How Did a Mumbai Advocate, Rashesh Bharatkumar Upadhyay, aka Rashesh Shah Become the Key Facilitator in a 28,000 Crore Cyber Fraud Laundering Web That Prey on Hundreds Across 20 States?
The Directorate of Enforcement arrested Mumbai based advocate Rashesh Bharatkumar Upadhyay also known as Rashesh Shah on 24.10.2026 under the Prevention of Money Laundering Act 2002 after intercepting him at the boarding gate of Chhatrapati Shivaji Maharaj International Airport in Mumbai as he prepared to board an early morning connecting flight to Delhi without any return booking. The interception received active support from Mumbai Customs and the Central Industrial Security Force.
The Special Court PMLA North Goa remanded him to ED custody till 29.10.2026. This arrest marked the seventh in an investigation that began with a single digital arrest complaint from Goa and expanded into a nationwide examination of banking transactions approaching 28,000 crore cash deposits near 2,900 crore more than 300 victim complaints and over 160 FIRs registered across 20 states and Union Territories with reported losses exceeding 400 crore.
The investigation traces its origin to FIR registered by Goa Police on 09.06.2025. Between 21.05.2025 and 02.06.2025 a Goa resident and her husband found themselves subjected to continuous video surveillance by individuals who claimed to represent the Telecom Regulatory Authority of India and the Central Bureau of Investigation. The woman was shown what was described as a forged Supreme Court order and instructed to transfer funds into accounts presented as Secret Supervision Accounts.
Approximately 2.6 crore moved from the victims into accounts that investigators later linked to a far larger structure. Within hours the funds were said to have been fragmented across dormant and newly opened accounts before spreading into more than 400 beneficiary accounts. From there the trail led into an interconnected web of commodity trading travel and foreign exchange companies allegedly controlled by Fahim Moin Hussain Sayed and Naim Mueen Sayyed through persons of modest means listed as directors.
What does it reveal about systemic vulnerability when a single complaint of 2.6 crore opens a window onto banking activity measured in tens of thousands of crore. The network entities together undertook banking transactions exceeding 27,850 crore and deposited approximately 2,904 crore in cash of which 584.70 crore passed through 61,448 separate transactions at bulk note acceptance machines across multiple locations.
These accounts surfaced in 330 victim complaints and 163 FIRs spanning 20 states and Union Territories with aggregate reported losses of 417.49 crore. In numerous instances money belonging to one victim was routed into two or more entities of the same group during the same fraud indicating that the accounts functioned as a common pool rather than discrete businesses. The scale of cash handling through bulk note machines alone raises questions about the effectiveness of existing monitoring systems that allow such volumes to move without earlier disruption.
Rashesh Upadhyay entered this picture as the individual said to have performed a specialised function whenever accounts linked to the network faced restrictions following cybercrime complaints. Investigators described him as a key node who fixed payment amounts collection points and onward transfers of cash through intermediaries known as angadiyas. On his own admission he arranged the unfreezing of about 100 such accounts for various agents including one instance involving a payment of more than 60 lakh.
By restoring access to frozen proceeds the alleged mechanism allowed the network to continue moving funds that law enforcement actions had sought to immobilise. The fact that an enrolled advocate is said to have performed this role without ever filing a vakalatnama or appearing in court for the co accused or their companies sharpens the interrogative focus on the boundary between professional activity and facilitation of restricted account release.
The earlier arrests illuminate a compartmentalised structure. Fahim Moin Hussain Sayed and Naim Mueen Sayyed were identified as the alleged controllers of the commodity trading travel and foreign exchange entities. Chartered accountant Bhushan Suryakant Moye was linked to the incorporation of approximately 21 companies. Vilas Narayan Pawar and Shailesh Dagdu Chavan were associated with facilitating cash transactions against bank transfers.
Mukesh Kumar Pukhraj Jain also known as Mukesh Bhai was connected to arranging RTGS credits into network linked accounts in exchange for cash and commission. The addition of the advocate as the seventh arrest completes a picture in which different actors handled company formation banking entries cash conversion and the critical task of overcoming account freezes. How many more layers remain unexamined when such specialised roles already surface across the investigation.
The movement of funds followed a pattern that exploited both digital fragmentation and physical cash handling. Proceeds from digital arrest and other cyber frauds entered initial receiving accounts often dormant or freshly opened. Transfers then scattered the money across hundreds of mule accounts before consolidation into the business entities. Cash withdrawals and redeposits through bulk note acceptance machines converted digital credits into physical currency that could be moved outside ordinary banking visibility.
Portions were said to have been converted into foreign currency through licensed money changers. The repeated layering creates a cumulative transaction volume far larger than any single victim loss. A transfer of 10 lakh that moves through successive accounts can generate multiple times that figure in aggregate banking turnover while the original amount remains limited. Distinguishing original proceeds from repeated transfers therefore becomes essential yet the public figures of nearly 28,000 crore in transactions and roughly 2,900 crore in cash deposits stand as markers of the volume that investigators have so far mapped.
The allegation that dealings continued even after ED searches including activity involving accounts frozen by the agency itself adds another layer of concern. Upadhyay is said to have deleted chats with co accused persons and switched off known mobile numbers before the attempt to leave Mumbai. If communications were recovered from devices or recipients they would require precise mapping against the timeline of freezes unfreezes and cash movements.
The interception at the airport boarding gate without a return booking forms part of the sequence presented to the court yet the full significance of travel plans deletion of messages and continued activity after searches rests on the underlying records of account restrictions payment schedules and digital extractions.
The use of companies with directors drawn from employees drivers and residents of small tenements while actual control of bank accounts and decisions allegedly rested elsewhere raises further questions about beneficial ownership. Incorporation records KYC documents submitted to banks authorised signatory details and internet banking access logs become critical for determining who directed the flow of funds.
When the same set of entities appears across dozens of unrelated victim complaints the pattern suggests coordinated infrastructure rather than isolated business activity. The reported losses of over 400 crore represent only the complaints linked to these accounts. The true number of affected individuals may be higher if additional cases remain unconnected or unreported.
Digital arrest itself operates through sustained psychological pressure. Continuous video surveillance isolation from family and banks presentation of forged judicial documents and the invention of secret supervision accounts create an environment in which victims transfer life savings under the belief that they are complying with official process.
The Goa case lasting from 21.05.2025 to 02.06.2025 illustrates how such coercion can extract 2.6 crore before the victim is able to approach genuine authorities. Once the money enters the network the subsequent fragmentation across 400 accounts and conversion into cash and foreign currency makes recovery difficult. Each additional account that is unfrozen after a freeze multiplies the opportunity for further dissipation.
The presence of bulk note acceptance machine deposits totalling 584.70 crore across 61,448 transactions provides a concrete data point for examining cash intensive activity. Investigators can compare timestamps machine locations account ownership and corresponding incoming transfers to test whether deposits aligned with suspicious inflows.
The overall cash deposit figure of approximately 2,904 crore sits within the larger transaction volume and should not be added to it. Reported victim losses of 417.49 crore measure something different again the aggregate of complaints associated with the network accounts. These three measures transaction volume cash deposits and reported losses must be kept distinct if the actual scale of proceeds of crime is to be understood.
The advocate status of the seventh accused brings professional confidentiality into the frame. Communications made in furtherance of an illegal purpose or showing the commission of a crime or fraud fall outside ordinary protection. The absence of any vakalatnama or court appearance for the co accused or their companies is presented as evidence that the role was not conventional legal representation.
Whether specific messages or instructions crossed that boundary depends on the content purpose and surrounding circumstances of each communication. The investigation continues to examine the identities of officials said to have received payments and the intermediaries who moved the cash. No officials have been publicly named.
What remains visible is a structure capable of absorbing proceeds from multiple cyber frauds dispersing them through layered accounts converting them into cash and restoring access whenever restrictions appeared. The original Goa transfer of 2.6 crore served as an entry point into infrastructure that already handled volumes measured in thousands of crore. The unfreezing of approximately 100 accounts including instances involving payments above 60 lakh kept that infrastructure operational.
The arrest at the airport on 24.10.2026 and the remand till 29.10.2026 place one more individual in custody yet the full mapping of beneficial owners payment trails digital records and the precise relationship between each complaint and the network accounts continues. The numbers 28,000 crore in transactions 2,900 crore in cash deposits 300 plus complaints 160 plus FIRs 400 plus crore in losses and 7 arrests stand as the current public measure of a network whose operations left victims across 20 states and Union Territories with emptied accounts and unresolved recovery.
The pattern of using persons of limited means as directors while control resided elsewhere the rapid fragmentation of funds the heavy reliance on bulk cash deposits and the specialised function of arranging account releases together form a system that adapted to enforcement actions rather than collapsing under them. Each time an account was frozen the alleged intervention restored liquidity. Each time money moved through successive layers the original source became harder to trace.
The cumulative effect is a volume of activity that dwarfs individual losses while the victims themselves confront the practical difficulty of identifying recoverable assets. The seventh arrest brings into focus the role that made continued operation possible after freezes. The underlying questions of who ultimately benefited from the restored accounts who directed the cash payments and how many additional accounts and entities remain outside the present mapping define the unfinished scope of the inquiry.
