Federal anti-money laundering investigators apprehended Mumbai advocate Rashesh Bharatkumar Upadhyay at Chhatrapati Shivaji Maharaj International Airport as he attempted to board a one-way flight to New Delhi. The Enforcement Directorate (ED) Panaji Zonal Office took Upadhyay into custody under the Prevention of Money Laundering Act (PMLA) following joint interception support from Mumbai Customs and the Central Industrial Security Force (CISF).
Following the arrest, a Special PMLA Court in North Goa granted ED custody of Upadhyay through October 29. Investigators identified Upadhyay, also known as Rashesh Shah, as a critical operative and "lien-fixer" within an expansive illicit syndicate that moved roughly ₹28,000 crore through sophisticated cyber operations, according to SSBCrack's investigative report.
The Mechanism Behind the ₹28,000 Crore Laundering Network
The federal money-laundering investigation originated from a criminal complaint registered by the Cyber Crime Police Station in North Goa in June 2025. In that case, a Goa-based couple fell victim to a prolonged "digital arrest" scheme. Fraudsters impersonating officials from the Telecom Regulatory Authority of India (TRAI) and the Central Bureau of Investigation (CBI) held the victims under continuous video surveillance, displayed counterfeit Supreme Court orders, and coerced the transfer of ₹2.60 crore into fraudulent "Secret Supervision Accounts."
Financial tracking revealed that the stolen funds were disbursed through more than 400 mule accounts linked to shell entities spanning commodities, travel, and foreign exchange, managed via dummy directors. ED findings indicate the syndicate deposited an estimated ₹2,900 crore to ₹2,904 crore in cash, heavily utilizing Bulk Note Acceptance Machines, before converting illicit gains into foreign currency through licensed money changers.
| Investigation Metric | Verified Scale & Detail |
|---|---|
| Total Network Transaction Volume | Nearly ₹28,000 crore (earlier estimates cited over ₹27,850 crore) |
| Direct Cash Deposits | ₹2,900 to ₹2,904 crore via Bulk Note Acceptance Machines |
| Account Footprint | Over 400 mule accounts linked to shell companies |
| Nationwide Complaints & FIRs | Over 300 complaints and 160+ FIRs across 20 States/UTs |
| Aggregated Victim Losses | Exceeding ₹400 crore (documented up to ₹417.49 crore) |
Role of the Accused and Procedural Next Steps
Upadhyay represents the seventh arrest in the expanding probe, following the earlier detention of alleged syndicate controllers Fahim Moin Hussain Sayed and Naim Mueen Sayyed in August. Investigators allege Upadhyay worked to lift regulatory liens and unfreeze tainted bank accounts flagged by law enforcement, allowing the syndicate to maintain liquid access to defrauded capital.
With custody secured through October 29, ED interrogators are focusing on tracing cross-border foreign exchange outflows and identifying additional legal intermediaries who facilitated the multi-state scheme.
Key Factual ClarificationsEditorial Q&A
What is a digital arrest scam?
A digital arrest scam is a cyber fraud tactic where criminals impersonate law enforcement, regulatory bodies, or judicial authorities via video calls. They falsely claim the victim is implicated in serious financial or legal crimes, display forged warrants or court orders, and isolate them under continuous visual monitoring until funds are transferred to designated accounts.
Can scamming suspects be legally arrested under money laundering statutes?
Yes. When proceeds from cybercrime and fraud are routed through financial channels, disguised through shell firms, or converted via mule networks, agencies like the Enforcement Directorate invoke the Prevention of Money Laundering Act (PMLA) to arrest facilitators and freeze assets.
What should victims do if targeted by fraudulent legal notices?
Legitimate judicial and law enforcement agencies do not conduct arrests or demand asset inspections over private video calls. Any individual receiving demands to deposit funds into "supervision" or "safe" government accounts should immediately report the incident to local cybercrime units and log a formal complaint on national cybercrime portals.



