Authorities from Germany, Cyprus, Finland, Albania, Israel, Kosovo and North Macedonia struck an investment-fraud network on Tuesday, shutting more than 100 servers and arresting seven suspects. Eurojust, the EU agency for judicial cooperation, estimates documented losses above €4 million, and Europol says potential victims live in at least 50 countries. Searches covered 17 locations, including a call centre in Kosovo.
The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.
We may earn a commission if you sign up.
The case began with one German couple. In 2022 they put their savings into an online trading platform and discovered they could not withdraw the profits it displayed. Their complaint reached prosecutors in Itzehoe, Germany, who ended up leading a multi-country investigation that took more than four years.
The suspects were arrested for surrender or extradition to Germany. In its 3 November press release on the operation, Eurojust names no suspects, victims or officials, so the public record so far consists of figures and agency names rather than people. Eurojust coordinated the action day from its headquarters in The Hague and backed the work with European Investigation Orders, European Arrest Warrants and freezing orders.
Fast-profit promises and a fabricated dashboard
Eurojust describes a script that will look familiar to anyone who has followed online investment scams. Victims were promised large profits within a short period from trading cryptocurrencies, foreign currencies and stocks. Small first deposits were followed by displays of inflated gains, which made the platform look legitimate and encouraged bigger transfers. The website itself was the sales tool, and the more convincing it looked, the more money flowed in before anyone tried to take any out.
Brokers then leaned on victims psychologically to invest further large sums. Withdrawal requests met delaying tactics, and eventually the perpetrators disappeared. Eurojust’s wording is that the victims realised their money was gone.
The mechanics behind such operations are visible in the Austrian-led case. Per Infosecurity Magazine, victims were drawn in by misleading advertisements on social media and search engines, told to open cryptocurrency accounts with an initial €500 deposit, and then handled by a retention agent posing as an investment adviser. Some were later approached again with an offer to recover their lost funds, a second scam layered on the first. The group sometimes took full remote control of victims’ computers through remote access software, and call-centre staff earned a monthly salary of €800 plus commissions for new victims.
A website supplier in Cyprus and Israel, customers in the Balkans
Evidence from an earlier round of arrests pointed to a company based in Cyprus and Israel. According to Help Net Security’s report on the takedown, the company allegedly supplied criminal groups with fraudulent websites, a crime-as-a-service model in which one team builds the storefront and others staff the phones. Its suspected clients, who ran the fraudulent call centres, were traced to Albania, Kosovo and North Macedonia.
Eurojust set up two joint investigation teams: one bringing together German, Polish and Albanian authorities, the other Albanian and Kosovar ones. Europol analysed data and ran database checks, sent experts to Albania and Kosovo for digital forensics, and supported the operation through its Virtual Command Post. Israel’s participation came through its police, including the National Cybercrime Unit Lahav 433.
Two earlier action days and a long record of Albanian call centres
Tuesday’s raids were the third stage. A first action day produced two arrests and a large haul of evidence. Investigators then identified seven more suspects, among them managers of the call centres used to pressure victims, and a second action day brought more arrests and the seizure of evidence and cash. Tuesday’s searches followed from that material.
Albania has featured in cases like this before. A Eurojust release from March 2022 reported 15 arrests in Tirana over two fraudulent platforms, BrokerZ and Globalix, that lured German victims into products that did not exist. More recently, a July 2026 notice from the European Commission described an Austrian-led case with ten arrests and at least €50 million in losses, built around call centres in Tirana. Infosecurity Magazine reported that case employed about 450 staff in teams of six to eight organised by language.
The scale of the wider problem is large. Infosecurity Magazine cited the FBI’s finding that investment fraud was the highest-grossing cybercrime type in 2025, with more than $8.6 billion in reported losses. Against that figure, a €4 million case is modest, which is partly why prosecutors lean on the supply side: the websites, the servers and the managers who staff the phones are shared across many scams, so removing them hits more than one victim group at a time.
Open questions remain about scale. The 50-country figure describes potential victims, not confirmed ones, and Eurojust gives no count of people who actually lost money. The €4 million estimate is likewise described as the documented total, which leaves room for losses that never reached investigators. Whether the Cyprus and Israel supplier faces charges of its own, and where the seven arrested suspects will be tried, was not stated in Eurojust’s release.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
The day in tech, in one email: Get TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- The FBI told the rest of ShinyHunters to surrender after a 24-year-old was arrested
- Two passengers died at an Ohio toll plaza, and the NTSB now wants the cash lanes shut
- Long use of a common prostate pill is tied to a higher chance of glaucoma
- Ford is recalling 223,472 F-150 pickups because the fuel tank can leak or detach
