In one of its most detailed market manipulation investigations, the Securities and Exchange Board of India (SEBI) has shown how digital records can help uncover complex financial fraud. Instead of relying only on trading data and bank accounts, the regulator examined airline bookings, hotel reservations, food delivery applications, employee records, website ownership details, domain registration history, bulk SMS gateways, WhatsApp conversations and fund flows.
Using this digital trail, SEBI said it was able to uncover an alleged Rs 143.79-crore pump-and-dump network involving 226 entities.
One of SEBI’s longest orders
The findings are contained in a 394-page final order, one of SEBI’s longest enforcement orders in recent years. The order was passed by Whole Time Member Amarjit Singh, who described the alleged scheme as being carried out on an “industrial scale” and going beyond routine market misconduct, saying it had the potential to shake investor confidence in the integrity of the securities market.
The order relates to an alleged stock manipulation scheme involving Mauria Udyog Ltd., Vishal Fabrics Ltd., 7NR Retail Ltd., GBL Industries Ltd. and Darjeeling Ropeway Company Ltd. between 2017 and 2020.
SEBI has ordered disgorgement of about Rs 143.79 crore along with applicable interest. It has also imposed monetary penalties totalling Rs 47.8 crore and barred most of the noticees from accessing the securities market for four to seven years.
Case built using multiple sources
According to the order, the findings were not based on a single piece of evidence. SEBI said its conclusions were drawn from the combined weight of information collected from multiple independent sources.
Airline and hotel records examined
One of the unusual aspects of the investigation was the use of travel records. During the proceedings, alleged mastermind Hanif Shekh argued that certain mobile numbers relied upon by SEBI belonged to employees and were never used by him personally.
The regulator examined airline booking records, including those obtained from IndiGo, and found that his admitted mobile number and email address had been used for flight bookings. Hotel booking records were also used as supporting evidence while examining links among individuals connected to the alleged scheme.
Website ownership traced
SEBI also reconstructed the ownership trail of promotional websites.
Investigators examined GoDaddy domain registration records, contact audit histories, administrator access logs, invoices issued by digital marketing agencies and website management records to determine who exercised effective control over the domains.
According to the order, changes in domain ownership did not establish that operational control had shifted. SEBI concluded that certain names appearing in registration records merely acted as intermediaries, while effective control remained with the persons identified in the investigation.
Bulk SMS and WhatsApp under scanner
The investigation also examined the infrastructure used to spread stock recommendations.
SEBI analysed bulk SMS gateway providers, reseller arrangements, payment trails and WhatsApp communications to understand how the promotional campaigns were planned and executed.
According to the order, more than 2.1 crore bulk SMS messages were circulated in connection with one of the manipulated stocks. Promotional campaigns across the five stocks reached more than 60,000 unique mobile numbers.
Trading patterns raised concerns
Trading analysis formed another important part of the investigation. SEBI analysed synchronised trades, circular trading patterns, repeated order modifications and transactions executed in very small quantities.
According to the regulator, these trades were designed to create an artificial impression of liquidity and maintain investor interest despite little support from company fundamentals.
The order also noted that several entities continued trading despite suffering losses. SEBI said this indicated that maintaining artificial market activity, rather than generating trading profits, was itself part of the alleged manipulation strategy.
Money trail tracked across accounts
Fund-flow analysis further strengthened SEBI’s case. The regulator traced proceeds from share sales through multiple conduit entities before identifying their alleged ultimate beneficiaries. According to the order, proceeds generated from inflated share prices were layered through several accounts before finally reaching entities connected with the principal operators.
Employees and labour contractors investigated
Another major part of the investigation focused on employees and labour contractors of Mauria Udyog Ltd.
SEBI identified 62 employees and labour contractors as off-loaders, alleging that they sold shares during the manipulation period and later transferred the sale proceeds to Mauria Udyog, promoter-linked entities or entities connected with Hanif Shekh.
To examine these relationships, investigators scrutinised employee bank accounts, demat accounts and income-tax records.
According to the order, several employees shared common addresses, recovery email IDs, contact details and other identifiers, which collectively helped establish links among the participants.
A key finding in the order is that many employee shareholders allegedly did not retain the money received from selling shares. Instead, SEBI said the funds were transferred to the company, promoter-linked entities or Hanif Shekh-linked entities, conduct that it considered inconsistent with that of ordinary investors.
Noticees denied the allegations
Mauria Udyog and several noticees disputed the allegations. They argued that many individuals were long-term shareholders, some were labour contractors rather than employees and certain fund transfers represented legitimate transactions.
Digital footprints linked the network
The regulator also analysed Zomato food delivery application records, telecom records and other digital footprints to verify ownership of mobile numbers and establish links among individuals.
Together with banking records, demat statements and trading data, these digital footprints formed a key part of SEBI’s evidence in what it described as one of its largest actions against an alleged pump-and-dump network.
Toughest action against alleged mastermind
Hanif Shekh, identified by SEBI as the alleged mastermind of the stock manipulation scheme, received the toughest sanctions in the final order.
SEBI imposed a Rs 10-crore monetary penalty, barred him from the securities market for seven years and prohibited him from buying, selling or otherwise dealing in securities or associating with the securities market in any manner.
SEBI calls operation “industrial scale”
In the final order, Whole Time Member Amarjit Singh said the alleged fraudulent scheme, though not new in concept, was executed meticulously and on an almost industrial scale, involving 226 entities playing designated roles across five different stocks.
He said one of the most striking findings was the complex structure of fund transfers that appeared to be designed to hide the identity of the alleged ultimate beneficiaries.
The order added that the case warranted stringent directions both to ensure an effective deterrent against the noticees concerned and to discourage similar conduct by other participants in the securities market.
Also Read: Gujarat Firms Outperform Sensex, Nifty; Gain Up To 58% In H1 2026 https://www.vibesofindia.com/gujarat-stocks-outperform-market-adani-group-h1-2026/
