MUMBAI — The Mumbai Police Crime Branch has uncovered an expansive cyber fraud operation that functioned out of luxury villas in Goa, moving approximately ₹900 crore through thousands of mule bank accounts across India. Acting on intelligence that originated from a fictitious corporate office in South Mumbai, investigators raided Casa De Nicole, a rented villa in Candolim, on August 4, 2026. Inside the property, officers arrested 12 young men operating a round-the-clock money-laundering clearinghouse under the guise of tourists, seizing laptops, mobile phones, and dozens of banking kits tied to at least 186 registered cybercrime cases nationwide.
Round-the-Clock Operations Behind a Holiday Facade
The arrested men, comprising 11 individuals from Gujarat and one from Mumbai’s Jogeshwari neighbourhood, occupied rooms fitted with five to six workstations each. Working in three shifts, the group managed rapid fund transfers while receiving fixed monthly salaries of ₹35,000 alongside a 3 percent cut of the routed volumes. In their spare time, members frequented local nightclubs and casinos. A subsequent search of the premises yielded 15 laptops, 128 ATM cards, 85 mobile phones, 76 SIM cards, 22 cheque books, and 77 passbooks, prompting authorities to freeze approximately ₹120 crore held across 7,500 bank accounts. Francis, the owner of the villa, told police that he had leased the residence for two months for ₹1 lakh without any knowledge of the underlying illicit activities.
Five-Tier Syndicate Coordinated Across Dubai and Mumbai
The wider network functioned along a strict five-tier hierarchy spanning international borders. A Dubai-based entity occupied the apex, directing administrators in Goa who operated as local franchisees after allegedly paying an upfront fee of ₹50 lakh. Beneath them, networks of masters and supermasters procured and activated bank accounts, routing authentication hardware and SIM cards to Goa for live verification. The trail first surfaced in July 2026 during a raid on G.D. Overseas, a front company situated in Parsvnath Chambers at Masjid Bunder. Mohammad Shabbir Sheikh, an employee arrested at the site, told investigators he was hired in Dubai by a handler named Ranveer Kapoor, who promised up to ₹70,000 for each Mumbai current account established. Indian authorities are currently coordinating with counterparts in the United Arab Emirates to secure Kapoor’s extradition.
Rapid Transfers Executed Through Banker Panel Software
Central to the gang’s capability was a specialized application known as Banker Panel, which allowed operators to disperse illicit proceeds into multiple accounts simultaneously with a single command. By scattering funds within minutes, the syndicate bypassed the crucial initial window during which commercial banks typically freeze compromised balances upon receipt of victim complaints. Cash was subsequently withdrawn at automated teller machines or moved through angadia couriers to Dubai. In September, officers arrested Ahmedabad resident Bua Smith in Jaipur, who had allegedly coordinated the mule network on messaging channels under the alias Ashwathama. A parallel raid that month on a second Candolim villa, Sea Coast, led to 10 more arrests linked to a separate ₹400 crore operation, with investigators now probing wider conduits suspected to reach Sri Lanka and cryptocurrency channels.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
