Kochi: A woman sits in front of her phone, terrified because she has been 'digitally arrested'. On the screen, a man in uniform claims to be a police officer. He says her bank account is under investigation, must be frozen immediately, and that she could be prosecuted. Panicked, the woman follows every instruction and transfers her savings to the accounts specified by the ‘officer’ to avoid arrest. In just four hours, the ₹1.18 crore she transfers vanishes through 242 transactions and six layers of mule accounts. By the time she realises the fraud, files a complaint, and help arrives, the 'golden hour' — up to four hours, the crucial window to freeze stolen funds — has already passed.

This is not fiction. It’s one of the many real cases that inspired a game-changing approach by the Tamil Nadu Police Cyber Crime Wing, which is now rescuing victims before they even realise they are being scammed. At c0c0n 2025, Kerala Police’s annual cybersecurity conference in Kochi, Shahnaz Illyas, Superintendent of Police (Cyber Crime Wing), Tamil Nadu, shared how her team is using intelligence and technology to turn cyber policing from reactive to pre-emptive. 

Traditionally, cybercrime investigations begin after a victim files a complaint on the National Cybercrime Reporting Portal (NCRP). But by then, the money has usually travelled through multiple accounts and digital corridors, often beyond recovery. 

Tamil Nadu’s Cyber Crime Wing decided to flip this model. “Instead of waiting for victims to come to us, we started looking for them,” said Shahnaz. The police’s Cyber Patrolling and Intelligence Unit treats the financial network itself as a living intelligence source. 

It begins with a single clue, often the first bank account where a fraud victim’s money lands, known as a mule account. From there, investigators analyse transaction histories to identify patterns. Accounts opened recently with low balances and rapid fund transfers are flagged as potential mule accounts. In contrast, long-standing accounts with regular activity — salary credits, EMIs, savings — that suddenly start sending large amounts to suspicious beneficiaries signal something else; maybe an unsuspecting victim. 

“When we see a stable account suddenly moving big sums to a risky one, we know someone’s in trouble, even if they haven’t realised it yet,” Shahnaz said. Once a suspected victim is identified, the response is immediate. Through the NCRP’s Pre-Emptive Victim Alert Module, the police and banks work together to reach the person, often with a phone call, warning them that they are being scammed. 

In many cases, this alert arrives just in time. A single call from a genuine officer can break the illusion created by scammers posing as police or government officials. 

So far, the Tamil Nadu Police have identified and helped 399 victims across India, preventing massive financial losses. Victims from Tamil Nadu (75), Maharashtra (56), and Karnataka (37) form the largest group, while 28 victims were identified in Kerala. Illyas said that from just one NCRP complaint in Tamil Nadu, they have identified and alerted 34 victims across India. 

But Illyas said that the system faces many challenges. “Speed is everything in cybercrime recovery,” said Shahnaz. The process often stalls because of delays in getting complete bank statements. Some banks respond slowly or provide incomplete information, missing key beneficiary details. “For example, we sent 1,000 requests for bank statements to trace suspect accounts but received only 634 responses. Each delay costs time, and that time is someone’s life savings,” she said.