Behind many online trading scams sits a question most victims never think to ask: who built the website they trusted? On 3 November, authorities in seven countries moved against a company suspected of supplying exactly that. The action against an investment fraud scheme with potential victims in more than 50 countries led to the seizure of over 100 servers and the arrest of seven suspects.
The operation was led by Germany’s Itzehoe Public Prosecutor’s Office, with support from Europol and Eurojust. Authorities in Albania, Cyprus, Finland, Germany, Israel, Kosovo and North Macedonia took part.
They searched 17 locations and seized servers, evidence and assets. The seven suspects were arrested with a view to extradition to Germany. Investigators estimate losses of more than EUR 4 million.
The Investment Fraud Supply Chain
The target was not a single scam group. Investigators say the company supplied fake trading platforms to criminal groups, operating what they describe as a crime-as-a-service model from Cyprus and Israel.
Its suspected clients ran fraudulent call centres in Albania, Kosovo and North Macedonia. Those call centre operators allegedly persuaded victims to hand over their savings. In other words, one business built the storefront, and others did the selling.
How Victims Were Drawn In
The scheme promised large, quick returns from trading in cryptocurrencies, foreign currencies or stocks.
It started with an advert. The investigation found that affiliate marketing was abused to attract potential victims, with deceptive ads steering people towards fraudulent investment platforms and exploiting their trust in online promotions.
The personal data collected this way was then sold to the criminal groups running the call centres. Operators contacted potential victims with supposed investment opportunities and turned that first flicker of interest into repeated demands for money.
Why Victims Kept Paying in This Investment Fraud
The method relied on making the scam look like it was working.
Victims were first encouraged to transfer a small amount. Their online accounts then showed fictitious profits, which made the platform seem credible and the investment successful. Supposed brokers used those fake gains, along with constant psychological pressure, to push victims into sending larger and larger sums.
The problem surfaced when victims tried to withdraw. Operators used delaying tactics to block payments. Eventually, contact stopped altogether, and victims were left unable to recover their money.
How a Couple’s Complaint Exposed the Network
The case began in 2022, when a German couple reported that they could not withdraw money they had invested through an online trading platform.
A first international action day that year led to two arrests and seized evidence. With Europol-supported analysis, investigators identified seven more suspects, including suspected call centre managers. A second action day in 2025 brought further arrests and seizures of money and evidence. Analysis of that material exposed the suspected infrastructure provider and its links to call centre operators, setting up this month’s operation.
In total, the case took four years to reach the company allegedly behind the platforms.
The Role of Europol and Eurojust
Europol’s European Financial and Economic Crime Centre analysed the data, cross-checked it against Europol’s databases and brought national investigators together to plan joint action. On the action day, Europol sent experts to Albania and Kosovo to support digital forensic work, and its Virtual Command Post supported the coordinated intervention.
Eurojust supported the execution of European Investigation Orders, European Arrest Warrants and freezing orders. Two joint investigation teams were set up at the agency: one involving Albania, Germany and Poland, and another involving Albania and Kosovo. Judicial actions on 3 November were coordinated from Eurojust’s headquarters in The Hague.
