Noida: More than 50 money changer companies based in Noida have come under the Enforcement Directorate’s (ED) scanner during an investigation into a network allegedly involved in converting and routing proceeds of cyber fraud. The agency has reportedly obtained digital evidence linked to these firms and is expected to question their operators and other individuals connected with the network. Investigators suspect that money obtained through cyber fraud was moved through multiple domestic accounts before being converted into cash and foreign currency for transfer abroad.
The details emerged during questioning of Faheem Moin Hussain Saiyed and Naeem Hussain Saiyed, who were arrested in connection with a digital arrest case in Goa. Following permission from a special court, the ED has been questioning the two accused about the alleged financial network. According to the investigation, the network has links to 163 cyber fraud cases registered across the country.
₹260 Million Digital Arrest Fraud Exposes Money Trail
According to the ED, a man in North Goa was allegedly subjected to a digital arrest scam between May 21 and June 2, 2025, during which approximately ₹260 million was transferred by the victim. After a case was registered in Goa, the agency began tracing the movement of the money.
The investigation allegedly found that Faheem and Naeem used licensed money changers to convert proceeds of cyber fraud into cash and subsequently into foreign currency. Investigators have also identified transactions exceeding ₹27,850 crore through the wider network. Around ₹2,904 crore was allegedly deposited in cash, highlighting the scale of the financial activity being examined.
Investigators are now examining the bank accounts, businesses and intermediaries that were allegedly used to move the money through multiple layers.
Money Moved Through Multiple Layers Within Hours
According to the ED’s findings, large amounts generated through cyber fraud were initially transferred into dormant or newly opened bank accounts. The money was then distributed through multiple channels, including transfers between accounts, cash withdrawals, self-cheques and payment gateways.
The investigation has identified around 400 beneficiary accounts allegedly used to distribute the funds. After passing through these accounts, portions of the money allegedly reached networks associated with commodities, trading, travel and foreign exchange businesses.
The multiple layers of transactions are believed to have made it difficult to establish the original source and final destination of the funds.
Following the arrests of Faheem and Naeem, the ED conducted searches at around 20 premises in Mumbai and Goa. Approximately ₹30 crore was frozen during the operation, according to the investigation. The agency is now expanding its scrutiny to Noida-based money changers and foreign exchange agencies whose digital records allegedly show links with the network.
Sector 18 Emerges as Major Money-Changing Hub
Noida has a substantial money-changing and foreign exchange business, with Sector 18 considered one of the city’s major hubs. More than 300 money changers and foreign exchange agents are reportedly operating across the city. Around 150 such firms are believed to operate in Sector 18, while more than 30 authorised foreign exchange agents and money transfer agencies operate in Sector 62.
These businesses provide services including foreign currency exchange, international money transfers and prepaid forex cards. They are required to follow regulatory requirements, including customer identification and Know Your Customer procedures during currency transactions.
The ED will now examine whether firms linked to suspicious transactions complied with applicable KYC and other regulatory requirements.
A key focus of the investigation is whether any legitimate business operations were allegedly used to convert proceeds of cybercrime into cash or foreign currency. Investigators are examining digital records, banking trails and suspicious transactions to identify further links in the alleged network and determine the role of individual companies and intermediaries.
About the author — Suvedita Nath is a science student with a growing interest in cybercrime and digital safety. She writes on online activity, cyber threats, and technology-driven risks. Her work focuses on clarity, accuracy, and public awareness.
