New Delhi, Dec 14 (PTI) The CBI has filed a chargesheet against 17 people, including four Chinese nationals, and 58 companies for their alleged roles in a transnational cyber fraud network that siphoned off over Rs 1,000 crore through a sprawling web of shell entities and digital scams, officials said on Sunday.

After busting the racket in October, investigators unravelled a single, tightly coordinated syndicate that relied on an elaborate digital and financial infrastructure to run a range of frauds. These included misleading loan applications, fake investment schemes, Ponzi and multi-level marketing models, bogus part-time job offers and fraudulent online gaming platforms.

According to the probe agency's final report, the group layered the flow of illicit funds through 111 shell companies, routing about Rs 1,000 crore via mule accounts. One account received more than Rs 152 crore in a short span.

The shell companies, the CBI said, were incorporated using dummy directors, forged or misleading documents, fake addresses and false statements of business objectives.

"These shell entities were used to open bank accounts and merchant accounts with various payment gateways, enabling rapid layering and diversion of proceeds of crime," a CBI spokesperson said in a statement.

Investigators traced the origins of the scam to 2020, when the country was grappling with the COVID-19 pandemic. The shell companies were allegedly incorporated at the direction of four Chinese handlers -- Zou Yi, Huan Liu, Weijian Liu and Guanhua Wang.

Their Indian associates procured identity documents from unsuspecting individuals, which were then used to establish the network of shell companies and mule accounts to launder proceeds from the scams and obscure the money trail.

The investigation exposed communication links and operational control that, the agency said, nailed the role of Chinese masterminds running the fraud network from abroad.

"Significantly, a UPI ID linked to the bank accounts of two Indian accused was found to be active in a foreign location as late as August 2025, conclusively establishing continued foreign control and real-time operational oversight of the fraud infrastructure from outside India," the CBI statement said.

The probe found that the racketeers employed a highly layered, technology-driven modus operandi, using Google advertisements, bulk SMS campaigns, SIM-box-based messaging systems, cloud infrastructure, fintech platforms and multiple mule bank accounts.

"Each stage of the operation -- from luring victims to collection and movement of funds -- was deliberately structured to conceal the identities of the actual controllers and evade detection by law enforcement agencies," the spokesperson said.

The chargesheet names 17 individuals, including the four Chinese nationals, and 58 companies.

The investigation was launched on the inputs from the Indian Cyber Crime Coordination Centre (I4C) under the Ministry of Home Affairs, which flagged large-scale cheating of citizens through online investment and employment schemes, resulting in the arrest of three individuals in October.

"Though initially appearing as isolated complaints, detailed analysis by CBI revealed striking similarities in applications used, fund-flow patterns, payment gateways and digital footprints, pointing towards a common organised conspiracy," the agency said.

Following the October arrests, the CBI conducted searches at 27 locations across Karnataka, Tamil Nadu, Kerala, Andhra Pradesh, Jharkhand and Haryana, seizing digital devices, documents and financial records that were later subjected to detailed forensic examination. PTI ABS NSD NSD

Transnational cyber fraud using 111 shell companies and mule accounts allegedly siphoned around Rs 1,000 crore via technology driven schemes. The CBI filed a chargesheet against 17 individuals, including four Chinese nationals, and 58 companies for an alleged transnational cyber fraud and money laundering network that used 111 shell companies, mule accounts and technology platforms to siphon about Rs 1,000 crore; investigators attribute operational direction to four named foreign handlers and cite digital forensic evidence and active foreign linked UPI activity establishing ongoing external control.