Gujarat's Gandhinagar Cyber Crime Centre of Excellence has arrested a 25-year-old man from Assam's Barpeta district, identified as Rafiqool Alam (also recorded in some official documentation as Rafiq-ul-Alam Mohammad Ali), describing him as the key financial operator of an international "digital arrest" cybercrime network. Investigators say the network has been linked to 1,090 cybercrime cases across India involving fraud proceeds exceeding Rs 1,071.55 crore, with money laundered through more than 1,700 bank accounts and converted into cryptocurrency for transfer to members of a Chinese criminal network.
Background
The case is a reminder that the geography of cybercrime rarely matches the geography of policing: a Gujarat-based force investigating Gujarat victims ended up making an arrest in a rural district of Assam more than 2,500 kilometres away, underscoring how thoroughly these networks operate across, rather than within, state or even national lines, and why inter-state police coordination has become as central to fighting this category of crime as any single force's own cyber cell.
"Digital arrest" scams have become one of the most damaging categories of cybercrime in India over the past two years, with Indians reported to have lost roughly Rs 2,140 crore to the tactic over an 18-month stretch through 2024-2026. The scam works by impersonating law enforcement or investigative agencies: victims receive a call claiming their Aadhaar number, bank account, SIM card or a courier parcel linked to them is tied to criminal activity, often something serious-sounding like money laundering or narcotics smuggling. The caller, posing as a police officer or an agency official, then escalates to a video call — frequently using studio setups styled to resemble police stations or government offices, complete with uniforms, official-looking seals and scripted procedural language — to make the threat appear real and psychologically overwhelming enough that victims comply rather than pause to verify. Victims are told they are under investigation and, in some cases, shown forged arrest warrants or court documents, then pressured into transferring money to "prove innocence" or avoid an actual arrest. There is no such legal concept as a digital arrest under Indian law: no agency can arrest, detain or extract money from anyone via a video call, a fact regularly reiterated in government advisories on the scam, including a direct I4C statement that CBI, police, customs, the Enforcement Directorate and judges do not arrest anyone over a video call under any circumstances.
What makes networks like the one Rafiqool Alam is accused of financially operating particularly hard to dismantle is the layered, deliberately compartmentalised structure separating the callers who directly threaten and manipulate victims from the financial operators who launder and move the resulting money — often through entirely different states or even countries from where the calls originate, so that the arrest of any single participant rarely exposes the network's full chain of command. This case fits a broader, uncomfortable pattern regional law enforcement has flagged repeatedly in recent months: Assam districts serving as recruiting or operational bases for financial-handler roles in nationally scaled cyber fraud networks, even when the victims and the ultimate beneficiaries are located far away in different states or overseas.
India's institutional response to this specific category of fraud has scaled up considerably in recent years as case volumes and reported losses have both climbed. The Ministry of Home Affairs set up the Indian Cyber Crime Coordination Centre (I4C) as a scheme in 2018, formalising it as an attached MHA office from July 1, 2024, to coordinate prevention, detection, investigation and prosecution of cybercrime nationally. Its Citizen Financial Cyber Fraud Reporting and Management System, launched in 2021 and accessible via the 1930 helpline and the National Cybercrime Reporting Portal, is designed so that when a victim reports a fraudulent transaction quickly enough, a ticket is relayed in near-real time to the banks, wallets and payment intermediaries involved, putting a hold on the flow of stolen funds before it fully disperses — a system credited with freezing thousands of crores of rupees in attempted fraud, and one report indicates roughly 450,000 mule bank accounts have been frozen nationally as part of the broader crackdown on this laundering method. I4C has also issued direct public advisories stating plainly that "CBI/Police/Custom/ED/Judges DO NOT arrest you on video call," the same core message reiterated across government cybercrime awareness campaigns.
Assam's connection to large-scale, internationally linked cybercrime networks is, notably, not limited to this single case. Morigaon district — roughly 100 kilometres from Barpeta — has separately emerged as what regional reporting has described as a covert operational hub for one of the country's largest organised cybercrime networks, with investigators there tracing links to handlers based in Pakistan and Southeast Asia, distinct from the Chinese-network connection alleged in Alam's case — a reminder that Assam's exposure to this problem is not tied to any single foreign actor but reflects a broader vulnerability exploited by multiple, unrelated international fraud operations. Assam police operations targeting that Morigaon-centred network have resulted in more than 300 arrests, recovery and return of nearly Rs 2 crore to victims, and the seizure and deactivation of over 72,000 SIM cards in what was described as the largest SIM-related cybercrime operation in the state's history. Taken together with the Barpeta arrest, these cases point to a pattern regional law enforcement is increasingly having to reckon with: multiple districts within Assam functioning as recruitment and operational bases for the financial-handler layer of cybercrime networks whose command structures and ultimate beneficiaries sit outside India entirely.
Key Details
- The arrest: Rafiqool Alam, 25, of Barpeta district, was arrested after Gujarat police conducted technical analysis followed by a three-day reconnaissance operation carried out in disguise — a deliberately slow, undercover approach rather than an immediate raid, reflecting the sensitivity of moving on a suspect embedded in a local community far from the investigating force's home state — before raiding his residence in Barpeta and seizing technical gadgets used in the operation.
- The scam's script: The network allegedly posed as police officials, using forged letters purportedly from Maharashtra Police and the Supreme Court to intimidate victims into believing serious criminal cases had been registered against them, before placing them under a fabricated "digital arrest" via video call and pressuring them into transferring money.
- Moving the money: Investigators say the network split fraud proceeds across 1,754 bank accounts within a single hour to evade detection — a scale and speed of transaction-splitting that points to a highly automated or well-organised mule-account network rather than manual, case-by-case laundering.
- Converting to crypto: Funds were converted into cryptocurrency using an application investigators identified as "Chip Seller," with gaming platform accounts also used as a channel for financial transfers, before the crypto proceeds were sent on to members of a Chinese criminal network.
- Direct contact with Chinese handlers: Alam allegedly exchanged financial and operational information directly with Chinese counterparts via WhatsApp and Telegram, including scanner details, account passwords and cryptocurrency wallet information — indicating an active, ongoing operational relationship rather than a one-off transaction, and suggesting he held a position of real trust within the network's hierarchy rather than acting as a disposable, low-level mule handler.
- What was recovered: Investigators traced 23 cryptocurrency wallets connected to the network, showing roughly Rs 16 crore in transactions — a figure that represents only a fraction of the Rs 1,071.55 crore total the network is alleged to have handled across its full 1,090-case footprint, illustrating how much of the money trail likely remains untraced even after a significant arrest.
- How the case broke open: The investigation began after police received information about a senior-citizen victim; officers first counselled the individual before beginning a technical investigation, which surfaced approximately 10 simultaneous ongoing cases. Police say they were able to reach some potential victims' homes in time to prevent further fraudulent transfers.
- Cases registered: Three cases have been formally registered at the Cyber Crime Police Station in Gandhinagar as the investigation continues, with more expected as investigators work through the full list of 1,090 linked cases across other states.
The specific laundering mechanics alleged in this case, taken as a whole, sit within a broader, well-documented pattern India's Directorate of Revenue Intelligence and other agencies have flagged in digital-arrest and similar cyber fraud cases nationally: funds are routed from victims through domestic mule accounts, converted into stablecoins such as Tether's USDT — prized by launderers for faster, relatively anonymous settlement and weaker anti-money-laundering oversight compared to traditional banking rails — and then moved onward through cryptocurrency exchanges, in some documented cases based in hubs like Dubai or France, before reaching the network's ultimate controllers, well beyond the practical reach of Indian investigators. Separately, Chinese authorities have themselves prosecuted fraud rings targeting Indian victims through similar structures; in one case reported this year, a Chinese court sentenced nine individuals for a telecom fraud operation that defrauded more than 66,000 Indian victims of roughly Rs 517 crore, laundering the proceeds through USDT before converting to yuan or dollars, with the network's organisers reportedly taking a 15 percent cut of laundered funds off the top before distributing the remainder further up the chain. Whether or not Alam's network used an identical structure, the described flow — mule accounts to app-based crypto conversion to overseas wallets — mirrors the pattern authorities say has become the default playbook for cross-border cyber fraud proceeds leaving India.
At a Glance
| Metric | Figure |
|---|---|
| Total fraud traced to the network | Rs 1,071.55 crore |
| Cybercrime cases linked nationally | 1,090 |
| Bank accounts used to split funds | 1,754 (within one hour) |
| Cryptocurrency wallets traced | 23 wallets, ~Rs 16 crore in transactions |
| Accused's age and location | 25 years old, Barpeta district, Assam |
| Cases formally registered so far | 3, at Gandhinagar Cyber Crime Police Station |
| National digital-arrest losses (18-month period) | Approx. Rs 2,140 crore |
Local Impact
For Barpeta and Assam more broadly, this arrest adds to a pattern regional police and national reporting have flagged with growing concern over the past year or more: districts within the state being used as bases for the financial-operator layer of nationally and internationally networked cyber fraud, rather than Assam being the source of the victims themselves. That distinction matters for how the state responds — the policing and prevention challenge here is less about protecting local residents from being scammed and more about disrupting local recruitment into money-laundering and mule-account roles within much larger criminal networks headquartered abroad.
For victims nationally, cases like this one illustrate why digital arrest scams have proven so damaging: even when a single financial operator is arrested, the money has typically already been split across well over a thousand accounts and converted to cryptocurrency within hours, making recovery extremely difficult regardless of how quickly a case is reported. Elderly victims in particular have borne a disproportionate share of losses — regional reporting has separately documented a case of an elderly Gujarat man defrauded of Rs 1.47 crore over a 28-day digital arrest scam that kept him under sustained psychological pressure and near-constant video surveillance by the fraudsters — underscoring why this particular category of fraud has drawn sustained national attention from cyber police units beyond Gujarat.
The scale of the mule-account infrastructure exposed in this case also has implications for India's banking system more broadly. Splitting Rs 1,071 crore in fraud proceeds across 1,754 accounts within a single hour is not something a small, informal group of individuals can plausibly execute manually — it implies either automated account-opening and transaction tooling, or a large recruited network of individuals willing to lend their bank credentials for a cut of the proceeds, or some combination of both. The nationwide crackdown that has reportedly frozen roughly 450,000 mule accounts to date suggests the scale of this underlying infrastructure problem extends far beyond any single network, Alam's included, and points to banks' know-your-customer and transaction-monitoring systems as a parallel front in this fight, alongside arresting individual financial handlers after the fact.
What Happens Next
Gandhinagar Cyber Crime officials have publicly said the investigation continues, with the explicit stated goals of identifying other accused persons within the network and tracing its full financial and international links — an acknowledgement that Rafiqool Alam's arrest addresses one node in a much larger structure rather than closing the case. Given that the network's Chinese-side handlers were reached through encrypted messaging platforms rather than traceable formal channels, and that funds were already converted to cryptocurrency and moved through dozens of wallets, investigators face a familiar challenge in cases of this kind: the domestic financial-operator layer is prosecutable under Indian law, but the network's actual controllers and the bulk of laundered funds may sit largely beyond the reach of Indian courts.
More immediately, expect Gujarat police to pursue further arrests connected to Alam's operation, potentially including other Assam-based or India-based financial handlers who managed the 1,754-account mule network, and possible coordination with central agencies, including I4C, given the case's cross-border and cross-state scale. Whether this results in broader action — such as tighter scrutiny of mule-account recruitment specifically in Assam, or coordinated advisories to banks and gaming platforms whose accounts were exploited as laundering channels — will likely depend on how far the "financial and international links" investigators say they are still tracing actually extend.
The parallel Morigaon investigations offer a rough template for what an escalated response in Barpeta or elsewhere in Assam might look like: mass SIM-card seizures and deactivations, sustained multi-month arrest operations rather than a single high-profile bust, and coordinated recovery efforts aimed at returning funds to victims where possible, even if only a small fraction of total losses is ever actually recoverable given how quickly proceeds move offshore. Given that this case, much like the Morigaon network before it, was uncovered and investigated by an out-of-state police force rather than Assam's own cyber cell, one open question is whether Assam Police will now open its own parallel investigation into Alam's activities and any local network he may have drawn on, independent of Gujarat's ongoing case.
Frequently Asked Questions
What technical gadgets were seized from Rafiqool Alam?
Police have said technical gadgets used in the operation were seized during the raid on his Barpeta residence, though a detailed public inventory of the seized equipment has not been released as of this report.
Who is Rafiqool Alam and what is he accused of?
Rafiqool Alam, 25, from Barpeta district, Assam, is accused of being the key financial operator of an international digital-arrest cybercrime network, allegedly responsible for laundering fraud proceeds through bank accounts and converting them into cryptocurrency for transfer to Chinese criminal network members.
What is a "digital arrest" scam?
It is a fraud tactic in which scammers impersonate police or government investigators, falsely claim the victim is linked to a crime, and use video calls — sometimes with fake police-station-style backdrops — to pressure victims into transferring money to avoid a supposed arrest. No such legal power to "arrest" someone over a video call exists under Indian law.
How much money is involved in this specific case?
Investigators have traced Rs 1,071.55 crore in fraud proceeds linked to 1,090 cybercrime cases across India connected to this network, with 23 cryptocurrency wallets showing roughly Rs 16 crore in transactions recovered so far.
How did the network move the money so quickly?
Investigators say fraud proceeds were split across 1,754 different bank accounts within a single hour to evade detection, before being converted into cryptocurrency using an app identified as "Chip Seller" and, in some instances, moved through gaming platform accounts.
How was Rafiqool Alam connected to the Chinese network?
He allegedly exchanged financial and operational details — including scanner information, account passwords and cryptocurrency wallet data — directly with Chinese counterparts via WhatsApp and Telegram.
How was he caught?
Gujarat police began investigating after receiving information about a senior-citizen victim, counselled that person, then conducted a technical investigation that surfaced roughly 10 simultaneous related cases. A three-day reconnaissance operation in disguise preceded a raid on Alam's residence in Barpeta, where technical gadgets were seized.
Is this connected to other Assam cybercrime cases in the news recently?
This is a separate case from other recent Assam-linked cyber fraud reporting, but it fits a broader pattern of Assam districts being used as bases for the financial-operator layer of large, nationally networked cybercrime rings, even when victims are located elsewhere in the country.
What should someone do if they receive a call claiming they are under "digital arrest"?
Cybersecurity advisories are unambiguous: hang up. No genuine police officer, ED, CBI or RBI official will ever conduct an arrest, demand money, or "verify" funds over a video call. Anyone receiving such a call should independently verify through the concerned agency's official channels and report the incident to India's national cybercrime helpline or portal.
What is India's official cybercrime reporting system, and does it actually work?
The Indian Cyber Crime Coordination Centre (I4C), an attached office of the Ministry of Home Affairs since July 2024, runs the 1930 helpline and National Cybercrime Reporting Portal. Its Citizen Financial Cyber Fraud Reporting and Management System can relay a victim's report to banks and payment intermediaries in near-real time to freeze stolen funds before they fully disperse, and the system is credited with freezing thousands of crores of rupees in attempted fraud, though speed of reporting is critical to its effectiveness.
Is this the only Assam district linked to large-scale cybercrime networks recently?
No. Morigaon district, roughly 100 km from Barpeta, has separately been described in regional reporting as a major operational hub for a different, large cybercrime network with alleged links to Pakistan and Southeast Asia, distinct from the Chinese-network connection in this case. Assam police action there has led to over 300 arrests and the seizure of more than 72,000 SIM cards.
Why do these networks convert stolen money into cryptocurrency?
Investigators say stablecoins like Tether's USDT are commonly used because they allow faster, relatively anonymous cross-border settlement with weaker anti-money-laundering oversight than traditional banking, making it harder to trace and recover funds once they leave the domestic banking system.
Sources
This report draws on coverage from IANS, ETV Bharat, Forbes India, PIB (Press Information Bureau), The420.in, Sentinel Assam, Deccan Herald, crypto.news, Business Standard, and Wikipedia's entry on digital arrest scams, cross-referenced for consistency on figures and dates.
