Shehzad Bhatti’s network: How social media, hawala & a shadow army shape Pakistan gangster’s India ops
Central agencies and multiple state police forces have intensified action against a Pakistan-based criminal network that recruits young men in India through social media, moves funds through informal channels, and gradually escalates recruits from minor tasks to serious violent crime.
The network is reported to use disposable SIM cards, UPI/QR-code transfers, and encrypted communication to route small payments for low-level tasks and larger sums for serious offences, resembling classic hawala-style informal value transfer combined with digital payment rails.
Enforcement action has invoked multiple statutes, including the Unlawful Activities (Prevention) Act (UAPA), the Bharatiya Nyaya Sanhita (BNS), the Arms Act, the NDPS Act, and the Explosives Act, with dozens of FIRs, arrests, and social-media takedown notices recorded so far.
The case has been described by investigators as a hybrid criminal-terrorist structure, blurring the line between organised crime (extortion, weapons and narcotics smuggling) and terrorism (targeted attacks, use of a militant-sounding cover identity, reconnaissance of sensitive installations).
Hawala and Informal Value Transfer Systems in Terror Financing
Hawala is an informal, trust-based money transfer system operating outside formal banking channels, where funds are moved through a network of brokers using coded instructions rather than physical cash movement across borders. It is a longstanding concern in terror-financing and money-laundering investigations because it leaves a minimal paper trail. Modern variants increasingly hybridise hawala with formal digital rails, such as UPI transfers and disposable financial instruments, making detection harder for enforcement agencies.
Key Details
- The Prevention of Money Laundering Act, 2002 (PMLA), in force since 2005, criminalises money laundering and empowers the Enforcement Directorate to attach and confiscate proceeds of crime, including funds routed through hawala.
- The Financial Action Task Force (FATF) is the global inter-governmental body that sets standards on anti-money laundering (AML) and countering the financing of terrorism (CFT); India has aligned its legal framework, including UAPA amendments, to meet FATF recommendations.
- The UAPA, 1967 was amended in 2008 to empower the central government to freeze, seize, or attach funds linked to terrorism financing, and further amended in 2019 to allow designation of individuals (not just organisations) as terrorists.
The network's use of UPI/QR codes, encrypted channels, and disposable SIMs alongside traditional hawala-style trust networks illustrates the evolving terror-financing typologies that FATF-aligned Indian laws (PMLA, UAPA) are designed to counter, and shows why financial-intelligence tracking is as central to counter-terror operations as physical interdiction.
National Investigation Agency (NIA) and Federal Counter-Terror Architecture
The National Investigation Agency is India's central counter-terrorism law enforcement body, created under the National Investigation Agency Act, 2008, in the aftermath of the 26/11 Mumbai attacks, to investigate and prosecute offences affecting the sovereignty, security, and integrity of India, including those with cross-border and inter-state dimensions. The NIA Act was amended in 2019 to expand the agency's jurisdiction to human trafficking, cyber-terrorism, and offences under the Explosive Substances Act, and to permit investigation of offences committed against Indian citizens or interests outside India.
Key Details
- The NIA operates alongside state police Special Task Forces (STFs) in cases with cross-border or multi-state ramifications, a coordination structure seen in the response to this network across states including Delhi, Haryana, Uttar Pradesh, Rajasthan, Punjab, and Uttarakhand.
- Offences under the UAPA are typically probed either by the NIA directly or by state police with NIA oversight, depending on the scale and cross-border linkage of the case.
- The use of a pseudo-organisational cover identity by a criminal network to project itself as an independent terror outfit is a recognised tactic that complicates attribution and investigation.
The involvement of the NIA alongside multiple state police forces reflects the standard federal-state coordination model for cases combining organised crime (arms and narcotics smuggling) with terrorism-adjacent activity (attacks on religious leaders, political and police targets), which is the precise jurisdictional overlap the NIA Act was designed to address.
- Over 80 FIRs have been filed under UAPA, BNS, the Arms Act, the NDPS Act, and the Explosives Act in connection with the network's India operations.
- More than 200 arrests and over 100 social-media takedown notices have been recorded in the enforcement action so far.
- Payments for low-level tasks were reported in the range of roughly Rs 2,000 to Rs 10,000, rising for more serious assignments.
- The NIA Act, 2008 was enacted after the 2008 Mumbai terror attacks and amended in 2019 to widen its jurisdictional scope.