The Fraud Ring Did Not Build Its Infrastructure. It Bought Crime-as-a-Service.

The eight-month operation ran from November 2025 through June 2026 and targeted West African organised crime groups, including Black Axe and similar networks. INTERPOL published preliminary results on 25 August 2026, covering activity in Argentina, South Africa, Italy and Romania.

The groups are associated with romance scams, cryptocurrency and investment fraud, business email compromise and related money laundering. INTERPOL also reported a rise in sextortion targeting minors, with identified victims as young as 14.

Argentina exposed the support layer

Argentina’s contribution provides the clearest view of the infrastructure economy behind the fraud. Authorities identified 196 people suspected of participating in a major Crime-as-a-Service network and arrested 17. INTERPOL says the network was suspected of supplying website domains and money-laundering support to West African organised crime groups.

Domains are not merely a technical detail in online fraud. They give operators disposable identities for investment platforms, payment portals, romance personas, corporate impersonation and credential collection. A provider that can register, rotate and replace domains lowers the cost of rebuilding after a takedown or abuse report.

Money laundering provides the second half of the service. Fraud operators need accounts, intermediaries, cryptocurrency paths, shell companies or cash-out mechanisms that can move proceeds away from the victim-facing operation. Outsourcing that work lets one criminal group specialise in persuasion while another handles infrastructure and finance.

INTERPOL deployed an Operational Support Team to Argentina to analyse seized data, identify networks and suspects and coordinate investigative leads with international partners. Many of the related investigations remain open, so the published figures are preliminary and do not establish guilt for every identified person.

South Africa showed a business-like scam operation

South African authorities raided seven Johannesburg locations linked to romance and investment scams targeting retirees in English-speaking countries. The operation resulted in 39 arrests, the blocking of 257 bank accounts and the seizure of USD 2.67 million.

INTERPOL describes a structured organisation in which people acted as conversion or retention agents at different stages of the scam. That language resembles a sales funnel because the fraud itself used one: acquire a target, establish trust, convert the person into a payer and keep extracting value.

For defenders and financial institutions, this structure matters. A single victim interaction may involve several operators, accounts and communication channels. Blocking one sender or freezing one account can interrupt the immediate event without identifying the service providers and financial paths that support the wider network.

Romania tied the call centre to EUR 143 million

Romanian authorities dismantled a group accused of running an investment scam through a call centre that promoted returns in stocks and cryptocurrencies. INTERPOL says victims’ money was diverted to electronic wallets controlled by the perpetrators and estimates that EUR 143 million was stolen and laundered globally.

Police arrested 11 people and seized approximately EUR 330,000 in cash and cryptocurrency, six properties and several luxury watches. The difference between the estimated global proceeds and the assets seized illustrates the central investigative problem: the victim-facing call centre is only one point in a financial network designed to disperse and obscure funds.

Italy supplied another example. Investigators identified one person in connection with a pan-European laundering network that used shell companies, remittance services and cash withdrawals. One account allegedly moved EUR 845,000 through 560 transactions using 20 financial instruments.

The dark web is becoming a procurement channel

INTERPOL says some of the criminal syndicates were observed procuring Crime-as-a-Service from outside providers, often through dark-web channels, to outsource money laundering and other critical functions.

This changes how organisations should think about attribution and disruption. The domain registrar, hosting account, payment wallet, money mule and social-media profile involved in one incident may belong to different service layers. Infrastructure can be shared across campaigns, while the group communicating with the victim may never directly control the systems used to move the money.

The same separation creates defensive opportunities. Reused providers, domain-registration patterns, account clusters and transaction relationships can connect incidents that look unrelated at the message level. Takedowns aimed at the service layer can also affect several customer groups at once.

Sextortion is part of the same operational ecosystem

Operation Jackal IV also identified an increase in sextortion directed at minors. INTERPOL says offenders contacted children through social media, built trust, coerced them into sharing explicit material and threatened to distribute it unless money was paid.

This is not simply another form of payment fraud. It combines manipulation, image-based abuse, extortion and serious safeguarding risk. Organisations responsible for schools, youth services or social platforms should treat rapid evidence preservation and victim support as priorities, not wait for a conventional financial-loss report.

Victims should not be blamed for engaging with an offender. Reporting, preserving account identifiers and messages where safe, and involving appropriate law-enforcement or child-protection services can help investigators connect the incident to wider infrastructure.

What defenders can take from the operation

1. Track infrastructure relationships. Record domains, hosting providers, certificates, payment destinations, wallet addresses and account identifiers. The service layer may be more reusable than the lure.
2. Correlate fraud and security telemetry. Business email compromise, fake investment portals, credential theft and laundering may appear in different queues. Shared indicators can reveal one operational chain.
3. Shorten domain-response time. Preserve evidence before requesting suspension, then share confirmed indicators with registrars, hosting providers and relevant response partners.
4. Strengthen payment-change controls. Require independent verification for altered bank details, urgent transfers and investment-related payment instructions. Do not rely on the same compromised channel for verification.
5. Prepare a sextortion response path. Ensure staff know how to escalate incidents involving minors without redistributing sensitive material or increasing harm.
6. Separate evidence from attribution. INTERPOL identified suspects and reported arrests, but many cases remain under investigation. Infrastructure overlap is an investigative lead, not proof that every user of a shared service belongs to the same group.

The supplier can be a higher-value target than the scammer

Operation Jackal IV shows why fraud disruption is moving beyond individual messages and accounts. The visible scammer can be replaced. A provider that repeatedly supplies domains, laundering capacity or other operational services can support many campaigns and many criminal customers.

That is the strategic lesson behind the 58 arrests. Cyber-enabled fraud has an infrastructure supply chain. Defenders, financial institutions and investigators gain leverage when they map and disrupt the shared services that keep that supply chain running.

Sources

• INTERPOL, 58 arrests in global effort to dismantle West African organised crime groups, published 25 August 2026; no publication time provided.
• INTERPOL, Operation Jackal III results, published 16 July 2024.
• INTERPOL Global Financial Fraud Assessment, published in 2024.
• AGERPRES reporting on Operation Jackal IV, published 25 August 2026; no publication time provided.