- V-KYC data flagged 10 Indian districts with early mule-account fraud signals between 2025-26
- Fraud hotspots often shift geographically, with 81% of district spikes lasting only one month
- V-KYC warnings appeared up to two months before law enforcement or media confirmed fraud cases
A new analysis of Video-KYC (or V-KYC) and onboarding data has identified 10 Indian districts showing early signs of rising mule-account and fraud activity. Bareilly, Lakhimpur Kheri and Varanasi are among the districts showing elevated risk.
The analysis by IDfy is based on V-KYC onboarding data collected between April 2025 and June 2026 across around 130 districts. It examined monthly onboarding attempts and rejection patterns to identify areas where suspicious activity was showing statistically significant concentrations.
10 Districts Showing Early Fraud Signals
The districts flagged in the latest analysis are:
| District | V-KYC rejection rate |
| Lakhimpur Kheri | 14.03% |
| Bareilly | 13.37% |
| Varanasi | 12.32% |
| Saharanpur | 10.32% |
| Muzaffarnagar | 9.77% |
| Panipat | 9.52% |
| Firozabad | 8.81% |
| Jodhpur | 7.61% |
| Lucknow | 6.00% |
| Ghaziabad | 5.91% |
The report cautions that these are current V-KYC risk signals. Some districts could already be active fraud hotspots, while others may be emerging clusters.
Why Fraud Networks Are Hard To Track
One of the key findings is that fraud activity does not necessarily disappear after enforcement action. Instead, it can shift geographically.
IDfy's 15-month analysis found that in 81 per cent of cases, an elevated risk spike in a district lasted only one month. Only 6.5 per cent of risk spikes continued for three months or more.
When one district cools down, another hotspot can emerge nearby. In 39 per cent of cases, the next hotspot was in the same state. The average movement was around 190 km. Old hotspots can also become active again. The analysis found that 11 active hotspots in the current quarter had already been flagged earlier in FY26.
V-KYC Data Can Give An Early Warning
The significance of the findings lies in when the warning appears. Across FY26, IDfy identified around 16 district-level fraud hotspots every quarter. Between 85 per cent and 90 per cent of these were later confirmed through law-enforcement action or news reports.
In verified cases, V-KYC signals appeared up to two months before public reporting. The company also said its forecast came earlier than I4C reporting in 33 per cent of regions. The larger whitepaper similarly says V-KYC rejection data flagged high-risk districts between two weeks and two months before police or media reporting in the cases studied. It also found that V-KYC data identified 33 per cent more active fraud locations than official daily reporting.
How The Fraud Pattern Changes
The analysis also points to a recurring pattern: fraud hotspots can move from one district to another rather quickly.
IDfy's data from around 130 districts over 15 months found that when a district's risk falls, the next hotspot is often elsewhere. The company said this geographic movement does not establish that the same fraud operators have physically moved. It indicates a pattern in where risk emerges.
Two examples cited in the whitepaper are Nuh in Haryana and a Gujarat cluster that originated in Surat. In the Nuh case, fraud activity later expanded into adjoining districts of western Uttar Pradesh. In Gujarat, the activity progressively spread from Surat towards Botad, Amreli and Jamnagar.
What This Means For Banks And Financial Firms
The findings suggest that simply monitoring known fraud hotspots may not be enough.
Financial institutions could also monitor neighbouring districts and prepare for possible shifts in activity. The report recommends identifying high-risk districts while the risk is active and pre-alerting nearby areas.
The analysis uses statistical validity and minimum fraud-volume thresholds before ranking districts. It then uses a Z-score to distinguish concentrated risk from fluctuations caused by small samples.
