Accused in two terror attacks in India used online payment services, e-commerce platforms and VPNs: FATF report

International cash laundering and terrorist financing watchdog Monetary Motion Process Pressure (FATF) has stated that the accused in two current terror assaults in India used on-line cost providers, e-commerce platforms, and Digital Personal Networks (VPNs). The FATF cited the incidents in its report ‘Complete Replace on Terrorist Financing Dangers’ revealed on Tuesday (July 8, 2025).

The primary case pertains to make use of of on-line cost providers and VPNs to fund a “lone actor” terrorist act. On April 3, 2022, a person influenced by terror group ISIL’s ideology attacked safety personnel at Gorakhnath Temple in Uttar Pradesh. The assault was detected through the try by the accused to breach safety, resulting in his speedy arrest.

The case was transferred to the State Anti-Terror Squad (ATS) for investigation. The ATS discovered that the accused had transferred ₹6,69,841 by way of PayPal to overseas nations in assist of ISIL, utilizing worldwide third-party transactions and VPN providers to obscure the IP tackle. He additionally obtained ₹10,323.35 from a overseas supply.

A forensic report on the accused’s telephone revealed that he had been utilizing a VPN for calls, chatting, and downloads to evade detection. “Additional monetary scrutiny uncovered that the accused had made a cost to a VPN supplier by means of his checking account to safe these providers… the investigation additionally uncovered that the accused had despatched cash to a number of people recognized as ISIL followers in overseas jurisdictions to assist terrorist actions,” stated the report.

Pulwama assault

In the course of the probe into the February 2019 suicide-bomb assault on a convoy killing 40 Central Reserve Police Pressure (CRPF) personnel in Jammu and Kashmir’s Pulwama, it was detected that an e-commerce platform was used for the procurement of supplies for the terrorist assault, carried out by Pakistan-based Jaish-e-Mohammed.

A key element of the improvised explosive gadget used within the assault — aluminium powder — was procured “by means of the EPOM [E-commerce platforms and online marketplaces] Amazon”. “This materials was used to boost the influence of the blast. Because of the investigation, 19 people had been charged beneath related provisions of the Illegal Actions (Prevention) Act, together with sections associated to Terror Financing. Amongst these charged had been seven overseas nationals, together with the suicide bomber”.

“Terrorists have been reported to abuse EPOMs, that are occupying an evergrowing place in worldwide financial landscapes, for numerous functions… criminals and terrorists can pose as a number of consumers and sellers (e.g., fraudulent/complicit on-line store fronts) on the EPOMs, and use trade-based ML/TF [Money Laundering/Terror Financing] methods, reminiscent of over/beneath invoicing, to switch worth (items and funds) between one another,” the report noticed.

The report stated terrorists have used EPOMs for procuring gear, weapons, chemical substances, and 3D-printing materials. “EPOMs will also be utilized by terrorists to promote gadgets to finance their tasks and operations, together with decrease worth gadgets that had been beforehand not in demand. EPOMs can be utilized to promote gadgets obtained by means of wildlife exploitation or stolen cultural artefacts,” stated the report.

It has been discovered that EPOMs can be utilized for fund-moving functions impressed by trade-based cash laundering schemes. Traded items can provide a disguise for the worth being transferred from one member to a different of the community, as per the report.

The strategies of elevating or switch of funds for terror financing as highlighted within the report embrace trafficking of people/ items/ medicine/ wildlife articles, digital belongings, donations, crowdfunding, use of shell entities, shell financial institution accounts and speedy money withdrawals, cell functions, misuse of non-profit organisations, extortion, kidnapping for ransom, “hawala” channels, and many others.