Summary
- Europol and Eurojust supported an investigation involving authorities in six European jurisdictions.
- Seven suspects were arrested, and more than 100 servers were seized.
- Investigators identified an alleged supplier of fraudulent trading platforms used by criminal call centres.
European authorities have seized more than 100 servers and arrested seven suspects in an international operation targeting the technical infrastructure used to operate fraudulent investment platforms.
The coordinated action took place on 3 November, involving authorities in Albania, Cyprus, Finland, Germany, Kosovo, and North Macedonia, with support from Europol and Eurojust.
Investigators searched 17 locations and targeted a company suspected of providing fraudulent trading websites to criminal organisations. The platforms were allegedly used by call centre operators to convince victims that they were investing in legitimate financial products.
According to Europol, the investigation identified potential victims in more than 50 countries and estimated financial losses exceeding €4 million.
German prosecutors are seeking the extradition of the seven suspects, while the wider investigation continues.
Trading platforms supplied to criminal operators
Rather than developing their own digital infrastructure, the suspected fraud organisations allegedly obtained websites and supporting services from a specialist supplier.
The platforms presented opportunities to trade cryptocurrencies, foreign exchange, and conventional financial assets. Their interfaces displayed fictitious investment returns, creating the impression that customers’ balances were increasing.
Victims were initially encouraged to deposit relatively small amounts. Once their supposed accounts showed profits, call centre employees allegedly persuaded them to transfer additional money.
Requests to withdraw funds were delayed or obstructed, with communication eventually ceasing.
The alleged operation depended on several connected services. Advertising attracted prospective victims, websites provided the appearance of a functioning trading service, and call centre employees maintained relationships intended to secure further payments.
Investigators also identified the use of affiliate marketing. Promotional links and advertisements directed potential customers towards the fraudulent platforms, while personal information gathered during the process was passed or sold to criminal operators.
The suspected infrastructure supplier operated through connections in Cyprus and Israel, according to investigators, with alleged customers including call centre operations in Albania, Kosovo, and North Macedonia.
This separation between platform provision and customer contact allowed different participants to perform specialised roles within a broader criminal business model.
Investigation developed over four years
The case began in 2022 when a German couple complained that they could not withdraw money from an online trading platform.
Investigators subsequently identified connections extending beyond the original platform, leading to an initial international enforcement operation that year.
Further action in 2025 produced arrests and additional evidence. Analysis of the recovered material helped authorities identify the suspected platform supplier and its relationships with call centre operators.
The latest operation moved further into the technical infrastructure allegedly supporting the network, including the servers associated with fraudulent websites.
Europol contributed intelligence analysis and operational coordination, while Eurojust supported the judicial arrangements needed for investigations spanning several jurisdictions.
Two joint investigation teams were established to facilitate the collection and exchange of evidence.
Shared infrastructure creates investigative opportunities
Criminal operations using a common technical supplier can appear unrelated to individual victims. Different brands, investment websites, and call centres may operate as separate businesses while depending on overlapping infrastructure.
Identifying those relationships allows investigators to examine connections between cases that initially appear to involve distinct offenders.
Servers supporting multiple sites may contain records that help reconstruct financial activity, customer acquisition, administrative access, and relationships between alleged participants. The contents and evidential value of the servers seized in this case have not yet been disclosed in full.
The operation also demonstrates the international character of digital infrastructure supporting organised financial crime. Websites may serve victims across many countries while their operators, hosting arrangements, and supporting businesses are distributed across different jurisdictions.
Seizing shared infrastructure can interrupt several operations simultaneously, but authorities have not confirmed that every website associated with the suspected network has been disabled.
Nor has the investigation established how much money can ultimately be recovered for victims.
The seven arrests and server seizures represent the latest stage of a four-year investigation, with extradition proceedings and further analysis of the recovered evidence still outstanding.
