The Enforcement Directorate’s Panaji office has arrested three more people in a money-laundering investigation linked to a nationwide network allegedly used to move proceeds of “digital arrest” cyber fraud into cash and foreign currency.

The three arrested on August 27 are chartered accountant Bhushan Suryakant Moye, Vilas Narayan Pawar and Shailesh Dagdu Chavan, who were taken into custody under Section 19 of the Prevention of Money Laundering Act, 2002.

A Special Court under the PMLA in Goa has remanded the three accused to ED custody until September 1, taking the total number of people arrested in the case to five. Fahim Moin Hussain Sayed and Naim Mueen Sayyed were arrested earlier, on August 23.

The investigation began with FIR No. 17/2025, registered on June 9, 2025, at the Cyber Crime Police Station in North Goa, after a Goa woman was allegedly kept on a video call, made to believe that she was under criminal investigation and coerced into transferring ₹2,60,33,634 between May 21 and June 2, 2025.

According to the ED, the money was transferred into bank accounts falsely presented to the victim as “Secret Supervision Accounts”, after which it entered a wider financial network allegedly created to receive cyber-fraud proceeds as banking credits, convert them into cash and ultimately move the cash towards foreign-currency conversion.

The scale of the alleged network extends far beyond the original complaint, with the ED saying that accounts linked to the syndicate recorded banking transactions exceeding ₹27,850 crore, while entities associated with the network have been connected to 330 victim complaints and 163 FIRs registered across more than 20 states and Union Territories, involving reported losses of ₹417.49 crore.

How the Goa Woman Was Allegedly Forced to Transfer ₹2.60 Crore

According to the Enforcement Directorate, the victim was subjected to what investigators describe as a “digital arrest”, in which she was kept on a video call and allegedly made to believe that she was under investigation in a criminal case, with the callers posing as officials and using the threat of legal action to pressure her into transferring money.

Between May 21 and June 2, 2025, she allegedly transferred a total of ₹2,60,33,634 into bank accounts described to her as “Secret Supervision Accounts”, which the ED says were not official government accounts.

Investigators allege that the money was subsequently absorbed into an organised network that received cyber-fraud proceeds through bank transfers before converting them into cash, with the cash then allegedly moved towards foreign-currency conversion through companies holding Full Fledged Money Changer licences from the Reserve Bank of India.

How the Alleged Money-Laundering Network Worked

The ED’s investigation alleges that the fraud proceeds were not simply withdrawn after reaching the first set of accounts, but were instead moved through a layered network involving more than 400 beneficiary accounts, making the financial trail considerably wider than the original victim transactions.

According to the agency, the money was routed into companies whose directors on record were people of limited means, while the accounts were allegedly operated by other individuals, allowing the entities to function as fronts through which the proceeds of cyber fraud could be received and moved.

The agency has described a process in which the alleged proceeds first entered the network as banking credits, were then converted into cash and subsequently moved towards foreign-currency conversion. Companies holding Full Fledged Money Changer licences issued by the Reserve Bank of India were allegedly involved at the foreign-currency stage, although the ED has not publicly identified the licensed money changers or disclosed where the foreign currency ultimately went.

Investigators have linked the bank accounts associated with the entities to 330 victim complaints and 163 FIRs registered across more than 20 states and Union Territories, with reported losses in those cases amounting to ₹417.49 crore, according to the ED.

The ₹417.49-crore figure represents the reported losses associated with the complaints and FIRs, whereas the ₹27,850-crore figure represents banking transactions recorded in accounts linked to the alleged network, meaning the two figures measure different aspects of the financial activity under investigation.

What the ED Alleges About the Three Latest Arrests

The ED has attributed specific roles to the three men arrested on August 27, alleging that they helped establish, operate and move funds through different parts of the network.

According to the agency, Bhushan Suryakant Moye, a chartered accountant, incorporated 21 companies using identity documents supplied to him, and allegedly treated those companies and their 43 dummy directors as a single group, including while filing their income-tax returns.

Investigators allege that the companies were used to receive and move funds entering the network, while the individuals shown as directors on paper did not exercise actual control over the bank accounts.

The agency has alleged that Vilas Narayan Pawar handled the RTGS transfers through which the alleged proceeds of crime were moved into accounts linked to the network, while Shailesh Dagdu Chavan allegedly supplied cash against those transfers.

The premises of all three men were searched on August 21, six days before their arrests on August 27, while the two other accused, Fahim Moin Hussain Sayed and Naim Mueen Sayyed, had been arrested on August 23 and remain part of the same PMLA investigation.

₹27,850 Crore in Banking Transactions, ₹2,904 Crore in Cash Deposits

The figures emerging from the investigation indicate the scale of the financial network being examined by the ED, which has said that accounts linked to the syndicate recorded banking transactions exceeding ₹27,850 crore.

The agency has also identified around ₹2,904 crore in cash deposits linked to the network, of which approximately ₹584.70 crore was deposited through 61,448 bulk-note-acceptance-machine transactions at different locations.

The ED has connected the accounts of the entities involved to 330 victim complaints and 163 FIRs across more than 20 states and Union Territories, with reported losses of ₹417.49 crore, while the much larger banking turnover reflects the total transactions recorded through accounts associated with the alleged network rather than the amount directly reported stolen by victims.

Searches Uncover Cash as ED Traces the Network

The investigation has involved searches across Mumbai and Goa as the ED followed the movement of the alleged proceeds through the network.

On July 17, the agency carried out searches under Section 17 of the PMLA at 20 locations in Mumbai and Goa, followed by further searches on August 21, including at the premises of Moye, Pawar and Chavan.

According to the ED, the searches resulted in the seizure of ₹3.25 crore in cash, while bank accounts linked to the alleged syndicate containing more than ₹30 crore were frozen.

Investigators also seized digital devices, account books, financial records and statutory registers, which are being examined as part of the investigation into the movement of funds through the various entities and accounts.

The ED has further alleged that the laundering activity continued even after the July 17 searches and remained active until shortly before the August 23 arrests of Sayed and Sayyed, a development the agency has cited in seeking custodial interrogation of the accused as investigators attempt to establish the roles of the different individuals and entities and trace the movement of the alleged proceeds of crime.

Digital-Arrest Scams Form Part of a Wider Global Fraud Problem

The Goa case sits within a much wider expansion of social-engineering and impersonation fraud, although the available international data does not measure “digital arrest” scams as a single global category and therefore cannot be directly compared with India’s digital-arrest figures.

In INTERPOL’s Operation First Light 2026, a global anti-fraud operation involving 97 countries and territories, authorities identified more than 142,000 victims of social-engineering scams and analysed 152,808 cases, while the operation resulted in 5,811 arrests and the interception of approximately US$293 million in illicit assets. INTERPOL said the operation targeted social-engineering scams and associated money laundering, including impersonation, investment, romance and other forms of fraud.

The United States has also reported substantial losses from impersonation fraud. The Federal Trade Commission said consumers reported losing US$3.5 billion to imposter scams in 2025, with more than one million reports received during the year and reported losses nearly three times the level recorded in 2020.

India’s broader cyber-fraud figures show the scale of the problem domestically, even as complaints relating specifically to digital-arrest scams have declined. According to data placed before the Supreme Court by the Indian Cybercrime Coordination Centre, digital-arrest complaints registered on the National Cybercrime Reporting Portal fell from 1,23,672 in 2024 to 58,239 in 2025, and stood at 16,377 up to June 30, 2026.

The wider financial-cybercrime numbers remain substantial, with the Ministry of Home Affairs telling the Lok Sabha that more than 65.89 lakh financial-cyber-fraud complaints were reported through the National Cybercrime Reporting Portal between 2021 and 2025, involving reported losses of more than ₹55,050 crore. More than ₹8,189 crore was marked under lien during the period, while more than 1.95 lakh FIRs were registered in connection with financial cyber fraud complaints.

The distinction between the datasets is important: the decline in digital-arrest complaints does not mean cyber-enabled financial fraud as a whole has declined, while the international figures on social-engineering and impersonation scams encompass several forms of fraud that extend beyond the particular “digital arrest” model seen in India.

Investigation Continues

The ED’s investigation remains ongoing, with investigators examining the digital devices, account books, financial records and statutory registers seized during the searches, while the agency continues to trace the movement of funds through the more than 400 beneficiary accounts allegedly connected to the network.

The ED has not publicly disclosed where the foreign currency allegedly generated through the network ultimately went, nor has it identified the licensed money changers allegedly involved in that part of the operation, with those aspects of the financial trail continuing to be examined.

The case also highlights the mechanism behind a growing form of cyber-enabled fraud in which criminals impersonate law-enforcement or government officials, place victims under prolonged video-call surveillance and use the threat of arrest or criminal proceedings to make them transfer money themselves.

Authorities have repeatedly warned that no legitimate government agency conducts an arrest through a video call, and people who receive such calls should disconnect and report suspected cyber financial fraud through the national cybercrime helpline 1930.