How SEBI Cracked a ₹143.79 Crore Stock Pump-and-Dump Network

By Atharva Kadu

SEBI’s final order in June 2026 exposed an alleged large-scale stock manipulation network involving Mauria Udyog Ltd., Vishal Fabrics Ltd., 7NR Retail Ltd., GBL Industries Ltd. and Darjeeling Ropeway Company Ltd. The scheme operated across the five stocks between 2017 and 2020 and involved 226 entities. According to SEBI, the network created artificial price and trading activity, promoted the shares through bulk SMS messages and websites, and later sold shares at elevated prices. The regulator found unlawful gains of about ₹143.79 crore.

Why the Investigation Was Needed

The investigation was needed because the trading activity did not appear to be driven only by normal investor interest. SEBI examined a pattern in which connected entities allegedly created artificial price and volume activity in relatively illiquid stocks, while bulk SMS messages and websites promoted the shares to outside investors. The regulator also needed to determine who benefited from the subsequent sale of shares and how the money moved between connected entities. By combining trading records with bank, demat, communication and digital records, SEBI was able to examine whether apparently separate participants were part of one coordinated network.

The Five Stocks at the Centre

Source: SEBI final order; Moneycontrol — five-stock pump-and-dump case.

The five companies were not simply treated as five unrelated stock cases. SEBI found a common thread: connected entities traded in these relatively illiquid scrips to create artificial price and volume activity, while buy recommendations were circulated to attract outside investors. The companies were Mauria Udyog Ltd. (MUL), Vishal Fabrics Ltd. (VFL), 7NR Retail Ltd., GBL Industries Ltd. and Darjeeling Ropeway Company Ltd. The alleged scheme was built around different groups performing different roles rather than one single trading account.

How the Pump-and-Dump Scheme Worked

Source: SEBI final order; Moneycontrol — explanation of the alleged modus operandi.

SEBI described three important roles in the alleged operation: Price-Volume Influencers, the SMS Sender and Off-loaders. The Price-Volume Influencers used synchronised, circular and otherwise connected trades to increase apparent activity and prices. Hanif Shekh was identified by SEBI as the alleged mastermind and SMS Sender. Buy recommendations were circulated through bulk SMSs, with websites also used for four of the five scrips. Once the stocks appeared more active and attractive, Off-loaders sold shares at higher prices. The sale proceeds were then moved through multiple entities and layers, according to the regulator.

The trading evidence showed unusually high activity. SEBI’s investigation recorded substantial contributions by connected entities to market buy and sell volumes in the five scrips. For example, connected entities accounted for 39.9% of market buy volume in Mauria Udyog Group 1, 44.83% in 7NR Retail, 32% in Darjeeling Ropeway, 20.10% in GBL Industries and 56.12% of BSE buy volume in Vishal Fabrics during the respective periods. These figures helped SEBI examine whether the apparent market interest was genuine.

How the Five Companies Got Involved

Source: SEBI final order — company-wise findings; Moneycontrol.

Mauria Udyog Ltd. formed one of the most detailed parts of the investigation. SEBI examined promoter-linked entities and identified 62 employees and labour contractors as alleged Off-loaders. Their bank accounts, demat accounts and income-tax records were examined. The regulator said several sale proceeds were later transferred to Mauria Udyog, promoter-linked entities or entities connected with Hanif Shekh. Mauria Udyog and other noticees disputed parts of these findings and said some transactions had legitimate explanations.

In Vishal Fabrics Ltd., SEBI identified a group of 15 connected entities, referred to in the order as the Chiripal Group, as Price-Volume Influencers during the pre-SMS period. The regulator said these entities were connected with promoter/promoter-group entities and traded among themselves and with other groups. The stock then saw a noteworthy increase in price and volume during the SMS period without a major corporate announcement, according to the order.

In GBL Industries Ltd., SEBI examined the role of the Gohil Group and other connected entities in the alleged scheme. The order described Gohil Group entities as participants who exited the stock and then transferred sale proceeds to Hanif Shekh or his connected entities through multiple layers. This fund movement was important to SEBI because it helped connect the trading activity in GBL with the wider network rather than treating the transactions as isolated trades. Connected entities accounted for 20.10% of the market buy volume in GBL Industries during the relevant period, which was one of the indicators examined by the regulator.

In Darjeeling Ropeway Company Ltd., SEBI identified connected traders, Off-loaders and conduit entities as part of the alleged operation. The regulator found that connected entities accounted for 32% of the market buy volume during the relevant period. As with the other stocks, SEBI examined whether trading by connected participants helped create artificial market activity and whether shares were later off-loaded at elevated prices. Fund-transfer patterns involving connected entities were also examined as part of the broader investigation.

For 7NR Retail Ltd., GBL Industries Ltd. and Darjeeling Ropeway Company Ltd., SEBI identified different groups of connected traders, Off-loaders and conduit entities. In the GBL case, for example, the order described Gohil Group entities transferring sale proceeds after their exit from the stock to Hanif Shekh or his connected entities through multiple layers. Similar fund-transfer patterns were examined in 7NR Retail and the other scrips. The common link across all five companies was the alleged coordinated creation of market activity, promotion to investors and later off-loading.

How SEBI Found the Network

Source: Moneycontrol — airline, hotel, food-delivery, website, telecom and WhatsApp evidence.

SEBI did not rely only on trading data. Investigators combined demat and bank records with call-detail records, WhatsApp communications, bulk-SMS gateway information, website ownership records, domain-registration histories and digital marketing records. The regulator also examined employee records and common identifiers such as addresses, contact details and recovery email IDs. This cumulative approach helped connect people and entities that appeared separate on paper.

The travel trail became especially important. Hanif Shekh argued that some mobile numbers used by SEBI belonged to employees rather than him. SEBI examined airline booking records, including records from IndiGo, and found that his admitted mobile number and email address had been used for flight bookings. Hotel reservations were used as corroborating evidence. Investigators also examined Zomato food-delivery records and telecom data to help establish ownership and links between individuals.

The promotional infrastructure also left a digital trail. SEBI examined GoDaddy domain-registration records, contact audit histories, administrator-access information, invoices from digital marketing agencies and website-management records. The regulator concluded that changes in registered ownership did not necessarily mean that effective control had changed. More than 2.1 crore bulk SMS messages were linked to one of the manipulated scrips, while campaigns across the five stocks reached more than 60,000 unique mobile numbers.

Following the Money Trail

Source: SEBI final order; Moneycontrol — trading and fund-flow analysis.

The investigation followed the money after the suspicious trades were identified. SEBI traced proceeds from share sales through multiple conduit entities, bank accounts and other intermediaries. According to the regulator, funds were layered through different accounts before reaching entities connected with the principal operators. This made the structure more difficult to detect from a single transaction.

The fund trail was important because the entity selling the shares was not always the entity that ultimately benefited. SEBI also noted that some entities continued trading even when they were making losses, which the regulator viewed as an indication that maintaining artificial market activity could itself have been part of the alleged strategy. The regulator relied on the combined pattern of trades, communications and fund transfers rather than one isolated transaction.

SEBI ultimately quantified unlawful gains at about ₹143.79 crore. The final order described the fund-transfer structure as complex and said it appeared designed to obscure the identity of the ultimate beneficiaries. The order also emphasised that the evidence came from multiple independent sources — trading records, digital communications, travel and food-delivery records, employee information and banking trails.

After Effects and What Investors Can Learn

Source: SEBI final order dated June 30, 2026; Moneycontrol, July 1, 2026.

SEBI imposed aggregate monetary penalties of about ₹47.8 crore, ordered disgorgement of approximately ₹143.79 crore along with applicable interest, and barred most noticees from accessing the securities market for four to seven years. Hanif Shekh received the toughest individual sanction highlighted in the Moneycontrol report: a ₹10-crore penalty and a seven-year market ban.

The case also shows that regulatory responsibility can extend beyond the person who sends a stock tip. SEBI examined Price-Volume Influencers, Collaborators, Off-loaders, financiers, conduit entities, promoter-linked participants and other connected persons. The final action covered a large network of 226 noticees, showing how regulators can reconstruct a scheme from many small pieces of evidence.

For investors, the lesson is simple: a sudden rise in a share price or trading volume does not automatically mean that a company’s business has improved. Unsolicited buy messages, promises of quick gains and recommendations that appear to come from familiar financial brands should be treated carefully. Investors should verify information independently and use SEBI-registered intermediaries rather than relying on anonymous stock tips.

Conclusion

The Mauria Udyog, Vishal Fabrics, 7NR Retail, GBL Industries and Darjeeling Ropeway case shows how a modern pump-and-dump operation can leave footprints far beyond the stock exchange. SEBI connected trading patterns with WhatsApp chats, bulk SMS systems, websites, airline bookings, hotel reservations, food orders and layered money transfers. The case is a strong example of how financial regulators are using digital evidence and cross-checking multiple records to identify coordinated market manipulation and protect investor confidence.