"The action follows four years of investigation and earlier interventions in 2022 and 2025," Europol said.
Europol and Eurojust coordinated a multi‑country sweep
European law enforcement authorities — supported by Europol and Eurojust — carried out a coordinated international operation that resulted in the arrest of seven suspects and the seizure of more than 100 servers. The action involved authorities from Albania, Cyprus, Finland, Germany, Kosovo, and North Macedonia and followed a probe that began in 2022 and included earlier interventions in 2022 and 2025.
The company accused of offering a "crime‑as‑a‑service" model
Evidence gathered during earlier operations led investigators to identify a company that allegedly operated a "crime-as-a-service" model from Cyprus and Israel, Europol said. That company is accused of providing fraudulent trading websites to criminal gangs; investigators also identified suspected clients operating fraudulent call centres in Albania, Kosovo and North Macedonia. A first international action day in the initial phase resulted in two arrests and the seizure of evidence, and subsequent Europol‑supported analysis helped develop the case to identify seven additional suspects, including suspected call centre managers.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleHow the scam worked: ads, stolen data and staged profits
The scheme promised quick, substantial returns from trading in foreign currencies, stocks, or cryptocurrency. Deceptive advertisements routed potential victims to fake investment platforms that harvested personal data. That stolen data was later sold to criminal groups running call centers; call centre operators then phoned victims with supposed investment opportunities.
Per the investigators' account, victims were encouraged to transfer a small initial amount. The platforms displayed fake online accounts showing fictitious profits to create the appearance of legitimacy. Those simulated gains were used to sustain psychological pressure aimed at pushing victims into larger transfers. When victims attempted to withdraw money, the scammers used delaying tactics and eventually cut off contact, leaving victims unable to recover funds.
Timeline and scope: from a German complaint to a global victim network
The investigation began after a German couple reported in 2022 that they could not withdraw money from an online trading platform. That complaint enabled investigators to link multiple call centre operators behind investment scams to potential victims in at least 50 countries. Europol described the group of operations as the latest in a string of similar takedowns across Europe, which have repeatedly found large‑scale call centres and wide financial harm.
Past disruptions cited by investigators include a March 2022 shutdown of a massive call‑centre investment fraud network that used 200 "traders" to steal at least €3 million each month; multiple 2023 takedowns of call centres tied to millions of euros in losses; the May 2024 closure of 12 fraud call centres linked to thousands of daily scam calls; a July 2025 Spanish dismantling of a crypto investment fraud ring that laundered over €460 million stolen from more than 5,000 victims; and an April operation by Austrian and Albanian authorities that disrupted a cryptocurrency investment fraud linked to estimated losses of over €50 million.
What this means for victims, law enforcement, and online platforms
- Victims and the general public: The pattern described — deceptive adverts, staged profits, pressure to invest larger sums, and blocking withdrawals — underscores how multiple jurisdictions report similar methods and recurring financial harm to wide victim pools (at least 50 countries were implicated in this investigation).
- Law enforcement and prosecutors: The case illustrates cross‑border investigative work tying infrastructure (more than 100 seized servers) to service providers alleged to have supplied fraudulent platforms, and the role of coordinated operations and Europol‑supported analysis in identifying additional suspects, including call‑centre managers.
- Online platforms and intermediaries: The builders and hosts of fraudulent trading sites are presented in the account as an intermediate layer — a "crime‑as‑a‑service" offering that supplied tools to criminal call‑centre clients — suggesting enforcement attention can focus on both operators of call centres and firms alleged to create or host the deceptive interfaces used to lure victims.
The recent arrests and server seizures are the latest enforcement moves against a persistent pattern of investment scams repeatedly dismantled across Europe. Investigators have traced operational chains from deceptive adverts to hosted trading platforms, to the sale of stolen data and to call‑centre operators who exert psychological pressure to extract larger transfers. Europol's description of a "crime-as-a-service" model and the identification of suspected call‑centre managers mark concrete targets for prosecutors; the seized servers may yield forensic evidence that clarifies client networks and victim impact.
