The Enforcement Directorate has arrested a Mumbai-based advocate for allegedly helping a nationwide cyber-fraud network regain access to frozen bank accounts by arranging cash bribes through intermediaries.
Rashesh Bharatkumar Upadhyay, also known as Rashesh Shah, was arrested by the ED’s Panaji unit on October 24 while he was at Mumbai’s Chhatrapati Shivaji Maharaj International Airport.
The agency alleges that Upadhyay facilitated the unfreezing of around 100 bank accounts linked to the suspected laundering network.
His arrest is the seventh in an investigation involving bank transactions of nearly ₹28,000 crore.
That figure represents the volume of transactions handled by the network and should not be treated as the amount lost by cybercrime victims.
FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders
Lawyer Allegedly Helped Restore Frozen Accounts
The ED alleges that Upadhyay became involved when law-enforcement agencies froze bank accounts after receiving cyber-fraud complaints.
According to the agency, he arranged cash payments to secure the release of those accounts.
The money was allegedly moved through intermediaries known as angadiyas, informal couriers commonly used to transport cash and valuables.
ED claims Upadhyay decided the amount of money required, coordinated collection points and arranged its onward delivery.
Investigators say that around 100 accounts were unfrozen through this alleged mechanism.
In at least one instance, the alleged payment exceeded ₹60 lakh.
The identities of officials suspected of receiving such payments have not yet been publicly established.
The allegations against Upadhyay and others remain subject to investigation and trial.
Arrest Made at Mumbai Airport
Upadhyay was intercepted at the boarding gate at Mumbai airport while preparing to take a flight to Delhi.
The operation was carried out with assistance from Customs officials and the Central Industrial Security Force.
He was subsequently taken to Goa and produced before a special Prevention of Money Laundering Act court.
The court remanded him to ED custody until October 29.
The agency alleges that Upadhyay had switched off his known mobile numbers and deleted communications with co-accused persons before the arrest.
ED has described his actions as an attempt to avoid investigation.
Upadhyay is enrolled as an advocate.
However, investigators claim he had not appeared in court or filed a vakalatnama on behalf of the accused persons or companies linked to the case.
The agency alleges that his role was instead connected to brokering payments and facilitating the release of frozen funds.
Probe Began With ₹2.60 Crore Digital Arrest Scam
The wider investigation began with a Goa Police FIR registered after a woman and her husband were allegedly cheated of about ₹2.60 crore through a digital arrest scam.
Fraudsters allegedly posed as officials from the Telecom Regulatory Authority of India and the Central Bureau of Investigation.
The victims were allegedly kept under continuous video surveillance and threatened with arrest.
Investigators say the scammers also showed them a forged Supreme Court order to make the threats appear genuine.
The couple was then allegedly persuaded to transfer money into bank accounts described as “secret supervision accounts”.
No legitimate investigating agency uses such accounts or conducts digital arrests.
ED later traced the alleged proceeds through more than 400 mule bank accounts connected to commodity, travel and foreign-exchange businesses.
A mule account is a bank account used to receive or move money for someone else, often to make the original source of funds harder to trace.
Network Handled Nearly ₹28,000 Crore in Transactions
The scale of the case expanded substantially as investigators followed the money trail.
According to ED, companies and accounts linked to the suspected network recorded banking transactions of nearly ₹28,000 crore.
About ₹2,900 crore was allegedly deposited in cash.
The agency says accounts connected to the network have appeared in more than 300 cyber-fraud complaints and over 160 FIRs registered across 20 States and Union Territories.
Reported losses connected to those complaints exceed ₹400 crore.
These figures are different from the ₹28,000 crore transaction volume.
Large transaction turnover does not automatically mean that the entire amount represents criminal proceeds.
Investigators must still determine what proportion of the money was generated through fraud, layering or other unlawful activity.
Companies Allegedly Used Dummy Directors
ED alleges that a network of commodity, travel and foreign-exchange companies was operated using dummy directors.
The agency has identified Fahim Moin Hussain Sayed and Naim Mueen Sayyed as alleged controllers of parts of the network.
Investigators claim cyber-fraud proceeds moved through mule accounts before being withdrawn in cash or converted into foreign currency using authorised money changers.
Six people had already been arrested before Upadhyay.
The agency says some of them supplied bank accounts or helped move funds and restore access to frozen accounts.
The investigation is now focused on identifying the officials who may have accepted bribes, tracing angadiyas and other intermediaries, and establishing the full extent of the money-laundering chain.
Unfreezing Accounts Could Have Kept Fraud Network Active
The allegation against Upadhyay is significant because freezing bank accounts is one of the fastest ways police attempt to stop cybercrime proceeds from moving.
When a victim reports fraud, law-enforcement agencies can ask banks to place holds on suspected beneficiary accounts.
If those accounts are later released improperly, funds can be withdrawn, transferred or layered through additional accounts before investigators recover them.
ED alleges that the repeated unfreezing of accounts allowed the wider network to remain operational despite multiple complaints and investigations.
The agency is now examining whether corrupt assistance inside institutions helped cyber-fraud proceeds continue moving through the banking system.
No public finding has yet established the liability of any particular official.
What this means for you:
The case shows why quickly reporting online fraud can matter: frozen accounts can help stop stolen money from moving further. Victims should immediately call the national cybercrime helpline 1930 and report the transaction through the official cybercrime portal.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
