., drug trafficking, financial fraud).
Social
impact (e.g., community harm).
Socio-economic
factors (e.g., poverty, unemployment).
Regional
Special Directors are tasked with documenting these risk profiles, ensuring
investigations are tailored to local vulnerabilities, which is a critical
enhancement to the ED’s risk-based approach
Information
Collection and Analysis
The
Zones and Sub-zonal offices are responsible for collecting intelligence from
diverse sources, including:
ML-I/ML-II
Reports from Law Enforcement Agencies (LEAs).
Crime
and Criminal Tracking Network & Systems (CCTNS).
Suspicious
Transaction Reports (STRs) from FIU-India.
Open-source
data and public complaints.
Weekly
monitoring of platforms like CCTNS and CBI portals ensures timely detection of
predicate offenses. The officers analyze this information to determine the
presence of money laundering, categorizing cases into various types.
Discreet
Enquiries and File Handling
Discreet
inquiries focus on gathering specific evidence without broad investigations.
Such files may then be:
Merged
with existing cases.
Transferred
to other zones, HIUs, or STFs based on operational needs.
Closed
if no money laundering is evident, and Escalated to ECIR if criteria are met.
Criteria
for Recording ECIRs
The
circular delineates mandatory and non-mandatory criteria for ECIR recording
Mandatory
Criteria:
Directives
from constitutional bodies (e.g., Supreme Court, CVC).
Terrorism
financing or Naxal activities.
Organized
crime under specific laws (e.g., Immoral Traffic Act).
NDPS
Act cases with drug seizures exceeding five times commercial quantities or
syndicate involvement.
Financial
thresholds above a specified value for disproportionate assets cases, quid pro
quo corruption cases, bank frauds cases, Ponzi schemes, or location-specific
thresholds like in the case of metro cities.
Non-Mandatory
Criteria: Cases not meeting mandatory thresholds are evaluated by the Risk
Assessment Monitoring Committee (RAMC)
The
RAMC, chaired by the Special Director (HQ), assesses non-mandatory cases
quarterly, using a risk-based approach to approve or reject ECIR recording. It
also reviews mandatory cases where RSDEs approve non-recording, ensuring
consistency and oversight. Decisions are revisable with adaptability. new
evidence, enhancing
The
guidelines in the internal Technical Circular last revised in 2024 enhance ED’s
ability to prioritize high-risk cases, aligning with the NRA and FATF
standards. By formalizing risk analysis at regional levels and refining case
selection, ED optimizes its investigative capacity, targeting various
typologies with precision.
It
may also be noted that while the circular helps ED evolve a risk based
approach, considering fast proliferation of new risks, the Director ED may
always direct taking up investigations or through referral of new cases to a
Special RAMC.
Risk
analysis remains pivotal to the ED’s mission, enabling a strategic focus on
high-impact cases. The updated 2024 guidelines reinforce this approach,
ensuring the ED adapts to emerging threats while safeguarding India’s financial
system for a secure economic future.
Fraud
has consistently been one of the most common predicate offences for money
laundering. This steady growth stems from the increasing sophistication of
fraudulent schemes as well as greater reporting due to improved detection
methods. While fraud remains a perennial typology of offence for money
laundering investigations, the nature of fraud being investigated by ED has
evolved over the years.
Bank
frauds in India have played a significant role in the rise of Non-Performing
Assets (NPAs), driven by fraudulent activities such as wilful defaults,
misrepresentation of financials, and diversion of funds. High-profile cases
have exposed lapses in due diligence, inadequate monitoring, and occasional
collusion between bank officials and borrowers. Most of these bank fraud cases
were beginning to get exposed post 2014 and there was a sharp rise in gross
NPAs reported by the RBI from FY 2014-15, coinciding with a robust increase in
ED investigations in the subsequent years. Since the ED investigation follows
predicate agency investigation, there would be a time gap of few years between
the identification of fraud and commencement of investigation. ED has responded
decisively by rigorously investigating major bank fraud cases with the
objective of promptly restituting assets to defrauded banks or rightful
claimants. As of March 2025, ED had probed over 1,228 money-laundering cases
related to bank frauds, attached assets worth over ₹80,000 crore, and facilitated
the return of more than ₹23,258 crore to banks. Thus, the role played by the
focussed and proactive approach by ED in contributing to the declining NPA
ratio in Indian banks cannot be understated.
This also underscores a broader strategy of coordinated enforcement between the ED, the Reserve Bank of India (RBI), and other agencies. Moreover, ED's strict enforcement of the PMLA—with stringent bail conditions and a strong deterrent effect against asset misappropriation—further curbs potential frauds, ensuring that new loans are less likely to turn into NPAs. Thus, strong actions by ED including attachment and restitution in many cases related to bank frauds have made such endeavours a zero-sum game for perpetrators and as can be seen from the trends represented above, incidences of such cases have drastically come down. Fraud still accounts for a substantial portion of money laundering cases, mainly due to rise of other types of frauds such as cyber frauds and investment scams. This also underscores a broader strategy of coordinated enforcement between the ED, the Reserve Bank of India (RBI), and other agencies. Moreover, ED's strict enforcement of the PMLA—with stringent bail conditions and a strong deterrent effect against asset misappropriation—further curbs potential frauds, ensuring that new loans are less likely to turn into NPAs.
Real
estate fraud cases have also been a major risk area fuelled by a booming
property market, where rising prices and demand create opportunities for scams
like fake titles or investment frauds wherein the home buyers are cheated. The
sector’s attractiveness for money laundering also plays a key role. As real
estate activity grows, so does its vulnerability, indicating a need for
stricter regulations to curb any fraud.
While
the risk of bank and real estate fraud maybe coming down, the risk for cyber
and crypto related fraud has been drastically rising in recent years. This
sharp increase aligns with the rapid growth of digital currencies and online
transactions, which have opened new avenues for crimes like hacking,
ransomware, and cryptocurrency scams. The steep rise highlights how quickly
these threats are evolving, driven by technological advancements and the
anonymity of digital platforms, posing a significant challenge for ED to keep
pace.
The
data for corruption cases makes it evident that corruption remains a complex
issue, and ED is committed to keep the focus on rooting it out.
These
trends reveal a dynamic landscape for ED investigations. Declines in bank fraud
and real estate frauds suggest enforcement successes, while sharp rises in crypto/cyber
fraud and real estate fraud point to emerging challenges driven by technology
and economic growth. ED always endeavours to evolve and improve its strategies
to address these shifting patterns effectively.
In a
major bank fraud case investigated by ED under PMLA, certain entities, through
their directors defrauded a consortium of Public Sector banks by availing
credit facilities with the help of forged document and manipulating books of
account. The accused company had availed thousands of crores as loan using this
method in the name of capital expansion and for purchase of fixed assets.
Later, the accused company defaulted in repayment of the loan to the consortium
of banks.
Investigation
revealed that the loan amount taken from consortium of banks were routed to
sister concerns and the advances outstanding shown in the Balance Sheet were
written off and capitalized and added to the fixed assets. The funds were
subsequently used to acquire multiple real estate properties valued at over
thousands of crores. In this case, searches were conducted at more than 40
locations belonging to the accused company, its directors, and associates. The
search led to identification of several benami companies with high value real
estate assets along with seizure of ₹2.53 Crore held in hidden private lockers,
jewellery of more than ₹ 1.1 Crore and incriminating documents related to
siphoning of loan funds.
During
the investigation assets worth ₹ 5115.31 crore were attached on 05.09.2024 and
assets worth ₹ 557.49 crore were attached on 26.03.2025. One of the promoters
of the accused company was arrested on 09.07.2024 and a prosecution complaint
was filed on 06.09.2024.
A
CLOSER LOOK AT THE RISING RISK AREAS
Cybercrime
in the modern digital era has increased significantly. As per NCRB data,
cybercrimes have risen over 30% between 2020 and 2022. Further, as per the I4C,
Indians lost ₹1750 crores in just the first four months of 2024 – with 85% of
all cyber complaints registered arising from online financial fraud. The
increasing threat from cybercrime arises due to large scale digital adoption
through mobile phones decoupled from the concomitant digital and financial
literacy of the populace. Cyber criminals exploit this vulnerability through
multiple ways and the modus operandi of the criminals are detailed below.
There
are 122 cybercrime cases being investigated by ED currently involving Proceeds
of Crime (PoC) to the tune of ₹20462 crores in which properties worth ₹5964
crores have been attached. During investigation in these cases, a total of 96
individuals were arrested and 58 Prosecution Complaints (including
Supplementary PC) have been filed before jurisdictional Special Courts. 6
persons were also convicted in 2 cases
Data
submitted by the Finance Ministry to Parliament in March 2025 showed that
people lost a combined 1.77 billion rupees ($20.3 million) to fraud in the
fiscal year ended March 2024, more than double the amount of fiscal 2023.
Various
Types of Cyber Crimes
“Pig
Butchering”: A Long-Term Deception Pig butchering, is a sophisticated scam that
blends romance scams with investment fraud, particularly targeting
cryptocurrency investments. The scam's name reflects the process of
"fattening" the victim with trust before "slaughtering"
them financially.
THE
FLOW
The
fraudster and victim ("pig") usually meet online The scammer works at
gaining the trust ("fattening up") the victim The fraudster directs
victim to go to a private messaging service/app and fraudster will assist The
scammer convinces the victim to invest, what to do and where to deposit the
money The victim loses the investment. The money is gone as well as trusted
friend ("the slaughter")
THE
PROCESS
Starts
with the scammer: Often making contact with the targets over long periods of time
and seemingly at random; Then gaining trust before ultimately manipulating
their targets into phony investments and disappearing with the money/funds.
THE
INTRODUCTION
The
scammer may start off with a wrong number text, email, social media platforms,
or dating applications Take their time to set the "hook" or build the
connection Incorporates a romance scam with a long-term twist or even affinity
fraud
THE
RELATIONSHIP
Meet
online and build the relationship Relationship grows over time (possibly becoming
romantic) Getting to know financial wants and fears Introducing you to online
investments Talk of cryptocurrency and making money long-term
OTHER
SCAMS INVOLVED
Romance
Scam-Developing a romantic relationship Affinity Fraud-Through a trusted
community member(s) Through an unexpected or random connection with online apps
or websites
The
staggering financial impact across the world is underscoring their global reach
and the involvement of organized crime, often linked to fraud factories in
Southeast Asia.
Phantom
Hacking: Targeting the Vulnerable
Phantom
hacking, also referred to as the "Phantom Hacker" scam, is an
evolution of tech support scams, particularly targeting vulnerable or senior
citizens. This is identified as a growing threat, with significant financial
implications for victims.
The
detailed steps include:
Initial
Contact: Scammers pretend to be tech support representatives, contacting
victims via phone or email, often unsolicited. This initial contact leverages
the victim's potential lack of technical knowledge.
The
detailed steps include:
Software
Download: Victims are instructed to download software, which grants scammers
remote access to their computers. This step is critical, allowing scammers to
manipulate the victim's system.
Fake
Hacking Proof: Using remote access, scammers "prove" the computer is
at risk, showing fabricated alerts or logs to create urgency. This tactic preys
on vulnerability and fear
Financial
Account Access: Scammers request access to the victim's financial accounts,
claiming to check for unauthorized charges, further eroding trust in legitimate
systems.
Pose as Financial Institution: They then pose
as representatives from the victim's bank, instructing them to move money to a
third-party account, which is controlled by the scammers.
Pose
as Government Agency: In some cases, scammers may impersonate government agency
employees to add legitimacy, enhancing the scam's credibility.
A
sub category of these type of scams wherein they pose as Government Agents or
Police Officers which is widely prevalent in India currently:
“Digital
Arrest” Scams
Con
artists impersonate law enforcement or regulatory officials to extort money
from innocent people. The fraudsters contact victims (usually by phone or
through messaging apps) and pretend to be from the police, CBI, Customs, or
another LEA. They accuse the victim of some made-up crime – for example, say
that a package in the victim’s name was found with illegal items, or their bank
account was linked to a crime – and then threaten immediate arrest. The victim,
thrown into a panic, is then instructed to pay a large sum (a “penalty” or
“bail” amount) to resolve the issue quietly. The typical modus operandi in such
cases is as follows:
Impersonating
Authorities: The scammers usually initiate contact by calling the victim,
sometimes using spoofed phone numbers that appear as official helplines or
police stations.
Fabricated
Evidence & Websites: To further convince victims, these scammers use fake
documents and websites. They may email the victim an official-looking notice or
arrest warrant with government logos. In some cases, they direct the person to
a fraudulent website that mimics a government portal.
Threats
and Urgency: The defining feature is the use of fear. The scammer will typically
say something like, “You will be arrested within hours if you don’t act”. This
creates a sense of urgency and panic.
Payment
under Duress: Finally, the impostor “officer” demands money as the way out.
This is usually framed as a fine, fee, or security deposit to cancel the arrest
warrant or charges.
Layering
through Mule Accounts, Conversion to Crypto, & Integration: In the CEZO
case, it was found that criminal proceeds from victims were funneled through
layers of mule accounts, and later partly withdrawn in cash, and partly
converted to crypto and siphoned abroad.
Illegal
Online Gaming, Betting, & Gambling
These
cases involve unauthorized online betting platforms that lure users to gamble
on sports or casino-style games. For instance, Fairplay app live-streamed IPL
cricket matches without permission to facilitate betting, causing huge losses
to the official broadcaster (Star India). Another syndicate led by promoted
.apk files of online games which lured users into registering and crediting
funds in their online wallet to play such games with he promise of large
returns, generating over ₹400 crores in criminal proceeds. The typical modus
operandi in these cases is as follows:
Unregulated
Apps & Websites: Fraudsters create betting apps and websites and promote
them via social media and (Telegram, messaging WhatsApp) platforms as “online
gaming” to attract users. These apps are not registered or licensed, and are
often hosted overseas. Rigged Games & Scams: The platforms often have
rigged algorithms ensuring the house wins in the long run. Victims may win
small amounts initially to build trust, then steadily lose larger sums.
Use
of Mule Accounts: Players are instructed to deposit money via instant payment
methods (UPI/IMPS) into bank accounts that are not under the company’s name.
These are mule accounts held by individuals or shell entities used to collect
aggregate funds from users.
Reliance
on Payment Aggregators: Mule accounts are listed as merchants before various
payment aggregators like RazorPay or PayU, allowing for collection of PoC in
pool accounts, obfuscating the link to the organizers and makes it hard for
authorities to trace the flow directly to the accused.
Domestic
Layering: Once funds are collected from victims, the money is rapidly moved
through numerous bank accounts. In the Fairplay case, hundreds of mule accounts
were involved, with funds being transferred in circuitous patterns. Eventually,
large sums accumulate in a few shell companies (some even masquerading as
legitimate businesses, such as a shell pharmaceutical company in Mumbai).
Siphoning
Abroad: From the shell companies, money is siphoned abroad. This is done either
by buying cryptocurrency and transferring it overseas, or through bogus import/
export transactions.
Integration
as Legitimate Funds: Laundered funds are often brought back into India as
seemingly clean money. In many instances, the criminals reinvest their illicit
earnings into real estate, luxury assets, or even channel it back as bogus
Foreign Direct Investment (FDI) in businesses they control (as in the OctaFX
case). By doing so, the money re-enters the economy as though it were legitimate
investment capital or business profit. For example, launderers have used
overseas shell companies to send money back to India in the form of share
capital or investment in startups, thereby “regularizing” the tainted money as
if it were an outside investment.
Instant
Loan Apps – Targeting the Vulnerable and Poor
This
typology involves mobile apps that offer “instant loans” targeting people in
urgent need of money. The scheme typically involves a consortium of Chinese
seed capital, NBFCs, Fintech Companies, and Payment Aggregators. Shinebay
Technologies, for example, operated a suite of loan apps (LoanPro, FastCredit,
SmartRupee, etc.) that lent money at exorbitant interest rates for terms of
7-to-15 days. Borrowers across India, often desperate or financially
unsophisticated, fell into a debt trap, and many people faced harassment when
they could not repay on time. The typical modus operandi in these cases is as
follows:
Unregistered
Fintech Apps: The loan apps are not registered as banks or proper lenders.
Instead, the operators set up shell fintech companies in India – often
incorporating many companies at once using hired locals as fronts. These
companies release mobile apps on Android (often outside official app stores to
avoid scrutiny) and aggressively advertise on Facebook, Instagram, Telegram
etc., to attract borrowers. The apps promise quick, hassle-free loans with
“low” documentation. However, in reality, they charge extremely high interest
and fees (effective interest rates can exceed 300% annualized). Shinebay’s
apps, for instance, had interest around 22% for just 7-15 days loan plus heavy
processing fees.
Data
Theft & Extortion: As a condition of use, these apps ask for extensive
permissions on the user’s phone. Once installed, they harvest the borrower’s
contacts, photos, messages, and other personal data. If the user defaults,
recovery agents weaponize this personal information for harassment and abuse
against the borrower.
Partnership
with NBFCs: Because these fintech apps themselves cannot get a lending license;
they partner with registered Non-Banking Financial Companies (NBFCs) to
piggyback on their licenses. They sign MOUs where the fintech company claims to
just be a “tech service provider” for the NBFC, but in practice the entire lending
operation is run by the fintech firm. The fintech company funds the loans
(often channeling the FDI funds received by it into NBFCs as loans) and merely
routes the money through the NBFC. The NBFC earns a commission for allowing its
license to be used, while not actually risking its own capital. This
arrangement helps the illegal loan business appear somewhat legit on paper
(loans show up on NBFC books), all while evading RBI oversight.
Layering
and Integration: Follows a similar modus operandi as discussed above in other
case-types, often channeled into cryptocurrencies funneled back to the source
country which was often found to be China.
Spoofing:
A Versatile Technique in Cyber Attacks
Spoofing
is not a standalone cyber-crime but a technique used across various attacks,
involving disguising communication from an unknown source as trustworthy. It
encompasses several types, each with distinct applications in cyber-crime:
Email
Spoofing: Attackers forge the sender's address to appear as a legitimate entity,
commonly used in phishing attacks. For example, a fake email from a bank might
prompt users to enter login credentials on a malicious site.
DNS
Spoofing: Corrupting DNS data to redirect traffic from legitimate websites to
fake ones, potentially stealing login credentials or installing malware, a
tactic noted in cybersecurity reports for its impact on online trust.
IP
Spoofing: Faking IP addresses to impersonate another device, often used in
Distributed Denial of Service (DDoS) attacks to hide the attack's source or
bypass access controls, as seen in network security breaches.
Caller
ID Spoofing: Faking caller IDs to conduct voice phishing (vishing), where
scammers pose as trusted entities like banks to extract sensitive information.
Source: Fiu-Ind Annual Report 20245-25
While
specific statistics on spoofing are broad, its prevalence is evident in the
rise of phishing and DDoS attacks, with general cybersecurity awareness
emphasizing its role in modern threats.
Source: Fiu-Ind Annual Report 2024-25
In a
sophisticated cyber scam investigated by ED under the Prevention of Money Laundering
Act (PMLA), fraudsters lured victims with fraudulent initial public offering
(IPO) allotments and stock market investment schemes through deceptive apps,
promising substantial returns. They also coerced victims using a "digital
arrest" tactic, impersonating law enforcement officials to intimidate them
into transferring large sums under the pretense of a fake "fund
regularization process."
The
scammers leveraged social media platforms, particularly WhatsApp, creating fake
websites and misleading groups that mimicked legitimate financial firms. They
built trust through fabricated success stories and advertisements, convincing
victims to invest heavily.
Proceeds from the scam were laundered through
24 shell companies in Tamil Nadu and Karnataka, established with fake documents
and registered at co-working spaces with no genuine operations. Mule accounts
were utilized to obscure the trail of illicit funds, which were ultimately
converted into cryptocurrency and transferred overseas. The operation was
masterminded by individuals in Laos, Hong Kong, and Thailand, who collaborated
with Indian associates to set up these shell entities using counterfeit
documents shared via WhatsApp.
The
ED’s investigation triggered searches at 19 locations, resulting in the seizure
of incriminating documents and electronic devices, the freezing of Rs. 2.81
crore in a bank account, the arrest of 08 individuals, and the filing of
prosecution complaints on October 10, 2024. This case, built on multiple FIRs
from LEAs across India, exposed a widespread network targeting numerous victims
nationwide.
Digital Arrest
In a case initiated by an FIR registered with State Police, a senior citizen from Chennai was defrauded of Rs. 33 Lakh by scammers employing fake allegations and the threat of a "digital arrest." The scam began with a call from a woman claiming to be from Mumbai, alleging that the victim’s bank account with SBI was being misused for money laundering. Subsequently, the victim received a WhatsApp call from a person posing as another victim of the same money laundering gang, who urged her to speak with a supposed prosecutor named Ganapathy Iyer. The "prosecutor" then contacted her, instructing her to close all her fixed deposits (FDs) with Central Bank of India and transfer the funds to a specified account.
Source: Fiu-Ind Annual Report 2024-25
Cryptocurrency Fraud
In a
sophisticated cryptocurrency fraud case, ED launched an investigation following
a newspaper report detailing Mr. X’s imprisonment in the USA for defrauding
victims of over $20 million. The scam, which targeted hundreds of individuals,
involved the use of spoofed websites mimicking legitimate cryptocurrency
exchanges, leading to significant financial losses.
The
modus operandi centered on manipulating search engine optimization to ensure
spoofed websites appeared atop search results, closely resembling trusted
platforms except for altered contact details. Victims entering login
credentials on these fake sites encountered errors, prompting them to call a
listed number that connected them to a call center operated by Mr. X. This
enabled him to hijack their accounts, transfer their cryptocurrency to wallets
he controlled, and sell the assets on localbitcoins.com. The proceeds were
converted to INR via Indian crypto exchanges and funneled to his family
members. The ED’s response included searches that led to the freezing of Rs.
2.18 Crore in bank balances linked to Mr. X’s family, underscoring the
cross-border reach of this illicit operation
Source: FIU-Ind Annual Report 2024-25
In a
crypto currency fraud case, an entity had cheated large public in India and
abroad in the name of crypto currency investment. In the fraud, investors were
misled into investing through a digital currency platform promoted through a
lending program. The platform claimed to use a proprietary trading bot and
volatility software to generate high and guaranteed returns on the investment.
These claims were promoted through social media and multi-level marketing
strategies.
Investigations by ED revealed that no such
trading system or bot existed and that investor funds were misappropriated
through a network of cryptocurrency wallets. Subsequently after gathering
data/intelligence regarding the perpetrators of the scam, assets worth ₹ 489
crore were attached in April 2024. Further, searches were also conducted
against the perpetrators of the fraud resulting in seizure of bitcoins valued
at ₹ 1646 crore, along with cash, a luxury vehicle, and several digital
devices.
This post is based on FIU-Ind Annual Report 2024-25
Those who read this, also read
1. Money Laundering Typologies Research in 21st Century - India Perspective-2
3. Anti-Money Laundering- Definitions, Origins
4. Financial Intelligence Unit(FIU-Ind)
Comments
Post a Comment