The Enforcement Directorate has arrested three additional suspects in connection with a pan-India cyber fraud network estimated at Rs 30,000 crore, expanding an investigation that originated with a digital arrest scam in Goa, the agency said on Friday.
The arrests take to a higher figure the total number of individuals taken into custody in the case, which the federal financial crimes agency is pursuing under the Prevention of Money Laundering Act (PMLA). The ED has not publicly disclosed the identities of the newly arrested individuals, the specific sections of the PMLA invoked against them, or the precise dates of their detention, citing the ongoing nature of the probe.
According to the agency, the network is accused of defrauding victims across multiple states through digital arrest and related cyber fraud schemes, with the financial scale of the alleged conspiracy estimated at approximately Rs 30,000 crore. The ED has been conducting searches and making arrests in phases as the investigation widens across jurisdictions.
What happened
The latest arrests form part of a continuing money laundering investigation into a network that investigators say used a combination of impersonation, coercion, and digital payment channels to extract funds from victims. The case traces back to a digital arrest scam in Goa, in which perpetrators allegedly posed as officers from law enforcement or judicial agencies during video calls and pressured targets into transferring money under the pretext of resolving fabricated legal cases.
The digital arrest fraud model — in which victims are convinced, often over hours-long video sessions, that they are under investigation and must transfer funds to “clear their names” — has become one of the most reported categories of cybercrime in India over the past two years. Central and state agencies have logged thousands of complaints, with individual losses frequently running into lakhs and crores of rupees.
The ED’s entry into the case signals a shift from conventional cybercrime prosecution to financial crime investigation, which is triggered when investigators allege that the proceeds of the offence were processed through regulated financial channels, including bank accounts, payment aggregators, and potentially cryptocurrency exchanges.
Why it matters
The Rs 30,000-crore scale attributed to the network places this case among the largest cyber fraud conspiracies pursued by Indian enforcement agencies. If the figure holds up under investigation, it would represent a significant share of the estimated annual losses to cyber fraud in India, which the Indian Cyber Crime Coordination Centre (I4C) and the Reserve Bank of India have repeatedly flagged as running into tens of thousands of crores.
The ED’s involvement, rather than reliance on the regular criminal justice system alone, indicates the agency’s preliminary assessment that the proceeds were laundered through formal financial channels, the threshold for invoking the PMLA. That statute allows the agency to attach and seize property, conduct extended financial investigations, and pursue cases independently of the predicate offence.
The case also highlights the structural enforcement challenge posed by layered cyber fraud networks. Digital arrest scams typically rely on a distributed architecture: callers who impersonate officers, technical operators who set up the spoofed video environments, money mules who receive and forward the funds, shell entities that obscure the trail, and in some cases cryptocurrency conversions designed to break the audit chain. Effective prosecution requires coordination among the ED, state cybercrime cells, the I4C, and financial intelligence units, a task that investigators and audit reports have repeatedly described as uneven.
Background and context
Digital arrest scams emerged as a distinct category of cybercrime in India around 2023 and 2024, with cases rising sharply through 2025 and into 2026. The method has been used against retirees, professionals, and small business owners, with perpetrators often displaying fake credentials, simulated courtrooms, and forged documents during prolonged video calls. In several reported cases, victims have transferred funds over multiple installments after being told that partial payments would resolve progressively escalated legal threats.
The I4C, operating under the Ministry of Home Affairs, has served as the central coordinating body for cybercrime response, working with state police, the ED, the Central Bureau of Investigation, and financial regulators. The ED’s investigative jurisdiction, however, is limited to money laundering and foreign exchange violations under the PMLA and the Foreign Exchange Management Act (FEMA), meaning that the predicate cybercrime cases typically remain with state police or other central agencies.
Goa, where the case at the centre of the ED probe originated, has been a recurring geography in digital arrest investigations because of its high concentration of retired and semi-retired residents, a demographic that has been disproportionately targeted. The state cybercrime cell has reported multiple cases in which elderly victims were defrauded of substantial sums after extended video interactions with individuals posing as officers of the CBI, the ED, or the Supreme Court.
In several high-profile cases pursued by the ED over the past year, the agency has alleged that proceeds were routed through a combination of mule accounts, fictitious companies, and in some instances overseas remittance channels. The PMLA framework allows the agency to attach properties even before conviction, a tool the agency has used to pressure accused individuals and to preserve assets for potential restitution.
The phased pattern of arrests in the current case — moving outward from identified accused to downstream financial operators — is consistent with how PMLA investigations are typically structured. Investigators tend to focus first on tracing the flow of funds, identifying the bank accounts and entities through which proceeds were processed, and only later building the full conspiracy narrative that links those operators to the original fraudsters.
What to watch next
Several developments are likely to shape the trajectory of the case in the coming weeks and months.
First, the ED is expected to file its first prosecution complaint under the PMLA, which would formalise the charges against the arrested individuals and set the stage for trial. The timing and contents of that complaint will offer the clearest public indication of the agency’s working theory of the case.
Second, investigators are likely to push for custody of the newly arrested individuals beyond the initial remand period, given the financial complexity of the case and the need to trace fund flows. Courts have in past PMLA cases granted extended ED custody, but defence challenges to such extensions have become more common.
Third, asset attachments under Section 5 of the PMLA are a near-certainty if the agency identifies properties linked to the accused. The size of any provisional attachment order will be closely watched, as it will serve as a partial verification of the Rs 30,000-crore scale currently attributed to the network.
Fourth, coordination with the I4C and state cybercrime cells will be tested as the case expands. The ED has historically relied on predicate offence files built by state police to establish the criminal proceeds that justify PMLA action, and delays in those files have slowed several past investigations.
Fifth, any cryptocurrency angle remains undisclosed. If investigators determine that a portion of the proceeds was converted into digital assets, the case could draw in the Financial Intelligence Unit and raise questions about the regulatory framework for virtual digital assets, which has been under review by the government and the Securities and Exchange Board of India.
Analysis:
The escalating scale of the financial figure under investigation — Rs 30,000 crore — places this case among the largest cyber fraud networks pursued by Indian enforcement agencies. That figure, if substantiated through the attachment and trial process, would carry significant implications for how India’s enforcement architecture is resourced. The ED, the I4C, and state cybercrime cells have all acknowledged in recent reports that existing manpower and forensic capacity are insufficient for the volume of cases being reported.
The ED’s involvement also signals a strategic shift. As the volume of digital arrest and related fraud cases has grown, the agency has increasingly positioned itself as a downstream responder, stepping in once investigators believe proceeds have been laundered through regulated channels. This positioning allows the ED to use the PMLA’s stronger attachment and discovery tools, but it also means that the initial investigative burden continues to fall on state police forces that have uneven technical capacity.
The phased arrest pattern, in which investigators move from identified accused to downstream financial operators, is consistent with PMLA methodology, which prioritises tracing proceeds before building the full conspiracy. The strategy can yield strong evidentiary records on the financial side, but it has also been criticised by defence lawyers for what they describe as over-reliance on financial documents at the expense of testimony from the original victims of the fraud.
A broader question is whether the case will produce meaningful victim restitution. Indian law permits courts to direct compensation to victims of offences whose proceeds are confiscated under the PMLA, but the operational machinery for distributing such funds remains underdeveloped. In most past PMLA cases, attached assets have remained in government custody pending the conclusion of trials that can run for years.
Conclusion
The three additional arrests mark another step in what has become one of the more significant financial crime investigations of the year, but the case remains in its early stages. The Rs 30,000-crore figure attributed to the network is an investigative estimate, not a proven loss, and the identity of those arrested, the specific charges, and the structure of the alleged conspiracy are all likely to become clearer only as the ED files its prosecution complaint and the courts begin to scrutinise the evidence.
What is already clear is that the case reflects the scale and structural complexity of digital arrest fraud in India, a category of cybercrime that has outpaced the enforcement response and continues to evolve faster than the regulatory framework designed to counter it. The ED’s pursuit of the case will be watched closely by state agencies, financial regulators, and the courts, all of whom are grappling with the same underlying question: how to investigate, prosecute, and ultimately deter fraud networks that span dozens of jurisdictions and exploit the speed and opacity of digital payment systems.
Sources
India Today — https://www.indiatoday.in/india/story/ed-arrests-3-more-in-rs-30000-crore-cyber-fraud-case-linked-to-goa-digital-arrest-scam-ptag-2981758-2026-08-28
Corrections
If you believe this article contains an error, contact Herald Express with the source URL and supporting evidence.
Story synopsis gathered from: India Today – India — source
