Europol is reporting that an international operation involving authorities in Albania, Cyprus, Finland, Germany, Israel, Kosovo and North Macedonia, supported by Europol and Eurojust, has struck at the infrastructure of an investment fraud scheme with potential victims in over 50 countries. More than 100 servers were seized and seven suspects arrested during coordinated action on 3 November 2026.

Led by the German Itzehoe Public Prosecutor’s Office (Staatsanwaltschaft Itzehoe), the operation targeted a company suspected of supplying fraudulent trading websites to criminal groups. The entity is connected to call center operators who allegedly persuaded victims to hand over their savings. Investigators estimate losses exceeding €4 million.

Authorities searched 17 locations and seized servers, other evidence and assets. Seven suspects were arrested in with a view to extradition to Germany.

The action follows four years of investigation and earlier interventions in 2022 and 2025. Evidence gathered during those operations led to the company allegedly operating the ‘crime-as-a-service’ model from Cyprus and Israel. Investigators also identified suspected clients operating fraudulent call centers in Albania, Kosovo and North Macedonia.

From an online advert to a call from a scammer

The scheme promised substantial, quick returns from trading in cryptocurrencies, foreign currencies or stocks. Behind seemingly legitimate platforms, supposed brokers used fictitious profits and sustained psychological pressure to persuade victims to invest more.

The investigation also highlighted the abuse of affiliate marketing to attract potential victims. Deceptive advertisements directed people towards fraudulent investment platforms, exploiting their trust in online promotions.

Personal data collected through this process was sold to criminal groups operating call centers. Operators then contacted potential victims with supposed investment opportunities, turning their initial interest into repeated demands for money.

Fake profits encouraged larger payments

Victims were initially encouraged to transfer a small amount. Their online accounts then displayed fictitious profits, making the platform appear credible and the investment successful.

The supposed brokers used these apparent gains to push victims into transferring increasingly large sums. When victims asked to withdraw their money, the operators used delaying tactics to block payments. Eventually, contact ceased, leaving victims unable to recover their funds.

A couple’s complaint exposed an international network

The investigation began in 2022 after a German couple reported that they could not withdraw money invested through an online trading platform.

A first international action day that year resulted in two arrests and the seizure of evidence. Europol-supported analysis helped investigators develop the case, which identified seven additional suspects, including suspected call center managers.

A second action day in 2025 led to further arrests and seizures of money and evidence. Analysis of the material recovered exposed the suspected infrastructure provider and its links to call center operators, paving the way for the latest operation.

Europol and Eurojust support

Europol helped investigators turn operational data into actionable intelligence and coordinate the cross-border investigation. Its European Financial and Economic Crime Centre delivered extensive analysis, cross-checked data against Europol’s databases and brought national investigators together to prepare joint action.

On the action day, Europol deployed its experts to Albania and Kosovo to support digital forensic work and run immediate checks against Europol’s databases. Its Virtual Command Post supported the coordinated intervention.

Eurojust supported the execution of European Investigation Orders, European Arrest Warrants and freezing orders. Two joint investigation teams were established at the Agency: one involving Albania, Germany, and Poland, and another involving Albania and Kosovo. Judicial actions on 3 November were coordinated from Eurojust’s headquarters in The Hague.

The investigation involved authorities of:

• Albania
• Cyprus
• Finland
• Germany
• Israel
• Kosovo
• North Macedonia