Surat, Oct 24 — Two men allegedly linked to an international cybercrime network operating from Dubai have been arrested by Surat City Police in an investigation into online fraud estimated at Rs 410 crore across 338 complaints registered in 20 states and Union Territories, police said on Saturday.
The investigation began after a complainant was allegedly duped of Rs 23.38 lakh through fake share-trading applications named HB Ultra and IISL Sec.
The accused allegedly promised high returns, persuaded the complainant to open a trading account on the applications and induced transfers to multiple bank accounts before preventing withdrawals.
A case was registered at the Cyber Crime Police Station under Sections 318(4), 336(2), 338, 336(3), 340(2), 61(2) and 3(5) of the Bharatiya Nyaya Sanhita, 2023, and Section 66(D) of the Information Technology Act, 2000, as amended in 2008.
The arrested men have been identified as Abdul Rehman, 23, a civil engineering student who is pursuing his second year at Kaunas University of Technology in Lithuania, and Mohsin Khan alias Tuksu, 38, who worked as a labourer in the catering sector.
"Both were apprehended near Civil Char Rasta in Surat on October 22 following three to four days of technical investigation," police said.
Rehman had returned to India three months ago and had travelled to Dubai once, according to the police. Mohsin Khan is originally from Sheikhpura village in the Khatauli police station area of Muzaffarnagar district of Uttar Pradesh.
Investigators allege that Rehman established a fake firm, Mansuri Digital Trading, in Mohsin Khan's name to facilitate the movement of money obtained through cyber fraud.
The firm allegedly used accounts across Central Bank of India, Bank of Maharashtra, Canara Bank and Axis Bank, with police stating that four current accounts were opened across the banks, along with 12 savings accounts.
Police further alleged that Rehman worked for a Chinese cybercrime gang operating from Dubai.
He allegedly arranged mule bank accounts to receive fraud proceeds, converted the money into USDT cryptocurrency and transferred it to the gang through wallets registered in other people's names in exchange for commissions.
He also allegedly received commissions for arranging the accounts. "An account of Mansuri Digital Trading at the Central Bank of India recorded transactions totalling Rs 1.19 crore between August 24 and September 16, 2026. An initial check of the National Cyber Crime Reporting Portal showed 18 online complaints across different states linked to this account," officials said.
A search of Rehman's iPhone reportedly yielded details of 96 bank accounts, 30 debit cards issued in different individuals' names, applications of 13 banks and login details for 11 email IDs.
Investigators also found Telegram chats indicating communication with members of the alleged Chinese gang over the past year.
Two USDT wallets found on the phone had recorded transactions worth Rs 19.14 lakh.
Police also seized 12 mobile phones, 17 debit cards issued by Lithuanian and Indian banks, and two cheque books during a search of the accused's residence. Four mobile phones among the items were also recovered from the accused.
According to the police, the National Cyber Crime Reporting Portal showed 338 complaints across 20 states and Union Territories linked to the bank accounts recovered during the investigation.
Maharashtra accounted for 66 complaints, followed by Karnataka with 51 and Tamil Nadu with 49. Uttar Pradesh had 22 complaints, and Gujarat had 19.
The remaining complaints were reported from Andhra Pradesh, Kerala, Delhi, Odisha, Madhya Pradesh, Punjab, Rajasthan, Uttarakhand, Meghalaya, Bihar, Jharkhand, Assam, Telangana, Haryana and West Bengal.
The police estimated that the complaints involved online fraud of approximately Rs 410 crore. The investigation is continuing to establish the full extent of the network's operations.
Surat City Police have urged residents not to allow others to use their bank accounts in return for commissions or other financial inducements, warning that account holders could face legal action if their accounts are used to route proceeds of cybercrime.