Platforms · Software · Providers · Markets
The Itzehoe Public Prosecutor's Office in Germany led an international operation on Tuesday against infrastructure supporting an alleged investment fraud network. Police arrested seven suspects, seized more than 100 servers and searched 17 locations across several countries, while freezing assets and collecting evidence; estimated losses are at least €4 million across more than 50 countries.
The infrastructure served several roles
Europol and Eurojust supported the action against a network operating mainly from Cyprus and Israel. Investigators allege it supplied fraudulent trading platforms, used affiliate marketing to draw in prospective investors and sold their personal information to call-centre operators in Albania, Kosovo and North Macedonia.
Online promotions dangled quick, substantial gains from cryptocurrency, foreign exchange and stock investments. The advertisements gathered details from people who responded, which were then passed on to call-centre businesses, according to the account of the scheme.
Europol said callers first encouraged prospective victims to make a modest deposit, while the platforms showed invented profits to appear credible. Posing as legitimate brokers, the suspects allegedly pressed victims to send larger amounts. When customers sought withdrawals, the operators delayed payment and then stopped communicating, leaving victims with losses.
A complaint exposed the network's path
The inquiry lasted four years and began after a German couple reported in 2022 that they could not retrieve money placed through an online trading platform. Authorities intervened in 2022 and 2025; information gathered in those actions helped investigators identify infrastructure providers and connect them with call centres.
The seven arrested suspects now face extradition to Germany. The latest raid, first reported by Finance Magnates, follows a November 2025 operation against a €700 million scam linked to Limassol and a 2026 Europol-supported raid in Cyprus that arrested three suspects over an alleged crypto fraud network using a call-centre-style operation.
What this changes for operators
The case puts platform hosting, marketing referrals and the handling of prospective customers' personal information in the same operational picture. Brokers and trading-platform operators should establish which affiliates can submit leads, where those records go next and what evidence is retained when a referral or platform is challenged.
Operators can also check how quickly they could identify affected infrastructure and preserve relevant access, marketing and customer-data records. The investigation does not specify how the servers were connected to individual platforms or what controls were bypassed. Those are questions to raise with hosting providers and marketing partners, alongside what support they can provide for a law-enforcement request.
