Background and Timeline: The Navi Mumbai Cyber Police registered two significant online investment fraud cases in late January 2026, leading to a coordinated enforcement drive. The investigation followed complaints from multiple victims who were duped throughout late 2025 by promises of high financial returns. On January 28 and January 30, a special investigation team successfully arrested four suspects linked to multi-crore siphoning networks.
Modus Operandi: The syndicate utilized “High-Trust Hoaxes” to lure investors into gold trading and forex schemes via Telegram groups. In the gold fraud, the victim was persuaded to make small initial investments that showed substantial fictitious profits, allowing him to withdraw a small sum to build trust. In a separate forex case, a relationship manager at a cooperative bank allegedly facilitated the opening and supply of accounts used to route illicit funds.
Victims and Financial Impact: The combined financial loss reported in these two cases reached a staggering ₹4.56 crore, with one 68-year-old investor losing ₹4 crore alone in the gold hoax. In the second case, a victim was defrauded of ₹56.27 lakh through a fake share market and forex trading application. The primary suspect in the gold hoax was found to be linked to similar cybercrimes committed across 17 different Indian states.
Investigation and Agencies Involved: Navi Mumbai Cyber Police conducted a deep technical analysis of bank accounts and mobile numbers to trace the siphoning path. The probe led investigators to Chandanwadi in Thane and various hotel rooms across Mumbai where the suspects managed the bank-linked devices. During the search of one suspect’s house, police recovered 17 cheque books, 10 debit cards, 8 SIM cards, and 18 empty SIM card packets.
Arrests and Suspects: Four individuals were arrested: Kalpesh Shitap (47) for the gold fraud, and Salim Sheikh (43), Mohammed Nabil Haroon, and Saddam Ali Ejaz Ahmed (30) for the forex fraud. Saddam Ali was notably identified as a relationship manager at a cooperative bank in Sion who assisted the syndicate in securing mule accounts. The suspects have been remanded to police custody while efforts continue to identify other associates linked to the eight states involved.
Broader Implications and Trends: This bust uncovers the growing “Insider Threat” within the cooperative banking sector, where employees facilitate the creation of the mule account infrastructure. It highlights the tactical use of hotel rooms as temporary “scam bases” to rotate mobile numbers and receive OTPs for fraudulent transactions. Authorities warned that initial withdrawal successes are a common psychological trap intended to lower a victim’s guard.