Platforms · Software · Providers · Markets
Police seize the network's infrastructure
On Tuesday, an operation led by the Itzehoe Public Prosecutor's Office in Germany arrested seven suspects and took more than 100 servers out of service. Europol and Eurojust supported the action.
Police searched 17 locations in several countries, gathered evidence and froze assets. The suspects are facing extradition to Germany.
Authorities allege that the network operated mainly from Cyprus and Israel. It supplied fraudulent trading sites, used affiliate promotions to draw in potential victims and sold their personal information to call-centre operators in Albania, Kosovo and North Macedonia. The scheme is estimated to have taken at least €4 million from people in more than 50 countries.
How the fraud funnel worked
Europol said online adverts offered quick, substantial gains from crypto, stock and foreign exchange investments. Interested users' details were collected and passed to call-centre networks. Callers then encouraged people to start with a small deposit; the fake platforms showed invented profits to make the operation appear credible.
Operators posing as legitimate brokers allegedly pressed victims to send larger amounts. When customers sought withdrawals, they faced delays before contact stopped.
Earlier actions shaped the investigation
The four-year inquiry began after a German couple told authorities in 2022 that they could not withdraw money from an apparent online trading platform. Earlier actions in 2022 and 2025 produced evidence that helped investigators identify infrastructure providers and connect them to regional call centres. Finance Magnates reported the latest operation alongside previous cases: in November 2025, authorities broke up a €700 million scam linked to Limassol, and a 2026 Europol-supported action in Cyprus led to three arrests over an alleged crypto investment fraud network running a call-centre-style business.
The operation in figures
| Figure | What it refers to |
|---|---|
| More than 50 countries | Countries where victims were located |
| At least €4 million | Estimated losses |
| Seven suspects | Arrests in Tuesday's operation |
| More than 100 servers | Servers seized |
| 17 locations | Searches carried out |
| Four years | Length of the investigation |
| 2022 and 2025 | Years of earlier interventions |
| November 2025 | €700 million scam linked to Limassol dismantled |
| 2026 | Europol-supported Cyprus action that arrested three suspects |
What this changes for operators
The operation removed infrastructure used in an alleged fraud, but the account does not identify the hosting providers, platform software or payment services involved. It also does not report any connection to a legitimate broker's systems. For technology and risk teams, the immediate task is to establish whether any affiliate, data-processing or call-centre relationships expose customer information to similar onward transfers.
Operators can check how leads enter their systems, who can export personal data, where external providers process it and how access is logged. The investigation also makes withdrawal complaints and repeated delays worth reviewing as operational signals. The report does not say which systems or providers investigators found; teams should ask vendors what data they hold and how they would respond to a cross-border law-enforcement request.
