The Enforcement Directorate (ED), Panaji Zonal Office, arrested Mumbai-based advocate Rashesh Bharatkumar Upadhyay (also known as Rashesh Shah) on 24 October 2026 under the Prevention of Money Laundering Act (PMLA), 2002. He was intercepted at a boarding gate of Chhatrapati Shivaji Maharaj International Airport in Mumbai while attempting to board an early-morning connecting flight to Delhi without a return booking.
Mumbai Customs and the Central Industrial Security Force (CISF) assisted in locating and apprehending him. A Special Court under the PMLA in North Goa remanded him to ED custody until 29 October 2026. This is the seventh arrest in the investigation.
The money-laundering probe stems from an FIR registered by the Cyber Crime Police Station, North Goa, on 9 June 2025. A Goa-based woman (and her husband) was allegedly subjected to a “digital arrest.” Fraudsters impersonating officials of the Telecom Regulatory Authority of India (TRAI) and the Central Bureau of Investigation (CBI) placed the couple under continuous video surveillance, displayed a forged Supreme Court order, and coerced the transfer of approximately ₹2.60 crore (₹2,60,33,634) between 21 May and 2 June 2025 into accounts falsely described as “Secret Supervision Accounts.” The funds were rapidly routed through more than 400 mule accounts linked to commodity, trading, travel, and foreign-exchange entities controlled through dummy directors.
According to the ED, the broader network handled banking transactions of nearly ₹28,000 crore (earlier estimates cited figures exceeding ₹27,850 crore) and deposited about ₹2,900–₹2,904 crore in cash, including substantial amounts via Bulk Note Acceptance Machines. Accounts linked to the network have surfaced in over 300 victim complaints and more than 160 FIRs (reports have cited 330 complaints and 163 FIRs) across 20 states and Union Territories, with aggregate reported losses exceeding ₹400 crore (one earlier ED figure was ₹417.49 crore). Proceeds were withdrawn in cash and converted into foreign currency through RBI-licensed money changers. The network’s controllers, Fahim Moin Hussain Sayed and Naim Mueen Sayyed, were among those arrested earlier (on 23 August 2026).
The ED described Upadhyay as a “key node” or “lien-fixer” in the network. Whenever bank accounts linked to the cyber fraud operations were frozen by law-enforcement agencies following complaints, he allegedly arranged their release by routing cash bribes to certain suspected officials through angadiyas (informal private cash-transfer intermediaries). He is said to have fixed bribe amounts, coordinated collection points, and arranged onward payments. On his own admission, he facilitated the unfreezing of about 100 such accounts for various agents, including one instance involving a payment exceeding ₹60 lakh. He allegedly continued these activities even after ED searches, including in respect of accounts frozen by the agency itself. He deleted chats with co-accused persons and switched off all his known mobile numbers before attempting to leave. Although enrolled as an advocate, he had neither appeared in court nor filed a vakalatnama on behalf of any of the accused or their companies; the agency stated that advocate-client privilege does not cover communications furthering illegal purposes such as bribery or fraud facilitation.
Earlier arrests in the case include the network controllers Fahim Moin Hussain Sayed and Naim Mueen Sayyed, as well as other agents involved in supplying banking entries and arranging account releases. The ED is continuing efforts to identify the officials who allegedly accepted bribes, trace the angadiyas and other intermediaries, and map the full proceeds of crime. The investigation underscores the scale of organised “digital arrest” scams, in which fraudsters impersonate authorities, place victims under virtual surveillance, and force large transfers into mule accounts that feed into sophisticated laundering networks.
(Note: Figures and details are drawn from ED statements and contemporaneous reports by PTI and other media outlets as of late October 2026. The case remains under active investigation.)
