Summary

• Seven suspects were arrested and more than 100 servers seized during coordinated operations on 3 November.
• Investigators targeted a suspected technology supplier providing fraudulent investment platforms to criminal groups operating call centres.
• The investigation began in 2022 and has identified estimated losses exceeding €4 million, with potential victims in more than 50 countries.

An international operation supported by Europol has resulted in seven arrests and the seizure of more than 100 servers, targeting technology infrastructure allegedly used by criminal groups to operate fraudulent online investment platforms.

Authorities searched 17 locations during coordinated action on 3 November, following an investigation led by the German public prosecutor’s office in Itzehoe. Investigators believe the suspected fraud network reached potential victims in more than 50 countries and caused financial losses exceeding €4 million.

The latest operation targeted a company allegedly providing fraudulent trading websites to criminal organisations operating call centres. Investigators believe the supplier, associated with operations in Cyprus and Israel, enabled separate groups to present apparently legitimate investment services while using fabricated account information to persuade victims to transfer money.

Authorities from Albania, Cyprus, Finland, Germany, Kosovo, and North Macedonia participated in the coordinated action, with international assistance from Europol and Eurojust. The seven suspects were arrested for surrender or extradition to Germany, where the investigation is being pursued.

Fraudulent platforms supported repeated deception

The suspected scheme used websites that appeared to offer trading in cryptocurrencies, foreign currencies, and shares. Visitors could register accounts, transfer money, and view information suggesting that their investments were generating substantial returns.

According to investigators, those apparent profits were fictitious. The online platforms provided a convincing environment in which supposed brokers could encourage customers to make further payments, even though the displayed account balances did not reflect genuine investment performance.

Victims were generally encouraged to begin with comparatively small deposits. Once the website showed that their funds had apparently increased in value, call centre operators used those gains to justify requests for larger transfers.

The ability to show a customer an apparently growing investment account contributed to the deception. Information displayed through a professional-looking interface can reinforce claims made during telephone conversations, particularly when the person receiving the call believes the website represents an established financial service.

When customers attempted to withdraw their money, the operators allegedly introduced delays and excuses to prevent payment. Communication eventually stopped, leaving victims unable to recover the funds they had transferred.

Investigators also identified deceptive online advertising used to attract prospective victims. Some advertisements directed users towards fraudulent trading websites, while personal information collected through the process was reportedly sold to criminal groups operating call centres.

That arrangement allowed potential victims to be contacted by people who already possessed information about their interests. A person who had responded to an investment advertisement could subsequently receive calls from an apparently knowledgeable representative, making the approach more convincing than an entirely unsolicited contact.

Technology was allegedly supplied as a service

The investigation identified a suspected supplier providing fraudulent websites to multiple criminal groups, an arrangement described by the authorities as crime-as-a-service.

Under that model, the organisations providing technical infrastructure and those communicating directly with victims can operate as separate participants within the same wider scheme.

The suspected platform provider allegedly supplied the websites needed to create and maintain the appearance of investment activity. Other groups used those systems while operating call centres and persuading individuals to transfer funds.

Separating these activities can make investigations more complicated. A person developing or maintaining a website may not be the individual who contacts victims, while the operators handling payments may use additional accounts and organisations.

Authorities must establish how those participants are connected and whether evidence supports allegations that particular individuals knowingly contributed to criminal activity.

Computer infrastructure can provide evidence relevant to those relationships. Records recovered from servers may help investigators identify the operation of websites, connections between systems, and information supporting the reconstruction of suspected offences.

However, server seizures do not automatically establish that every associated criminal operation has permanently stopped. Investigators must determine which services were affected, how the suspected groups used them, and whether related infrastructure exists elsewhere.

A complaint in Germany began the investigation

The case began in 2022 after a German couple reported being unable to withdraw money from an online investment platform. Their complaint led authorities to investigate the website and the people believed to be involved in its operation.

An initial international action that year resulted in two arrests and the recovery of evidence. Analysis of the seized material helped investigators identify additional suspects, including people believed to manage call centres used to persuade victims to make further payments.

A second coordinated operation followed in 2025, producing additional arrests and seizures of money and evidence. Examination of those records led investigators towards the suspected technology supplier and its relationships with criminal groups.

The subsequent investigation identified alleged customers of that supplier operating call centres in Albania, Kosovo, and North Macedonia, connecting the infrastructure to activities taking place across several jurisdictions.

The 3 November operation focused on the supplier and the systems allegedly supporting those activities. Searches included a call centre in Kosovo, while authorities recovered servers and other material intended to support continuing investigations.

The successive operations demonstrate how evidence gathered during one intervention can expose additional organisations and infrastructure. Initial investigations into individual fraudulent transactions may develop into broader enquiries where technical records reveal common systems used by separate groups.

International cooperation connects technical evidence

Eurojust supported judicial coordination, including European Investigation Orders, arrest warrants, and freezing orders. Two joint investigation teams were established to connect authorities working on different parts of the suspected network.

One team involved German, Polish, and Albanian authorities, while another brought together investigators from Albania and Kosovo. The arrangements supported information sharing and decisions about coordinated investigative action.

During the latest operation, Eurojust coordinated judicial activity from The Hague, while Europol provided analytical assistance and checks against law enforcement databases.

Europol also deployed specialists to Albania and Kosovo to support digital forensic work and immediate information checks. Its Virtual Command Post helped authorities coordinate activity as the searches and arrests took place.

Cross-border investigations involving digital infrastructure require cooperation because evidence, service providers, suspects, and victims may be located in different countries. The authorities responsible for collecting material must work within their respective legal frameworks while maintaining procedures that allow evidence to be used in subsequent proceedings.

Online services can also depend on equipment and accounts hosted outside the country where victims live. Investigators may therefore need information from several jurisdictions to establish how an apparently local fraud complaint connects to a wider operation.

The estimated losses exceeding €4 million represent the authorities’ current assessment, while the reference to potential victims in more than 50 countries does not establish a confirmed number of individuals who suffered financial harm.

The arrests likewise represent investigative action rather than findings of guilt. Responsibility for the alleged offences will depend on evidence presented through the relevant legal proceedings.

The seized servers and associated evidence will now be examined as the German-led investigation continues. Authorities will seek to establish the roles of the suspects, the relationships between the alleged technology supplier and its customers, and the full extent of the financial losses connected to the fraudulent investment platforms.