A cyber fraud reported by one resident of Goa has led the Directorate of Enforcement to investigate a much larger financial network allegedly connected with hundreds of victim complaints across India.
According to an ED press release dated August 29, 2026, three more individuals—Bhushan Suryakant Moye, Vilas Narayan Pawar and Shailesh Dagdu Chavan—were arrested on August 27 under Section 19 of the Prevention of Money Laundering Act, 2002.
The arrests brought the total number of people taken into custody in this case to five. Fahim Moin Hussain Sayed and Naim Mueen Sayyed had previously been arrested on August 23, 2026.
The three latest accused were remanded to ED custody until September 1, 2026, by the Special PMLA Court in Goa.
What began with an alleged fraud of approximately ₹2.60 crore has revealed a network of more than 400 beneficiary accounts, 330 victim complaints and 163 FIRs across over 20 states and Union Territories. The accounts examined by investigators reportedly handled banking transactions exceeding ₹27,850 crore.
How the Victim Was Placed Under “Digital Arrest”
The ED initiated its investigation based on FIR No. 17/2025, registered on June 9, 2025, by the Cyber Crime Police Station in North Goa.
According to the press release, the victim was kept on a video call and made to believe that she was under criminal investigation. The fraudsters allegedly used fear, impersonation and continuous surveillance to prevent her from independently verifying their claims.
She was then coerced into transferring ₹2,60,33,634 to accounts falsely described as “Secret Supervision Accounts.”
The term sounds official but has no legitimate banking or law-enforcement purpose. Police agencies, courts, the Reserve Bank of India and central investigation agencies do not ask citizens to transfer money to secret accounts for verification or supervision.
Such scams commonly involve fraudsters pretending to be police officials, officers of investigating agencies, bank representatives or telecom regulators. Victims may be falsely accused of money laundering, narcotics trafficking or involvement in suspicious bank accounts.
The fraudsters then create urgency and warn the victim against speaking to family members, lawyers or local police.
From Bank Transfers to an Alleged Laundering Network
The ED investigation reportedly found that the stolen money did not simply remain in one account. It entered what the agency described as an organised apparatus designed to receive, move and convert proceeds generated through cyber fraud.
The alleged process involved several stages:
- Fraud proceeds entered the banking system as electronic credits.
- The funds were fragmented across numerous beneficiary accounts.
- Money was passed through companies and accounts controlled by other individuals.
- The electronic funds were converted into cash.
- The cash was allegedly converted into foreign currency through companies holding Full-Fledged Money Changer licences issued by the RBI.
Breaking funds into smaller amounts and routing them through multiple accounts can make it more difficult to identify their original source and final destination.
This practice is often called layering. Its purpose is to create multiple financial steps between the alleged crime and the ultimate beneficiary, making the money appear disconnected from its unlawful origin.
Under the PMLA, involvement may extend beyond the original cyber fraudsters. Those who knowingly assist in possessing, transferring, concealing, converting or projecting proceeds of crime as legitimate may also attract scrutiny.
More Than 400 Beneficiary Accounts Identified
The ED stated that the money was divided across more than 400 beneficiary accounts.
Some funds allegedly entered companies whose directors on official records were individuals of limited financial means. However, investigators believe that other persons were operating and controlling the accounts.
This difference between legal ownership and actual control is an important feature of financial investigations.
A person may appear as a director or authorised signatory in government and banking records, while another individual makes the commercial decisions and controls the Movement of money. Authorities may therefore examine beneficial ownership, device access, internet banking activity, telephone records and the circumstances under which a company was incorporated.
The agency alleges that these companies and accounts were used to project proceeds of crime as untainted funds.
330 Complaints and ₹417.49 Crore in Reported Losses
The scale of the suspected network extends significantly beyond the Goa victim.
According to the ED, accounts associated with the entities under investigation are linked to 330 victim complaints and 163 FIRs filed across more than 20 states and Union Territories.
The combined losses reported in these matters amount to approximately ₹417.49 crore.
The same accounts reportedly recorded banking transactions exceeding ₹27,850 crore. This figure represents the total volume of transactions identified in the accounts and should not automatically be interpreted as the total value of proven fraud or proceeds of crime.
Nevertheless, the difference between the reported victim losses and the overall transaction volume illustrates the complexity of the financial network being investigated. Accounts used for laundering may contain a mixture of alleged criminal proceeds, transfers between connected entities and other banking activity.
Investigators must therefore trace individual transactions and identify which amounts are linked to specific offences.
The Alleged Role of a Chartered Accountant
One of the arrested individuals, Bhushan Suryakant Moye, is identified in the ED press release as a Chartered Accountant.
The agency alleges that he incorporated 21 companies within the network using identity documents supplied to him. It further claims that he managed those companies and their 43 dummy directors as a single group.
According to the ED, the Income-tax returns of these companies were filed collectively as one exercise rather than handled as genuinely independent assignments.
The allegations highlight the responsibility of professionals involved in company formation, taxation and financial reporting. Incorporation documents, director identification, registered-office details and tax filings can lend an appearance of legitimacy to an entity.
Professionals are therefore expected to understand who actually controls the company, verify client identities and remain alert to structures that lack genuine business activity or commercial independence.
Professional credentials do not establish wrongdoing, and the allegations remain subject to investigation and adjudication. However, the case shows why accountants and other advisers may face scrutiny when their services are allegedly used to build or maintain a financial network.
The Alleged Roles of the Other Accused
The ED has attributed specific functions to the other two individuals arrested on August 27.
Vilas Narayan Pawar allegedly arranged the RTGS entries through which the suspected funds entered accounts within the network.
Shailesh Dagdu Chavan allegedly supplied cash against those electronic transfers.
This arrangement would have allowed funds received through bank accounts to be converted into physical cash. The cash could then allegedly be moved or converted into foreign currency, making the original transaction trail harder to follow.
The premises of all three individuals were searched on August 21, 2026.
The ED stated that the alleged laundering activity continued even after earlier searches conducted on July 17 and persisted until shortly before the first arrests on August 23. The agency cited this continued activity as a reason for making the arrests and seeking custodial interrogation.
What Businesses and Professionals Should Learn
The case demonstrates that company incorporation, banking activity and regulatory registrations do not make a transaction legitimate by themselves.
Banks, accountants, directors and regulated financial businesses should remain alert to warning signs such as:
- Multiple companies controlled from one location
- Directors who cannot explain the company’s activities
- High transaction volumes inconsistent with the stated business
- Frequent transfers followed by immediate cash withdrawals
- Payments received from unrelated individuals across different states
- Companies operating only as fund-routing channels
- Unusual requests to exchange large amounts of cash into foreign currency
- Tax returns and records prepared without genuine operational independence
Customer verification should extend beyond collecting identity documents. Where the transaction pattern does not match the customer’s profile, additional examination may be necessary.
Shunyatax Global Insights
This investigation shows how cyber fraud proceeds can move through bank accounts, companies, cash channels and foreign-currency businesses before appearing disconnected from the original offence.
Businesses and professionals must verify beneficial ownership, understand the purpose of significant transactions and maintain a clear financial trail. Proper documentation is important, but it must also reflect genuine commercial activity.
If you or your business is facing challenges involving suspicious transactions, financial documentation, corporate structuring or regulatory compliance, Shunyatax Global can provide professional guidance to help you respond with clarity and confidence.
📞 +91 94615 14198
Disclaimer: This article is based on the Directorate of Enforcement’s press release dated August 29, 2026. The individuals mentioned are accused, and the allegations remain subject to investigation and adjudication. This article is for general information and does not constitute legal or financial advice.