Source : INDIA TODAY NEWS
For two weeks in May 2025, a woman in Goa was never alone. She was on a video call she could not end, watched constantly by callers posing as investigators, told she was under criminal scrutiny and had to prove her innocence to make it stop.
Between May 21 and June 2, 2025, under that unbroken surveillance, she transferred Rs 2,60,33,634, over Rs 2.6 crore, into accounts she was told were “Secret Supervision Accounts.”
advertisement
She filed an FIR at the Cyber Crime Police Station in North Goa. That single complaint set off an Enforcement Directorate (ED) investigation that would eventually surface a network spanning 20 states, 163 FIRs, and transactions worth more than Rs 27,850 crore.
FOLLOWING THE MONEY TRAIL
Investigators started where every case like this starts: tracing where her Rs 2.6 crore actually went. It did not sit anywhere.
Within hours of each transfer, the money moved through a first layer of dormant and newly opened bank accounts, accounts that appeared to have been created and left inactive specifically so they could be activated the moment stolen funds needed somewhere to land.
From there, it fractured further, split across more than 400 beneficiary accounts through a combination of bank transfers, cash withdrawals, self-cheques and payment gateways. Each of those channels leaves its own kind of trail, and each was used deliberately, ED officials say, to make the movement of one victim’s money look like hundreds of unconnected, everyday transactions.
The trail did not end there. It led investigators to an interconnected cluster of commodity trading, travel and foreign exchange firms, several of which held valid Reserve Bank of India licences as Full Fledged Money Changers, entities legally entitled to convert rupees into foreign currency for travellers and businesses.
According to the ED, that legitimacy was the entire architecture of the operation.
The network existed to take cyber-fraud proceeds, which arrive in bank accounts looking like perfectly ordinary credits, convert them first into cash, and then convert that cash into foreign currency through licenced channels, laundering stolen money using the same infrastructure genuine currency exchange runs on.
The scale, once investigators added it up, was extraordinary. These entities together had carried out banking transactions exceeding Rs 27,850 crore.
They had deposited close to Rs 2,904 crore in cash, and of that, Rs 584.70 crore had gone through Bulk Note Acceptance Machines alone, spread across 61,448 separate transactions at multiple locations. The ED’s own assessment of this pattern was blunt: cash handling on a scale “wholly inconsistent with any ordinary business.”
ONE VICTIM, THEN 329 MORE
What turned this from a single fraud case into a syndicate investigation was what the ED found sitting behind those same bank accounts. They were not connected only to the Goa woman.
Investigators established that the accounts were the subject of 330 victim complaints and 163 First Information Reports, filed across 20 states and union territories, adding up to an aggregate reported loss of Rs 417.49 crore.
The detail that convinced investigators they were looking at one coordinated operation, rather than a coincidence of several unlucky money changers, came from the overlap between complaints.
In 101 of the 330 cases, a single victim’s stolen money had been routed into two or more entities within the same group, during the course of one and the same fraud. The accounts, the ED concluded, were operating as a common pool rather than as separate, independently run businesses.
Behind the paperwork of these companies sat people with little real power over them. The ED found that the entities used to route the money had been incorporated in the names of employees, drivers and residents of single-room tenements, individuals of modest means who were listed on official records as directors.
The actual bank accounts and business affairs, investigators say, remained under the control of others entirely, with the named directors serving as little more than identities borrowed to keep the real operators off the record.
THE RAIDS, THE ARRESTS
Armed with this trail, the ED moved from financial tracing to physical searches. Under Section 17 of the Prevention of Money Laundering Act, officers searched 20 premises across Mumbai and Goa on July 17, 2026. A second, expanded round of searches followed at further premises on August 21.
The searches yielded Rs 3.25 crore in seized cash. Syndicate bank accounts holding balances of more than Rs 30 crore were frozen.
Officers also seized digital devices, books of account, financial records and statutory registers belonging to the network’s companies, all of which are currently under forensic examination and are expected to widen the scope of the case as they are analysed.
On August 23, 2026, the ED arrested Fahim Moin Hussain Sayed and Naim Mueen Sayyed under Section 19 of the PMLA. Both were produced before the Special Court (PMLA) in Goa the following day, August 24, and have been remanded to ED custody for five days, up to August 29.
The ED has said further investigation is under progress, and given the volume of records still being examined, more arrests and disclosures are considered likely as the case develops.
Announcing the arrests, the ED tied the case directly back to the pattern it says defines organised digital arrest fraud today: dormant accounts kept ready in advance, a layering network capable of splitting and moving money within hours, and licenced money changers willing to push stolen funds into foreign currency at scale, all built around victims who, like the woman in Goa, are made to believe they are cooperating with the law rather than being robbed by it.
The agency has repeated its standing advisory alongside the arrests: no Indian investigating or law enforcement agency places any person under “digital arrest,” conducts an investigation over video call, or requires money to be transferred to any account for “verification” or “supervision.”
Citizens receiving such a call are advised to disconnect immediately and report it on the national cybercrime helpline 1930 or at the cyber crime portal.
– Ends
SOURCE :- TIMES OF INDIA
