Seven Arrested as Europol Operation Seizes More Than 100 Servers Behind Investment Scams

Investigators across Europe moved on November 3, 2026 against the supplier layer of the investment scam economy: not a single call center, but a company accused of selling the fraudulent trading platforms that call centers use. Europol announced that authorities in Albania, Cyprus, Finland, Germany, Israel, Kosovo and North Macedonia, supported by Europol and Eurojust, arrested seven suspects, seized more than 100 servers, and searched 17 locations in a coordinated action day. Potential victims are located in at least 50 countries, and investigators estimate losses at more than EUR 4 million.

The operation was led by the Public Prosecutor’s Office in Itzehoe, Germany. According to Europol, the targeted company allegedly operated a crime-as-a-service model from Cyprus and Israel, supplying fraudulent trading websites to criminal groups. Its suspected clients ran call centers in Albania, Kosovo and North Macedonia, where operators persuaded victims to hand over savings with promises of substantial, quick returns from trading cryptocurrencies, foreign currencies, or stocks. Europol says the scheme drew victims in through affiliate marketing and deceptive online advertising. The suspects in custody face extradition or surrender to Germany. The allegations have not been tested in court.

Four years behind one action day

The November 3 operation closed a four year investigation. Eurojust records that the case began in 2022, after a German couple reported investing their savings through an online platform and being unable to withdraw the supposed profits. Earlier interventions followed in 2022 and 2025, and evidence from those actions led investigators to the platform supplier. Two joint investigation teams were set up along the way, one between Germany, Poland and Albania and another between Albania and Kosovo. On the action day itself, the judicial side ran from Eurojust’s headquarters in The Hague: investigation orders and arrest warrants executed across borders, and assets frozen under freezing orders.

Photo: OSeveno, CC BY-SA 3.0, via Wikimedia Commons

What Europol and Eurojust each did

Europol’s contribution ran through its European Financial and Economic Crime Centre, which delivered analysis, cross-checked data against Europol’s databases, and convened the national investigators to prepare the joint action. On November 3, Europol specialists were on the ground in Albania and Kosovo, helping examine seized devices and checking names and records against the agency’s databases at the scene. Seizing more than 100 servers matters beyond the arrests: platform infrastructure is the reusable asset in this business model, and removing it raises the cost for every client group that rented it, not only the operators detained that day.

Why the supplier angle matters

Investment fraud has industrialized in the same way ransomware did. A small number of technical suppliers provide the websites, dashboards, and fake account balances that make a scam look like a brokerage, while interchangeable call centers provide the persuasion. Enforcement that stops at a call center leaves the supplier free to sell the same platform to the next crew. The Itzehoe led operation is the opposite shape: four years spent mapping the supplier, then one synchronized day across seven countries so that servers, evidence, and assets could be seized before any single raid warned the rest of the network. Whether the model works as deterrence will depend on prosecutions and asset recovery, which are still ahead. Victims who sent money through platforms connected to the case should expect recovery to be slow, and should report through their national police channels rather than paying any service that promises to retrieve the funds.

No corrections have been published for this article.