Europol announced on Tuesday, November 3, that searches across 17 countries led to seven arrests and the seizure of more than 100 servers in an investigation into an investment-fraud network. Victims in more than 50 countries lost an estimated $4.5 million or more.
Raids Across 17 Countries Target a Fraud-as-a-Service Company
The network was run through a company based in Cyprus and Israel, with call centers in Albania, Kosovo and North Macedonia. Authorities allege the company supplied cybercrime groups with trading websites and call centers, essentially operating as a service provider to other fraud operations.
Estimated losses are at least $4.5 million, which one outlet gave as about EUR 4 million. Support for the operation came from Albania, Cyprus, Finland, Germany, Israel, Kosovo, North Macedonia and Poland. The seven suspects face extradition to Germany.
How the Fake Trading Platforms Worked
The company ran fake crypto, forex and stock trading platforms that showed fictitious profits to victims. Operators applied psychological pressure to push people into depositing more money, and when victims tried to withdraw funds, the platforms blocked those withdrawals. Affiliate marketing ads fed leads of potential victims into the system.
This arrangement divided the work. One layer produced the websites and phone operations, another generated traffic through advertising, and the criminal groups using the service handled the victims. One trade report described the case as a German “crime-as-a-service” bust.
A Case That Began With One German Couple in 2022
The investigation started in 2022, when a German couple could not withdraw funds from a trading platform. Two people were arrested that year. Further seizures in 2025 led to the coordinated operation announced this week.
Why the Timeline Spans Four Years
The path from a single complaint to a 17-country operation shows how long it can take to unwind a structure built to hide who runs it. A fraud victim’s report in Germany eventually led investigators to infrastructure and a company in several other jurisdictions. The seizure of servers in 2025 appears to have supplied evidence that fed the final raids.
What the Server Seizures Disrupt
More than 100 seized servers represent the technical backbone of the websites that victims saw. Taking them offline cuts the fraud groups off from the trading portals they relied on, at least until they replace them. Because the company served multiple groups, the action affects more than one scam operation at the same time.
Europol’s announcement frames the case as a dismantling of infrastructure that supported multiple groups, not as the arrest of a single gang. That distinction matters for the scale of impact. The network’s reach to victims in more than 50 countries suggests the platforms were built for a wide audience, and the use of affiliate advertising points to a lead-generation machine designed to attract new victims continuously.
The financial figure may understate the harm. The reported loss of at least $4.5 million is described as an estimate, and the sources do not say how many individual victims it covers. Investment fraud of this kind often relies on repeated deposits, so a single victim may account for many transfers.
Open Questions on Extradition and Prosecution
The seven suspects face extradition to Germany, but the sources do not name them or say when proceedings will occur. The material also does not state which of the countries involved hold the suspects.
What Investment-Fraud Victims and Banks Can Take From the Case
The tactics described, fictitious profits followed by blocked withdrawals, are warning signs that apply to any platform promising high returns. Victims who cannot withdraw money from a trading site have reason to report it, as the German couple did in 2022. Their complaint is the origin of an investigation that, four years later, produced arrests and server seizures across multiple countries.
