ED arrests advocate over Rs 28,000-crore pan-India cyber fraud network

The ED is investigating alleged money laundering linked to a nationwide cyber-fraud and digital-arrest network. The network allegedly handled banking transactions worth nearly Rs 28,000 crore and deposited about Rs 2,900 crore in cash. The investigation examines how fraud proceeds moved through accounts, companies, cash withdrawals, and currency exchanges.

The ED arrested advocate Rashesh Upadhyay, also known as Rashesh Shah, at Mumbai airport while he was travelling to Delhi. The agency told court that he was a key node. It alleged that he helped release bank accounts frozen after police complaints by bribing officials through “Angadiyas,” a private cash-dealing network.

Upadhyay was taken to Panaji and sent to ED custody until October 29. The agency is also trying to identify officials who allegedly accepted bribes, locate other intermediaries, and trace the full proceeds. The arrest brought the total number of arrests in the case to seven.

A digital arrest is a cybercrime tactic, not a real legal procedure. Fraudsters pretend to be police officers or other law-enforcement officials during audio or video calls. They tell victims that an investigation, arrest, or legal case is underway. The threat is designed to make people panic and obey quickly.

The criminals then pressure victims to transfer money online. They may claim the payment is needed for verification, bail, account checks, or another official-sounding reason. In the Goa case, a woman was allegedly placed under digital arrest and transferred Rs 2.60 crore to several mule accounts between May 21 and June 2, 2025.

The government has said digital arrest has no legal basis in India. People facing such calls should report them immediately through the national cybercrime helpline at 1930 or the cybercrime.gov.in portal. The case shows how impersonation and fear can turn a phone call into a major financial loss.

The alleged network operated at a very large financial scale. The ED said it handled banking transactions worth nearly Rs 28,000 crore and made cash deposits of about Rs 2,900 crore. Those figures describe money moving through accounts linked to the alleged operation, not necessarily confirmed losses.

The network’s accounts featured in more than 300 complaints by victims and over 160 first information reports. These reports came from 20 states and Union Territories. The agency said reported losses exceeded Rs 400 crore, showing the difference between the network’s transaction volume and the losses formally reported by victims.

The scale makes the investigation broader than a single fraud complaint. The ED is tracing funds across bank accounts, companies, cash handlers, money changers, and alleged bribery channels. It is also trying to identify officials and intermediaries who may have helped the network keep operating after accounts were frozen.

The alleged movement began when the Goa victim transferred Rs 2.60 crore to several mule accounts. These are accounts used to receive or move money for someone else. The ED said the funds were then transferred among 400 mule accounts linked to commodity, travel, and foreign-exchange companies.

Those companies were allegedly operated through dummy directors. This structure could make the real controllers harder to identify while allowing the money to pass through many businesses and accounts. The funds were later withdrawn in cash. Cash withdrawals can make the transaction trail more difficult to follow than direct bank transfers.

The cash was then allegedly converted into foreign currency through money changers licensed by the Reserve Bank of India. The ED is tracing the complete flow and identifying intermediaries involved. The reported route illustrates how stolen money can be layered through accounts, companies, cash, and currency exchanges.

Money laundering is the process of moving or disguising money obtained through crime so its origin becomes harder to detect. It commonly involves several transfers, business accounts, cash withdrawals, or conversions into other assets or currencies. The aim is to hide the connection between the money and the original offence.

In this case, the alleged cyber-fraud proceeds moved through mule accounts, companies operated through dummy directors, cash withdrawals, and foreign-currency exchanges. Those steps are why the investigation focuses not only on the alleged fraud, but also on how the money was handled afterward. The ED alleges that banking transactions and cash deposits were part of a much larger network.

The Prevention of Money Laundering Act provides the legal framework for investigating suspected laundering and tracing crime proceeds. The ED is examining whether the alleged fraud money was concealed, transferred, or handled through intermediaries. It is also seeking the full proceeds and the people who helped move them.

When banks freeze accounts linked to suspected cybercrime, the account holders may lose access to transfers, withdrawals, and other banking services. The freeze can preserve records and prevent suspected proceeds from being quickly moved elsewhere. It can also disrupt the network’s ability to receive new fraud payments or pay intermediaries.

The ED alleged that Upadhyay helped release accounts after police complaints led to freezes. According to the agency, he arranged bribes to officials through “Angadiyas,” a private network of people dealing in cash. If accounts were released, the alleged operators could again access money, move funds between accounts, and continue using the banking system.

The agency is trying to identify officials who allegedly accepted bribes, along with Angadiyas and other intermediaries. Establishing those links could show how the network responded to enforcement action. It could also help investigators trace additional proceeds and understand whether account releases enabled further fraud.

Banks and payment systems normally monitor transactions for unusual patterns, such as rapid transfers across many accounts, large cash activity, or links to reported fraud. They keep records of account holders, beneficiaries, payment paths, and withdrawals. When a transaction is reported as suspicious, institutions can restrict activity, preserve records, and share information with authorised investigators.

Regulators and law-enforcement agencies compare those records with complaints, first information reports, and intelligence from other institutions. They may follow money through mule accounts, companies, cash withdrawals, and currency exchanges. In this case, the ED is examining more than 300 complaints, over 160 FIRs, and accounts spread across 20 states and Union Territories.

Freezing accounts can prevent further movement, but investigators must also trace connected accounts and intermediaries quickly. Cooperation can reveal common beneficiaries and transaction patterns. The article shows why enforcement agencies are examining alleged bribery, Angadiyas, dummy directors, and money changers alongside the original cyber fraud.