Scams are growing fast, and the weak link is increasingly the mule account that moves stolen money. The RBI, the courts and the banks are racing to close it.
The call usually comes in the afternoon. A voice claims to be from a bank, a courier firm or a government agency. The story is urgent and the tone is confident. A few minutes later, money leaves the victim's account and lands in another account owned by someone who has never met them. Within hours it is gone.
That second account is the hinge of most modern cyber fraud. Bankers call it a mule account. It is the reason the Reserve Bank of India, the Supreme Court and the banks are now focusing less on how scams begin and more on where the money goes.
How a mule account works
A mule account is a bank account opened, rented or taken over to receive and pass on stolen money. The funds move through several accounts in quick succession, which makes them hard to trace and recover.
Governor Sanjay Malhotra has described the pattern. Such accounts often sit dormant, then suddenly record a surge of low-value, high-volume transactions. Legal commentators on a recent Supreme Court order point to what makes the method work: real-time payments, remote onboarding, multiple payment identifiers and interoperable platforms. The same features that make Indian payments easy to use make stolen money easy to move.
This is the reason why the critical question for RBI becomes:
Can a bank identify a suspicious account before it becomes the transit infrastructure for a cybercrime, and can it stop the money without freezing an innocent customer indefinitely.
What the RBI is proposing
In April, the RBI released a discussion paper called "Exploring safeguards in digital payments to curb frauds" and invited comments until May 8. It floated four ideas.
The first is a one-hour delay for digital payments above ₹10,000, during which the payer could cancel. The second is an extra layer of approval by a trusted person for senior citizens and persons with disabilities. The third is on-off switches and limits that let customers control each payment mode at the account level. The fourth is a limit on the total credits an account can receive without additional review of the business relationship.
None of these is final. But a rule requiring at least one authentication factor unique to each transaction took effect on April 1, 2026. In March, the government also described revised RBI instructions on unauthorised electronic banking transactions, including a compensation mechanism and wider use of AI-driven fraud analytics.
The technology response
The RBI's main tool against mule accounts is MuleHunter.AI, developed by the Reserve Bank Innovation Hub. It uses artificial intelligence and machine learning to flag accounts that behave like mules. It was live in 26 banks as of March and is being scaled up. A Supreme Court order in February noted that about 26 of 53 banks reportedly used it, so adoption is still partial.
The RBI has also created the Indian Digital Payment Intelligence Corporation, a non-profit company incorporated on October 16, 2025. Its job is to detect, prevent and analyse payment fraud in real time using AI and data analysis. A related prototype, the Digital Payment Intelligence Platform, is being developed.
The logic is shared defence. Fraud rarely stays within one bank. Money hops from a victim's bank to a mule account in a second bank and then to a third. Governor Malhotra urged banks and NBFCs in January to build shared analytics so suspicious activity can be caught early, before losses spread.
The courts step in
On August 4, the Supreme Court directed the RBI to adopt and circulate a standard operating procedure for mule accounts and cyber-fraud-linked accounts within four weeks, with copies to the registrars general of every High Court. The RBI had already told the Court about a draft procedure for temporary debit holds on accounts linked to mule activity, and the order points to rules on returning recovered money to victims.
The hard trade-offs
Every safeguard has a cost. A one-hour delay would protect people from a scammer's pressure, but it could also irritate the many customers who send a legitimate large payment, such as a rent or a supplier's invoice. Banks will have to decide how to exempt trusted payees without creating a loophole.
Debit holds raise a different problem. Freezing a suspected mule account stops money from leaving, but an innocent customer may be caught. That calls for quick review and clear communication. Trusted-person authentication adds protection for older customers, but also raises questions about consent and privacy.
There is also a cost gap. The largest banks can build or buy AI detection. Smaller banks and cooperative lenders may struggle. Because fraudsters go where defences are weakest, a gap in one institution becomes a gap for the whole system.
What bankers can do
Start at the front door. Many mule accounts are opened with genuine documents by people paid to hand over access. Review onboarding for new accounts that show unusual patterns, such as many accounts opened at one address or by one agent, and tighten checks on accounts that go from dormant to active without explanation.
Monitor behaviour instead of just balances. Look for fast in-and-out movement, many small credits from unrelated senders, and sudden activity on old accounts. Treat the branch as a defence. Staff should be trained to notice customers who seem coached, who are in a hurry or who are withdrawing large sums after a phone call. Tell customers plainly that no bank will ask for a PIN, OTP or transfer to a "safe" account.
Prepare your apps now. If the RBI finalises on-off switches, transaction limits and a cooling-off period, customers will expect clear controls and simple language. Banks that build these early will adapt more easily.
Finally, respond fast to victims. The speed of reporting often decides whether money can be traced. A complaint desk that answers within minutes will recover more than one that answers within days.