Seven suspects were arrested and more than 100 servers seized on Tuesday in an international operation involving Cyprus against an alleged investment fraud network with potential victims in more than 50 countries, Europol said.
The operation, led by the Itzehoe Public Prosecutor’s Office in Germany, targeted a company that allegedly supplied fake online trading websites to criminal groups. According to Europol, the company allegedly ran a crime-as-a-service model from Cyprus and Israel and was linked to call centre operators who allegedly persuaded victims to invest their savings. Investigators estimate total losses at more than 4 million euros.
Authorities from Albania, Finland, Germany, Kosovo and North Macedonia also took part, with support from Europol and Eurojust. They searched 17 locations and seized servers, other evidence and assets. The seven suspects were arrested with a view to their extradition to Germany.
How the scheme allegedly worked
The scheme promised high, fast returns from trading cryptocurrencies, foreign currencies or shares, Europol said.
Misleading online advertisements, placed through what the agency described as abuse of affiliate marketing, drew users to the fraudulent investment platforms. The personal data collected in the process was then allegedly sold to criminal groups running call centres, whose operators contacted potential victims with supposed investment opportunities and turned their initial interest into repeated demands for money.
Victims were first asked to transfer a small sum. Fictitious profits then appeared in their online accounts to make the platform look trustworthy and the investment successful. The supposed brokers, operating behind websites posing as legitimate investment platforms, used these profits and constant psychological pressure to push victims into transferring ever larger amounts.
When victims asked to withdraw their money, the operators used delaying tactics to block payments. Eventually contact stopped and victims were unable to recover their money.
Four-year investigation
The investigation began in 2022, when a couple in Germany reported that they could not withdraw money they had invested through an online trading platform.
A first international operation that year led to two arrests and the seizure of evidence. Analysis carried out with Europol’s support helped identify seven more suspects, including alleged call centre operators.
A second operation in 2025 led to further arrests and seizures of money and evidence. Examination of the material recovered led investigators to the alleged infrastructure provider and its links to the call centre operators. Investigators also identified alleged clients of the company running illegal call centres in Albania, Kosovo and North Macedonia.
Europol said it provided analytical and operational support and, on the day of the operation, deployed experts to Albania and Kosovo to support digital forensics and cross-check data against its databases.
Eurojust helped execute European Investigation Orders, European Arrest Warrants and asset-freezing orders, among other measures, and coordinated the judicial action on 3 November from its headquarters in The Hague.
