Police and prosecutors in seven countries have shut down more than 100 servers and arrested seven suspects in an investment scam case. The target was a company suspected of supplying fake trading websites to criminal call centres. Europol said the action day took place on 3 November in Albania, Cyprus, Finland, Germany, Israel, Kosovo and North Macedonia.
Estimated losses exceed EUR 4m, and potential victims are spread across more than 50 countries. Officers searched 17 locations, including a call centre in Kosovo, according to Eurojust. The seven suspects were arrested for surrender or extradition to Germany.
In brief
- More than 100 servers were taken down and seven suspects arrested across seven countries on 3 November.
- Investigators say a ‘crime-as-a-service’ company supplied fraudulent trading platforms to call centres in Albania, Kosovo and North Macedonia.
- Losses are put at over EUR 4m, with potential victims in more than 50 countries.
How the investment scam worked, and the signs to watch for
Europol set out the pattern in its release. The scheme promised “substantial, quick returns” from trading cryptocurrencies, foreign currencies or stocks. Victims were first encouraged to send a small amount, and their accounts then showed fictitious profits. The supposed brokers used those apparent gains, and sustained psychological pressure, to push for larger transfers. When victims asked to withdraw, the operators used delaying tactics, and eventually contact stopped.
That sequence is the main thing to recognise. The warning signs are:
- Substantial, quick returns promised from trading.
- A small first deposit followed by an account showing fast gains.
- Pressure to add more money.
- Excuses or delays once a withdrawal is requested.
Europol said the scheme used affiliate marketing and deceptive online adverts to draw people in. Personal data was sold on to the call centres, which means a victim’s first contact may have come from a cold call rather than a search.
A supplier, not a single scam
The investigation, led by the Itzehoe public prosecutor’s office in northern Germany, has run for four years. It began in 2022, when a German couple filed a complaint. An earlier action day that year led to two arrests, and there was a further intervention in 2025.
Investigators say the company at the centre operated from Cyprus and Israel. It provided the websites and technical infrastructure, while the client call centres in Albania, Kosovo and North Macedonia dealt with victims. Europol described it as a ‘crime-as-a-service’ model.
Eurojust said two joint investigation teams were set up, one between Germany, Poland and Albania and another between Albania and Kosovo. The judicial side was coordinated from The Hague. Authorities carried out European Investigation Orders, European Arrest Warrants and freezing orders.
Europol’s European Financial and Economic Crime Centre handled the analysis. It deployed experts to Albania and Kosovo and ran a virtual command post on the day. The agencies taking part included Schleswig-Holstein’s State Criminal Investigation Office, Cyprus Police, Finland’s National Bureau of Investigation, Albania’s special prosecution office and police, Israel Police’s Lahav 433 unit, Kosovo’s special prosecution and police, and North Macedonia’s organised crime prosecutors and interior ministry.
Similar cases have come up elsewhere. In the US, TSN has reported on the SEC’s case over an alleged $130m crypto fraud built on false filings and charges against six people over a Madagascar NFT romance scam. It has also covered how a DOJ unit has restrained hundreds of millions in scam crypto.
Hitting the platform supplier disrupts many call centres at once
The detail that matters most is who was targeted. Investigators went after the company suspected of building and hosting the fake trading sites, not one call centre working the phones. If the allegations hold, taking down more than 100 servers removes the shopfront that several separate fraud groups relied on. That kind of disruption lasts longer than an arrest at the bottom of the chain.
For compliance teams, the case also shows where the money and data trails can be cut. The scheme depended on paid advertising, affiliate traffic and bought-in personal data, all before a single deposit was made. Ad networks, affiliate programmes and data brokers sit upstream of the fraud and can screen for it.
Banks and payment firms see the next stage: repeated, growing transfers to a ‘trading’ account, followed by a customer who cannot withdraw. Those are patterns that transaction monitoring can flag.
The freezing orders executed on the day also signal that investigators were following assets, not just people. The agencies have not said how much was frozen.
The four-year timeline is a reminder that cross-border fraud cases move at the pace of mutual legal assistance. It took two joint investigation teams and coordination from The Hague to reach seven arrests. For potential victims in more than 50 countries, the quicker protection is still to spot the stalled withdrawal before sending the next deposit.
Sources
- Europol: Investment scams, potential victims in at least 50 countries, over 100 servers seized (3 November 2026)
- Eurojust: International investment fraud scheme dismantled, seven arrests (3 November 2026)
Related stories
- DOJ Unit Has Restrained $938m in Scam Crypto, Trump Says Nearly $1bn
- SEC Says Two Firms Used False Filings in Alleged $130m Crypto Fraud
- US Charges Six Over Madagascar NFT Scam as Crypto Restraints Top $1bn
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
