It began with a phone call.

For the victim in Goa, it did not sound like a scam.

She was made to believe that she was under investigation and was kept under continuous surveillance through a video call. The people on the other side created an atmosphere of authority and fear, eventually convincing her to transfer ₹2.60 crore into accounts described to her as “Secret Supervision Accounts.”

Between 21 May 2025 and 2 June 2025, the money was transferred.

What happened next was far more complicated than a simple bank-to-bank movement.

According to the Directorate of Enforcement's press release dated 25 August 2026, the funds entered an organised network allegedly designed to convert cyber-fraud proceeds into cash and subsequently into foreign currency through entities holding licences as Full Fledged Money Changers.

The case is a powerful reminder that modern cyber fraud is no longer limited to the person making the fraudulent call.

Behind a single victim can be an entire financial network.

The ED Arrests Two Accused in the Goa Case

The Directorate of Enforcement's Panaji Zonal Office stated that it arrested Fahim Moin Hussain Sayed and Naim Mueen Sayyed on 23 August 2026 under Section 19 of the Prevention of Money Laundering Act, 2002.

They were produced before the Special Court (PMLA), Goa, on 24 August 2026 and were remanded to ED custody for five days, up to 29 August 2026.

The investigation originated from an FIR registered by the Cyber Crime Police Station, North Goa, concerning the alleged “digital arrest” fraud.

But the investigation quickly moved beyond the original fraud.

The focus became the financial trail.

Where did the victim's money go?

Who received it?

How quickly was it moved?

Which accounts were used?

And how was the money eventually converted into cash and foreign currency?

Those questions appear to have exposed a much larger network.

From One Victim to Hundreds of Bank Accounts

According to the ED, the victim's money was moved within hours through a first layer of dormant and newly opened bank accounts.

From there, it was fragmented across more than 400 beneficiary accounts through bank transfers, cash withdrawals, self-cheques and payment gateways.

This is where the case becomes particularly significant.

For someone looking at a single bank statement, an individual transaction may not immediately reveal the complete picture.

A transfer may look like an ordinary payment.

Another may look like a withdrawal.

Another may appear to be a business transaction.

But when investigators connect the accounts, transaction timings and movement of funds, a larger pattern can emerge.

In this case, the trail allegedly led to an interconnected group of commodity, trading, travel and foreign-exchange entities.

According to the ED, these entities together undertook banking transactions exceeding ₹27,850 crore and deposited approximately ₹2,904 crore in cash.

Of that cash, around ₹584.70 crore was deposited through 61,448 transactions at Bulk Note Acceptance Machines across multiple locations. The ED described the scale and pattern as inconsistent with ordinary business activity.

The Numbers Tell a Much Bigger Story

The original alleged fraud involved ₹2.60 crore.

But the investigation uncovered a network with financial activity running into thousands of crores.

That does not mean the entire ₹27,850 crore of banking transactions represents fraud proceeds.

It is important to distinguish between total banking activity described in the investigation and the reported proceeds or losses connected with the alleged offences.

The ED stated that the bank accounts associated with these entities were the subject of 330 victim complaints and 163 FIRs across 20 States and Union Territories, involving an aggregate reported loss of ₹417.49 crore.

In 101 complaints, the money belonging to a single victim was allegedly routed into two or more entities of the same group during the same fraud.

For investigators, that pattern was significant.

It suggested that the accounts were allegedly functioning as a common pool rather than as genuinely separate businesses.

The Companies Looked Separate. The Money Trail Told Another Story.

One of the most concerning aspects of the investigation is the alleged use of companies whose recorded directors were people of very modest financial means.

The ED stated that some companies were incorporated in the names of employees, drivers and residents of single-room tenements, while the actual bank accounts and affairs of those companies remained under the control of others.

This illustrates why KYC, beneficial ownership and financial due diligence matter so much.

A company's name, registered address or listed director may not always tell the complete story about who ultimately controls the financial activity.

For banks, financial institutions, Auditors, Compliance teams and regulators, understanding the source and movement of funds can be just as important as identifying the immediate account holder.

When Cyber Fraud Becomes a Money-Laundering Investigation

The Goa case also demonstrates how a cybercrime investigation can develop into a broader money-laundering investigation.

The original offence allegedly generated money.

The next challenge was to move that money through multiple accounts, convert it into different forms and potentially make its origin harder to trace.

That is where financial investigation becomes critical.

Investigators may examine:

• Bank account transactions
• Beneficiary relationships
• Cash withdrawals and deposits
• Payment gateway activity
• Company ownership
• Directors and beneficial owners
• Foreign-exchange transactions
• Digital devices
• Books of accounts
• Statutory records
• Links between apparently separate entities

In this case, the ED stated that searches were conducted at 20 premises in Mumbai and Goa on 17 July 2026, followed by further searches on 21 August 2026.

The investigation resulted in the seizure of ₹3.25 crore in cash, while syndicate accounts containing balances exceeding ₹30 crore were frozen. Digital devices, books of account, records and statutory registers were also seized for examination.

The Most Important Warning Is Simpler Than the Money Trail

Despite the complicated financial network described in the investigation, the public warning from the ED is extremely straightforward.

There is no such thing as a “digital arrest” conducted by an Indian investigating or law-enforcement agency.

According to the ED, no agency:

• Places a person under “digital arrest”
• Conducts an investigation through a video call
• Requires money to be transferred to an account for “verification”
• Requires money to be transferred for “supervision”

If someone makes such a demand, it should be treated as a fraud warning sign.

The ED has advised citizens receiving such calls to disconnect and report the matter through the national cybercrime helpline 1930 or the official cybercrime reporting portal.

Shunyatax's View: 

Follow the Money, Not Just the Story

At Shunyatax Global, we believe the most important lesson from cases like this extends beyond cyber fraud.

Financial crime increasingly leaves a digital and banking footprint.

Multiple accounts, unusual cash movements, rapid fund transfers, interconnected entities and unexplained transactions can create significant compliance and financial risks for businesses and individuals.

For businesses, maintaining proper accounting records, KYC documentation, beneficial ownership records, transaction trails and source-of-funds documentation is increasingly important.

If your business or organisation has received funds from unfamiliar parties, operates through multiple entities, handles large transactions, or needs help reviewing unusual financial activity, Shunyatax can assist with accounting, financial compliance, transaction review and advisory support.

The objective is not simply to maintain books.

It is to understand what the numbers are actually saying.