Europol and international partners
Europol announced a cross-border takedown of an alleged investment-fraud operation that authorities say affected potential victims in more than 50 countries. The joint investigation that culminated in arrests and seizures on Tuesday was supported by officials in Albania, Cyprus, Finland, Germany, Israel, Kosovo, North Macedonia and Poland, Europol said.
Officials arrested seven people on Tuesday; those individuals were not identified in the announcement and are facing extradition to Germany to face charges, Europol said. The operation included searches across 17 countries and followed an investigative trail that stretches back to 2022, when a German couple reported they could not withdraw funds from an online trading platform.
The company's infrastructure: trading platforms and call centers
Europol identified a company — operated from Cyprus and Israel — that allegedly provided cybercrime groups with a suite of trading websites and an assortment of call centers whose role was to persuade victims to transfer their savings. The investigation linked the company to call centers in Albania, Kosovo and North Macedonia.
Authorities described these platforms as “seemingly legitimate” fronts for brokers who were, according to Europol, creating fictitious profits and applying sustained psychological pressure to convince victims to invest increasing sums.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadOperational methods: affiliate marketing, fictitious profits, and payment blocking
The scheme used affiliate marketing to funnel potential victims to fraudulent investment platforms. Operators ran advertisements that led people to the trading sites; cybercrime groups running the call centers then purchased data collected through those ads to contact potential victims, Europol said.
Once contact was made, alleged brokers displayed fictitious profits and used psychological pressure to get victims to put in more money. When victims sought to withdraw funds, the operators employed delaying tactics to block payments; ultimately, contact ceased and victims were left unable to recover their funds, Europol wrote.
Scale, seizures and the investigation timeline
Europol put the estimated losses from the operation at a minimum of $4.5 million. As part of the takedown, investigators seized more than 100 servers during searches carried out across 17 countries on Tuesday.
The probe began publicly in 2022 after the German couple’s report; two people were arrested that year and evidence seized in that action led to further arrests and seizures in 2025, according to Europol’s account. The latest round of arrests and technical seizures represent the most recent phase in a multi-year investigation that spread over several jurisdictions.
What this means for technologists, policymakers, and victims
- Technologists and security teams should note the use of affiliate marketing and high-volume server infrastructure: Europol’s seizure of more than 100 servers underscores the scale at which fraudulent platforms can be hosted and propagated.
- Policymakers and law enforcement planners can point to the investigation’s multinational footprint — with operative links to Cyprus, Israel and call centers in Albania, Kosovo and North Macedonia — as an example of where cross-border cooperation among Germany, Poland, Finland and others was decisive.
- Potential victims and consumer protection advocates will be attentive to the operational detail Europol described: rapid-return promises, displayed (but fictitious) profits, and deliberate payment delays that end with contact ceasing. The investigation was triggered by a victim report, highlighting the role of individual complaints in exposing larger schemes.
Europol’s announcement details a complex, commercialized fraud model: a company selling platforms and call-center services, affiliate-driven acquisition of targets, and a pattern of payment obstruction that left victims across more than 50 countries out of pocket. Seven arrests and the seizure of more than 100 servers mark a significant disruption, but the statement leaves open a central question for those harmed — the prospect of recovering lost funds — even as the suspects are prepared for extradition to Germany to face charges.
