Casa De Nicole is a picture of North Goa’s laid-back charm — two storeys tall, with off-white walls and garden beds. Just the kind of villa vacationers in Goa prefer during the monsoon, when off-season prices plummet. So when a dozen young men lived it up here for days, lounging by the pool or stepping out to visit casinos and nightclubs, none of the neighbours paid any attention.Until August 4, 2026, when a team of the Mumbai Police’s Crime Branch raided Casa De Nicole. The ‘vacationers’, it turned out, were a key cog in a much larger cybercrime machine, one that spanned Gujarat, Goa, Mumbai, Dubai and beyond. Casa De Nicole was raided by a team of the Mumbai Police’s Crime Branch on August 4, 2026The cybercrime chain is by now all too familiar: conmen pose as law enforcement and terrorise the victim into transferring their life savings into a specified bank account, from where the money splits and gets transferred into thousands of bank accounts — a blitzkrieg operation that leaves banks with little time to react.It’s for the first time, police say, that they have cracked down on the latter part of the operation — the team involved in moving money at lightning speeds into smaller accounts.What stunned the police was that the men carrying out these fraudulent transactions weren’t those working in the shadows in Jamtara, Nuh or many of the other cybercrime hubs, but living it up in Goa’s villas. When the Mumbai Police team cracked down on the Candolim villa, they found 12 youngsters, 11 from Gujarat and one from Jogeshwari in Mumbai. “Some whose ‘working hours’ were over were lounging on the terrace. Others were in the pool,” says Inspector Prashant Gawde, who was part of the team that conducted the raid.Since then, police have cracked down on at least one more villa in Goa and arrested 10. Police have filed two FIRs across both cases, estimating that the two gangs defrauded people of a combined Rs 900 crore. ⠀It all began in Mumbai.Story continues below this adIn July this year, DCP (crime) Raj Tilak Roushan received a tip-off that something suspicious was going on at a company in South Mumbai — Office No. 303 at Parsvnath Chambers, Masjid Bunder. On July 3, a Mumbai Crime Branch team raided the office that bore an adhesive sticker for ‘G.D. Overseas’. The company turned out to be a sham; it existed nowhere except on that single piece of paper.The investigators found 10-12 employees whose job was to open new current accounts across banks in Mumbai. Upon checking the transactions, a peculiar trend stood out: while the accounts were opened in Mumbai banks and activated by ‘G.D. Overseas’ employees, they were later operated from Goa. The investigators also found that the ‘G.D. Overseas’ employees bought the SIM cards that were linked to the bank accounts — typically for OTPs and banking authentication — and sent them to Goa, where the accounts were later operated. The 12 accused arrested were produced by the police in a press conferenceDuring interrogations, Mohammad Shabbir Sheikh, one of the arrested employees from the south Mumbai office unit, told the police that while he was employed in Dubai, he met a ‘Ranveer Kapoor’, who advised him to go to Mumbai and create the bank accounts. The bank welcome kits and account-linked SIM cards were to be handed over to another person who would take them to Goa. The FIR in the case, filed at the Pydhonie police station, quotes Ranveer Kapoor as telling Sheikh, “In return, I will give you Rs 50,000-70,000 per account.”Following the Goa trail, the police reached Casa De Nicole, which falls in the jurisdiction of Goa’s Calangute Police Station. The Mumbai Crime Branch team, led by Senior Inspector (Unit II) Dilip Tejankar, conducted the raid. They seized 15 laptops, 128 ATM cards, 85 mobile phones, 76 SIM cards, 22 cheque books, 77 passbooks, six routers, and three keyboards from the villa.Story continues below this adThe account numbers the youth had with them were used in 186 cybercrime cases across the country, it was found. The police went on to freeze Rs 120 crore spread across 7,500 bank accounts. The police believe nearly Rs 500 crore were moved by the accused living in the villa. ⠀Mumbai Crime Branch officers say that Casa De Nicole appeared to be a villa from outside, but was an office space inside. “Every room had five to six laptops, and they had created a cabin-type setup, where they would sit and transfer money,” says Inspector Prashant Gawde.It was a 24×7 operation, with the youth working in three eight-hour batches. At any time, at least four men were ready to move money from a victim’s account to thousands of others. This was required, as it could not be predicted when a cybercrime victim would take the bait and transfer money, say officers.Gawde says that some of those arrested at the Goa villa said their workdays were taxing, with some days extending to 12 hours. But there was a pay-off: they could step out of the villa and splurge in their free hours. “They would go to nightclubs and casinos; sometimes, they would even bring people over to the villa,” he says.Story continues below this adThe men earned Rs 35,000 a month and a three per cent share of the money they moved each day. The pool where the youth often lounged in their free hoursCasa De Nicole owner Francis says he had no idea a cybercrime racket was being run from the villa until a police call in August.“They rented the villa for two months for Rs 1 lakh. Initially, when they approached me, I told them I rent the villa only for short durations. But I changed my mind later. They paid rent for two months upfront, but had stayed only for one month when the police raided the premises. I had no clue that they were involved in cyber fraud,” says Francis.A resident, requesting anonymity, says, “They were a noisy bunch. They had rented vehicles. I would see them coming and going at odd hours, but did not think much of it.”The villa has since been locked.Story continues below this adA Mumbai police officer said that an absconding accused in the case, whose identity they refused to reveal, had approached the villa owners claiming to be the manager at a multinational company and saying he wanted to book the villa to enable his employees to “work from home” in a relaxed environment.But something still puzzled the officers: moving money manually across thousands of accounts would require far more people. This, they soon found, was where the ‘company’ stepped in. ⠀The youth, police found, reported to a Dubai-based Indian who called himself ‘Ranveer Kapoor’. Police claim to have identified him, and they are trying to get him back in coordination with the authorities in Dubai. He, along with other Dubai-based operators, ran what the accused called the “company”.The “company”, police found, was at the head of the cyber fraud pyramid, followed by the “administrators” (the men arrested in Goa), the “masters”, “super masters” and the “customers”.Story continues below this adAt the bottom, or the first level of the fraud, were the “customers”, people who, in exchange for money, handed over their accounts for fraudulent transactions. These were the mule accounts into which the “administrators” would, at the click of a button on their app, transfer the money.A level above them were the “masters”, essentially agents working on the periphery of the banking system in Mumbai, who would procure the ‘mule’ accounts from customers, either by force or lure.The “supermasters” were the ones responsible for keeping the bank accounts ready for transactions. They collected welcome packs for newly opened accounts, activated the accounts, and set up OTPs.“A regular flow of mule accounts was needed to run this network,” a police officer says.Story continues below this ad“Administrators”, the youth arrested in Goa whose job was to move money between accounts, formed the next level and held ‘franchises’ of the “company” they reported to. The arrested administrators told police they paid Rs 50 lakh upfront to obtain the ‘franchise’.As they probed further, police realised that the men in the Goa villa could not realistically have logged into and operated thousands of bank accounts one by one. They found that the Dubai-based company had given their administrators in Goa access to an app especially developed for cybercrime, called Banker Panel.On the app, the youth entered the account into which the victim was made to transfer money in one box and listed the accounts to which the money would be sent in another. “Once the set-up was ready, they only needed to click once, and the money would be transferred to thousands of accounts in an instant. The chain continues,” the police officer says.This ensured the victims’ money would be untraceable, even if law enforcement officials were alerted within the “golden hour”, the first one to two hours immediately after a fraud, when banks can block or freeze the money.Story continues below this adThe money transferred to different accounts was eventually withdrawn at ATMs or through cheque-books.Another group, police say, would send the money onwards to Dubai via the ‘angadia’ network — an unofficial, trust-based courier system, often used to send unaccounted money without alerting authorities.The cybercrime network, the officer says, had a unique method to pay commission to ‘franchises’ like the Goa one in ‘white’.For this, the Dubai-based ‘company’ operated gaming platforms. On these platforms, a youth in Goa would pay Rs 1,000 to bet on a race. The ‘company’ would return Rs 900 and add Rs 100 to the bet, creating a legitimate-looking transaction through which the franchise could receive its commission in ‘white’.The police found gaming portals like ‘XXX247’, ‘900 Panel’ and ‘Rudra’ linked to the cybercrime network. “Though online gaming has been banned in India (the Promotion and Regulation of Online Gaming Act was passed in 2025 and came into effect on May 1, 2026), it is not banned abroad, so they would use that loophole. We have since blocked the gaming websites,” the officer says.As they dug deeper, the Mumbai Police team kept bumping into a shadowy figure, ‘Ashwathama’, on several WhatsApp groups the youth used. Bua Smith, who called himself ‘Ashwathama’, was tracked down in Jaipur“Since the accused would ensure one ‘level’ did not meet another, no one knew who this person was,” an officer says. “This person played an important role in these WhatsApp groups, in organising mule account holders and telling those on the lower levels what was to be done.”In the first week of September, the police tracked down ‘Ashwathama’ in Jaipur. He was identified as Bua Smith, who hailed from Ahmedabad. He told police that he was sure that he, like Ashwathama, the immortal warrior in the Mahabharata, would not be found out, even if all others were arrested. ⠀Police say Casa De Nicole, run by the Dubai-based ‘company’, is not an isolated case. Other ‘companies’, they say, have begun to operate from countries such as Sri Lanka. They eventually convert money into cryptocurrency and send it to a third country, like China, using crypto wallets.After the raid on Casa De Nicole in August, there was a similar raid at a Goa villa called Sea Coast in September. Investigators uncovered the same modus operandi: men in their thirties operating out of a villa, moving money across thousands of accounts. The accused, police found, changed villas when owners or neighbours suspected that something was amiss. The police suspect they moved around Rs 400 crore of fraudulently obtained money.In September, the Mumbai Crime Branch (Unit V), led by senior Inspector Rohini Potdar, raided Sea Coast villa and arrested the accused. “They were given a monthly salary of Rs 25,000 and a percentage of the money they moved. Every person ended up earning anywhere between Rs 1 and 1.5 lakh a month,” says a police officer.“Unlike the lot in Casa De Nicole who splurged on casinos and nightclubs, police say the men arrested from Sea Coast were older and told them that they wanted to send money back home,” says Assistant Police Inspector Sachin Barate, who was part of the team that raided Sea Coast villa.For Goa Police, which assisted their counterparts from Mumbai in the raids, the shadowy activities in the villa are a growing headache. “The ease of ‘working’ from a villa, close to the beaches and casinos, is what draws young men to take up this job,” says a Goa officer posted in the cyber cell.