The bank that holds the mule account owes you nothing under the customer-liability circular, because you are not its customer. That is the honest starting point. What it does owe is compliance with the Reserve Bank's anti-mule rules, and where an account was opened on paper-thin KYC, run through crores in a week and never flagged, that failure is the basis of a claim. It is a harder claim than the one against your own bank, and it sits behind the freeze and the FIR rather than replacing them.
What has the receiving bank done wrong?
The Reserve Bank's Master Direction on Know Your Customer of 25 February 2016, updated to August 2025, has a paragraph headed "Operation of Bank Accounts and Money Mules". It says that account opening and transaction monitoring instructions "shall be strictly adhered to, in order to minimise the operations of Money Mules", that banks "shall undertake diligence measures and meticulous monitoring to identify accounts which are operated as Money Mules and take appropriate action, including reporting of suspicious transactions" to the Financial Intelligence Unit, and that where an account is established to be a mule and no suspicious transaction report was filed, "it shall then be deemed that the bank has not complied with these directions." Ongoing due diligence is defined in the same direction as regular monitoring of transactions to ensure they are consistent with the bank's knowledge of the customer and the source of funds.
The regulator has also removed the excuse that mule patterns are hard to see. According to the Finance Ministry's statement in the Rajya Sabha on 24 March 2026, the Reserve Bank has rolled out MuleHunter.AI, live in 26 banks, has issued advisories on the specific controls banks must run to detect suspected mules, and has told banks to deploy real-time transaction monitoring and network analytics. On 12 May 2026 the Indian Cyber Crime Coordination Centre and the Reserve Bank Innovation Hub signed a memorandum to feed the I4C Suspect Registry into those systems. A bank that received a fresh student's account, saw forty inbound transfers of round amounts and instant withdrawals, and did nothing, has a monitoring failure it will find hard to explain.
From 1 January 2027 the point is written into the rules for the first time. The Reserve Bank's amended directions of 24 June 2026 make the beneficiary bank, defined as the bank where the fraudulently debited amount is first credited, contribute to the new small-value compensation for frauds up to Rs 50,000. It is a small share, but it is the first time the receiving bank pays by rule rather than by judgment.
Can I file a consumer complaint against the receiving bank?
This is where I would be careful. A consumer under Section 2(7) of the Consumer Protection Act, 2019 is a person who hires or avails a service for consideration, and you never hired anything from the receiving bank. Whether a stranger to the account can sue that bank for deficiency is contested ground, and I would not build a case on it. The claims that stand on firmer footing are these.
Where is the money now?
- Still in the mule account, under a hold: apply to the Magistrate under Section 503 of the Bharatiya Nagarik Suraksha Sanhita, 2023 for release to you. The receiving bank is a formal party, not a defendant.
- Withdrawn, mule holder identified: civil suit for recovery against the holder, and a request to the investigating officer to move for attachment of the holder's other property under Section 107 BNSS, which lets the court order rateable distribution of proceeds of crime to the persons affected.
- Withdrawn, and the account should never have existed: a civil suit for damages against the bank for negligent onboarding and monitoring, pleaded on the KYC Master Direction, and a complaint to the Reserve Bank so the supervisory record exists. This is the slowest and most contested track, so it comes last.
Against your own bank the position is different and easier. If it delayed the freeze request after your written report, that is a deficiency in service under Section 2(11) of the 2019 Act, which expressly includes an act of negligence causing loss, and it goes to the Ombudsman and the consumer commission in the usual way. Our answer on filing a consumer complaint covers the mechanics.
What can be done against the account holder?
Quite a lot, and it is the pressure point that most often gets money back. Section 317(1) of the Bharatiya Nyaya Sanhita, 2023 designates property obtained by cheating as stolen property. Section 317(2) punishes whoever dishonestly receives or retains stolen property knowing or having reason to believe it to be stolen, with up to three years. Section 317(5) punishes whoever voluntarily assists in concealing, disposing of or making away with it, also up to three years. Where the holder acted in concert with the fraudsters, Section 3(5) makes each person liable for the act of all, and Section 111 treats cyber-crimes and mass-marketing fraud run by a syndicate as organised crime. A mule who handed over his account for a commission is not a bystander.
On the civil side, a person to whom money has been paid by mistake or under coercion must repay it under Section 72 of the Indian Contract Act, 1872, the suit is for the amount plus interest, and under Section 17 of the Limitation Act, 1963 the three years run from when you discovered the fraud. The practical catch is that many mule holders are students, migrant workers or people who sold their KYC for a few thousand rupees and have nothing to recover, which is why the freeze and the Section 107 route matter more than the decree.
| Party | Legal basis | Forum | Realistic strength |
|---|---|---|---|
| Mule account holder | Section 317(2) and (5) BNS, Section 72 Contract Act | FIR and civil suit | Strong on liability, weak on recovery unless assets exist |
| Fraudsters' other property | Section 107 BNSS attachment of proceeds of crime | Court on the investigating officer's application | Depends entirely on the police moving |
| Your own bank | 2017 RBI circular paragraphs 5, 9 and 12, Section 2(11) CPA 2019 | Bank, RBI Ombudsman, consumer commission | Strong where the freeze request was delayed |
| Receiving bank | KYC Master Direction, money mule paragraph, negligence | Civil court, complaint to the RBI | Contested, slow, worth pleading in large cases |
What do I ask for in writing?
- From your bank: the time it received your report, the time it sent the hold request to the beneficiary bank, and the beneficiary bank's response
- From the beneficiary bank, through the investigating officer: the account opening date, the KYC documents, whether a suspicious transaction report was filed, and whether the account or the holder appears in the I4C Suspect Registry
- From the investigating officer: confirmation of the freeze under Section 106 BNSS, the amount held, and whether a Section 107 application has been moved
- For the Magistrate: the FIR, the portal acknowledgement, your statement, the hold confirmation, and an affidavit of ownership
What I tell clients about the receiving bank
Do not lead with it. The bank will answer that it opened the account on valid documents and that it froze the balance the moment the 1930 ticket arrived, and both statements are usually true. Where the claim has teeth is the account that was clearly a conduit from day one, in a case large enough to justify a suit. In the ordinary matter, the money comes back through the hold and the Magistrate, and the receiving bank's KYC failure becomes a paragraph in the police complaint that helps the officer see the holder as an accused rather than a witness. The sibling answer on what to do when the money has moved on sets out the release application, and our guide on recovering money from online fraud has the full sequence.