14 days under watch, Rs 2.6 crore gone: The digital arrest behind a Rs 27,850 crore bust

A Goa woman’s complaint over a so-called digital arrest led the Enforcement Directorate (ED) to a multi-state money laundering network with over 300 victims.

For two weeks in May 2025, a woman in Goa was never alone. She was on a video call she could not end, watched constantly by callers posing as investigators, told she was under criminal scrutiny and had to prove her innocence to make it stop.

Between May 21 and June 2, 2025, under that unbroken surveillance, she transferred Rs 2,60,33,634, over Rs 2.6 crore, into accounts she was told were “Secret Supervision Accounts.”She filed an FIR at the Cyber Crime Police Station in North Goa. That single complaint set off an Enforcement Directorate (ED) investigation that would eventually surface a network spanning 20 states, 163 FIRs, and transactions worth more than Rs 27,850 crore.

FOLLOWING THE MONEY TRAIL

Investigators started where every case like this starts: tracing where her Rs 2.6 crore actually went. It did not sit anywhere.Within hours of each transfer, the money moved through a first layer of dormant and newly opened bank accounts, accounts that appeared to have been created and left inactive specifically so they could be activated the moment stolen funds needed somewhere to land.

From there, it fractured further, split across more than 400 beneficiary accounts through a combination of bank transfers, cash withdrawals, self-cheques and payment gateways. Each of those channels leaves its own kind of trail, and each was used deliberately, ED officials say, to make the movement of one victim’s money look like hundreds of unconnected, everyday transactions.The trail did not end there. It led investigators to an interconnected cluster of commodity trading, travel and foreign exchange firms, several of which held valid Reserve Bank of India licences as Full Fledged Money Changers, entities legally entitled to convert rupees into foreign currency for travellers and businesses.

According to the ED, that legitimacy was the entire architecture of the operation.

The network existed to take cyber-fraud proceeds, which arrive in bank accounts looking like perfectly ordinary credits, convert them first into cash, and then convert that cash into foreign currency through licenced channels, laundering stolen money using the same infrastructure genuine currency exchange runs on.

The scale, once investigators added it up, was extraordinary. These entities together had carried out banking transactions exceeding Rs 27,850 crore.

They had deposited close to Rs 2,904 crore in cash, and of that, Rs 584.70 crore had gone through Bulk Note Acceptance Machines alone, spread across 61,448 separate transactions at multiple locations. The ED’s own assessment of this pattern was blunt: cash handling on a scale “wholly inconsistent with any ordinary business.”

ONE VICTIM, THEN 329 MORE

What turned this from a single fraud case into a syndicate investigation was what the ED found sitting behind those same bank accounts. They were not connected only to the Goa womanInvestigators established that the accounts were the subject of 330 victim complaints and 163 First Information Reports, filed across 20 states and union territories, adding up to an aggregate reported loss of Rs 417.49 crore.

The detail that convinced investigators they were looking at one coordinated operation, rather than a coincidence of several unlucky money changers, came from the overlap between complaints.

In 101 of the 330 cases, a single victim’s stolen money had been routed into two or more entities within the same group, during the course of one and the same fraud. The accounts, the ED concluded, were operating as a common pool rather than as separate, independently run businesses.

Behind the paperwork of these companies sat people with little real power over them. The ED found that the entities used to route the money had been incorporated in the names of employees, drivers and residents of single-room tenements, individuals of modest means who were listed on official records as directors.

The actual bank accounts and business affairs, investigators say, remained under the control of others entirely, with the named directors serving as little more than identities borrowed to keep the real operators off the record.