The Enforcement Directorate has widened its money-laundering probe into a large cyber fraud network with the arrest of Mumbai-based advocate Rashesh Bharatkumar Upadhyay, also known as Rashesh Shah. The arrest was made on 24 October 2026 by the ED’s Panaji Zonal Office under the Prevention of Money Laundering Act (PMLA), 2002, after he was stopped at a boarding gate at Chhatrapati Shivaji Maharaj International Airport in Mumbai while trying to take an early-morning connecting flight to Delhi without a return booking.
Officials said Mumbai Customs and the Central Industrial Security Force (CISF) helped in locating and apprehending him. A Special Court under the PMLA in North Goa remanded him to ED custody until 29 October 2026. His arrest is the seventh in the case.
The case originated from an FIR filed by the Cyber Crime Police Station, North Goa, on 9 June 2025. According to the complaint, a Goa-based woman and her husband were allegedly trapped in a “digital arrest” scam. Fraudsters claimed to be officials of the Telecom Regulatory Authority of India (TRAI) and the Central Bureau of Investigation (CBI), kept the couple under continuous video surveillance, showed a forged Supreme Court order, and allegedly compelled them to transfer around ₹2.60 crore (₹2,60,33,634) between 21 May and 2 June 2025 into accounts described as “Secret Supervision Accounts.”
The ED said the money was then moved quickly through more than 400 mule accounts connected to commodity, trading, travel and foreign-exchange entities that were allegedly run through dummy directors. The agency has estimated that the wider network handled banking transactions of nearly ₹28,000 crore, with earlier figures cited at over ₹27,850 crore, and deposited about ₹2,900–₹2,904 crore in cash, including through Bulk Note Acceptance Machines.
According to the available details, accounts linked to the same network have figured in more than 300 victim complaints and over 160 FIRs across 20 states and Union Territories. Reports have cited 330 complaints and 163 FIRs, while aggregate losses have been put at more than ₹400 crore; one earlier ED figure was ₹417.49 crore. The alleged proceeds were withdrawn in cash and converted into foreign currency through RBI-licensed money changers. The network’s controllers, Fahim Moin Hussain Sayed and Naim Mueen Sayyed, were arrested earlier on 23 August 2026.
The ED described Upadhyay as a “key node” or “lien-fixer” in the alleged network. The agency claims that whenever bank accounts connected to the cyber fraud were frozen by law-enforcement agencies, he arranged their release by sending cash bribes to suspected officials through angadiyas, described as informal private cash-transfer intermediaries. It also alleged that he fixed bribe amounts, coordinated collection points and arranged onward payments.
The agency said that, on his own admission, he helped get about 100 such accounts unfrozen for different agents, including one instance involving a payment of more than ₹60 lakh. The ED further alleged that he continued these activities even after search operations, including in relation to accounts frozen by the agency itself. It said he deleted chats with co-accused persons and switched off all known mobile numbers before trying to leave Mumbai.
Although Upadhyay is enrolled as an advocate, the ED stated that he had not appeared in court or filed a vakalatnama on behalf of any accused person or company. The agency also said that advocate-client privilege does not extend to communications meant to further illegal acts such as bribery or fraud facilitation. These are the ED’s claims; the case remains under investigation.
Earlier arrests in the matter include the alleged network controllers Fahim Moin Hussain Sayed and Naim Mueen Sayyed, along with other agents said to have supplied banking entries and arranged account releases. The ED says it is now working to identify officials who allegedly accepted bribes, trace the angadiyas and other intermediaries, and map the full proceeds of crime. The investigation is part of a broader inquiry into “digital arrest” scams in which fraudsters impersonate authorities, place victims under virtual surveillance and force transfers into mule accounts.
The figures and details in the case are based on ED statements and contemporaneous reports by PTI and other media outlets as of late October 2026. The investigation is ongoing.
