10 districts vulnerable to mule account fraud, wider tracking needed: Study

Fraud prevention company's analysis shows that people must treat requests to open or operate bank accounts on behalf of others with caution

Criminals running mule-account rackets are expanding their reach across north India, with 10 districts in Uttar Pradesh, Haryana and Rajasthan emerging as fraud hotspots, according to an analysis of video-KYC (V-KYC) onboarding data by fraud prevention firm IDfy.

 

The most vulnerable locations include eight districts in Uttar Pradesh — among them Lucknow, Ghaziabad, and Bareilly — alongside Panipat in Haryana and Jodhpur in Rajasthan. The findings are based on V-KYC data covering around 130 districts between April 2025 and June 2026.

 

The development matters for banks and customers because mule accounts are often used to receive and move money illegally. The analysis suggests that waiting for complaints or enforcement action may not always give financial institutions enough lead time to detect emerging fraud clusters.

Which districts are showing higher risk?

IDfy’s analysis identified the following districts as requiring heightened attention:

District	V-KYC rejection rate
Lakhimpur Kheri	14.03%
Bareilly	13.37%
Varanasi	12.32%
Saharanpur	10.32%
Muzaffarnagar	9.77%
Panipat	9.52%
Firozabad	8.81%
Jodhpur	7.61%
Lucknow	6.00%
Ghaziabad	5.91%

These are V-KYC risk signals, not proof that every person or account in these districts is involved in fraud. IDfy itself says some locations may already be active hotspots, while others could be emerging clusters.

Why V-KYC data can provide an early warning

The analysis looks at V-KYC attempts and rejections. A rejection can occur when automated systems or live agents identify issues such as impersonation, document tampering, third-party prompting or suspicious behaviour.

 

IDfy says it identified around 16 district-level fraud hotspots every quarter during FY26. Of these, 85-90 per cent were subsequently confirmed through law-enforcement action or news reports. In verified cases, the V-KYC signal appeared up to two months before public reporting. The company also says its forecast came before I4C reporting in 33 per cent of regions.

 

The company’s analysis therefore positions onboarding data as a complementary early-warning layer, rather than a replacement for police or government data.

Fraud risk can move to another district

An important finding is that a decline in risk in one location does not necessarily mean the wider fraud activity has ended.

 

IDfy studied 15 months of data across approximately 130 districts and found that 81 per cent of district-level risk spikes lasted only one month. Only 6.5 per cent continued for three months or more.

 

The next hotspot appeared in the same state 39 per cent of the time, while the average geographic movement was around 190 km. Earlier hotspots could also become active again, with 11 current-quarter hotspots having already been flagged earlier in FY26.

 

This means that monitoring only a known hotspot may not be sufficient. Financial institutions may also need to watch neighbouring districts when fraud risk rises sharply in one area.

What does this mean for bank customers?

For customers, the findings highlight the importance of treating requests to open or operate bank accounts on behalf of others with caution.

 

A mule account can be an ordinary-looking bank account that is used to receive or transfer money connected with fraudulent activity. The IDfy study, however, is based on onboarding signals and does not establish that all rejected applications or all accounts in a flagged district are fraudulent.

 

Customers should therefore be particularly careful if someone offers money for opening an account, asks to use their bank account to receive funds, or requests access to banking credentials or authentication codes.

 

How banks are trying to detect the problem earlier

IDfy says its methodology uses three stages to distinguish meaningful risk from statistical noise: A minimum sample-size threshold, a minimum fraud-volume threshold and Z-score ranking. A district must record at least 30 rejected calls in a month to qualify for Z-score ranking.