Jamtara Gang Aide Arrested by Gujarat Police in Fake RTO Challan Fraud Case
Gujarat Police have detained a suspected member of a Jamtara-based cybercrime syndicate following an investigation into a fraudulent scheme involving a malicious RTO e-challan application.
Arrest of Sitaram Mandal
The accused, Sitaram Mandal, was taken into custody from Sabarmati Jail in Ahmedabad, where he was already detained on unrelated charges. He now faces separate allegations tied to a cyber fraud case in Surat that resulted in the unauthorized withdrawal of ₹5.02 lakh from a family’s bank account.
Details of the Fraud
The fraud began on November 20, 2025, when an individual received a file disguised as an RTO e-challan notice. The compromised account was later used to distribute the same malicious application to a group containing the victim’s son and his associates, leveraging trust among contacts to bypass security awareness.
Impact of the Malicious Application
Once installed, the application reportedly granted attackers remote access to the victim’s device, enabling multiple unauthorized transactions totaling ₹5,02,562. The family reported the incident to the national cybercrime helpline and filed a formal complaint with the Surat Cyber Crime Cell on December 14, 2025, leading to charges under the Bharatiya Nyaya Sanhita and the Information Technology Act.
Investigation and Financial Trail
Investigations revealed that ₹1,47,954 of the stolen funds was transferred through an accused named Nishit Nathwani to settle a credit card bill. Nathwani allegedly retained a 15–20% commission before depositing the remainder into Mandal’s Axis Bank account via cash deposit machines.
Role of Mule Accounts
Mandal is accused of taking an additional 5–10% cut before forwarding the remaining funds to accomplices in Jharkhand. Bank records indicate that Mandal’s Axis Bank account received ₹15,87,400 in credit transactions between September 2025 and January 2026, with ₹2.72 lakh directly linked to this and related cybercrime activities.
Cybercrime Network and Operations
Mandal’s arrest is part of a broader probe by the Ahmedabad Cyber Crime Cell into a malware-distribution network. Authorities have identified Purnanand, also known as Mukesh Tiwari, as the alleged developer of the malicious APK files and operator of a Telegram bot used for marketing.
Structure of the Fraud Network
Another accused, Vikas Das, is alleged to have supplied malware to approximately 400 fraudsters. Mandal’s role reportedly included facilitating the distribution of the malicious software and arranging bank cards for the network. Court and police records show Mandal has a history of cybercrime-related charges.
Jamtara as a Cybercrime Hub
The Jamtara region of Jharkhand has long served as a hub for organized digital fraud in India. Recent investigations have uncovered networks distributing over 100 custom-built APK files impersonating financial institutions and government agencies.
Law Enforcement Efforts
Law enforcement across multiple states, including Odisha and Gujarat, has dismantled similar structures involving developers, distributors, and cash handlers. The current phase of Jamtara-linked fraud is characterized by a structured, assembly-line approach, with distinct roles for malware development, marketing via Telegram bots, account muling, and physical cash conversion.
Ongoing Investigations
Gujarat authorities are now examining whether Mandal’s alleged involvement extends to other cybercrime reports processed through the national cybercrime helpline.
About Author
English