ED’s Panaji zonal office arrested Fahim Moin Hussain Sayed and Naim Mueen Sayyed on 23 August 2026 under Section 19 of the Prevention of Money Laundering Act (PMLA), 2002. They were produced before the special court (PMLA) in Goa on 24th August and have been remanded to ED custody for five days, up to 29 August 2026.
The investigation originated from a case registered by the cybercrime police station in north Goa, after a Goa resident allegedly lost ₹2.60 crore in a ‘digital arrest’ scam.
According to ED, the woman was led to believe she was under investigation and kept under continuous surveillance via a video call. The fraudsters allegedly coerced her into transferring ₹2.60 crore between 21st May and 2 June 2025, into accounts falsely described as ‘secret supervision accounts’.
₹27,850 Crore Moved through Network
ED said its investigation has uncovered an organised apparatus allegedly created to convert proceeds of cyber fraud, initially received as banking transactions, into cash and subsequently into foreign currency through entities holding Reserve Bank of India (RBI) licences as full-fledged money-changers.
The agency said the victim's money was moved within hours through a first layer of dormant and newly opened bank accounts. It was subsequently fragmented across more than 400 beneficiary accounts through bank transfers, cash withdrawals, self-cheques and payment gateways.
The trail eventually led investigators to an interconnected group of commodity, trading, travel and foreign-exchange entities, according to the agency.
The entities collectively undertook banking transactions exceeding ₹27,850 crore and deposited around ₹2,904 crore in cash, ED said.
Of this amount, ₹584.70 crore was deposited through 61,448 separate transactions at bulk note acceptance machines across multiple locations.
ED said the scale and pattern of cash handling were inconsistent with ordinary business activity.
Accounts Linked to 163 FIRs
The investigation has also revealed the extent to which the entities' bank accounts allegedly featured in cyber fraud cases across the country.
According to ED, the accounts of these entities are the subject of 330 victim complaints and 163 FIRs registered across 20 states and Union Territories (UTs). The complaints involve an aggregate reported loss of ₹417.49 crore.
In 101 complaints, money belonging to a single victim was allegedly routed into two or more entities belonging to the same group during the same fraud.
ED said this indicated that the bank accounts functioned as a common pool rather than being operated as independent business accounts.
Companies Allegedly Controlled through Proxy Directors
The investigation has also pointed to the alleged use of individuals from modest economic backgrounds as directors of companies through which the money was routed.
ED said several companies were incorporated in the names of employees, drivers and residents of single-room tenements, who were listed as directors in official records.
However, according to the agency, the bank accounts and affairs of these companies were actually controlled by other persons.
The alleged arrangement allowed the network to use apparently legitimate corporate and banking structures to move and layer proceeds generated from cyber fraud.
₹3.25 Crore Cash Seized
ED conducted searches under Section 17 of the PMLA at 20 premises in Mumbai and Goa on 17 July 2026, followed by searches at additional premises on 21 August 2026. During the searches, the agency seized cash amounting to ₹3.25 crore.
Bank accounts belonging to the alleged syndicate, with balances exceeding ₹30 crore, were also frozen, ED said.
Digital devices, books of account, records and statutory registers were seized and are being examined as part of the investigation.
ED Warns against ‘Digital Arrest’ Scams
The agency reiterated that no investigating or law-enforcement agency in India places people under ‘digital arrest’.
It also warned that genuine law enforcement agencies (LEAs) do not conduct investigations over video calls or demand that individuals transfer money to accounts for ‘verification’ or ‘supervision’.
ED urged people who receive such calls to disconnect immediately and report the matter through the national cybercrime helpline 1930 or the government’s cybercrime reporting portal.
The agency said further investigation into the money-laundering network is underway.
How the Alleged Money Trail Worked
According to ED's investigation, the alleged operation followed a multi-stage process:
Digital arrest fraud -> victim's bank transfer -> dormant/newly opened accounts -> hundreds of beneficiary accounts -> cash withdrawals and payment gateways -> interconnected business entities -> cash deposits -> foreign-currency conversion through licensed money changers
The scale of the transactions has prompted ED to examine whether the network was operating as a broader financial infrastructure for cyber-fraud syndicates across multiple states and UTs.
The agency's findings also highlight how proceeds from a single ‘digital arrest’ fraud can rapidly move through numerous bank accounts, making the money trail more difficult to track and potentially enabling the conversion of cyber-fraud proceeds into cash and foreign currency.
