On 3 November, at 13:15, Eurojust quietly edited a line in its own press release: the list of participating countries had changed. It was the only visible trace of how many moving parts the operation had.

By then, authorities in Albania, Cyprus, Finland, Germany, Israel, Kosovo and North Macedonia had searched 17 locations, arrested seven suspects pending extradition to Germany, and seized more than 100 servers. The action was led by the Itzehoe public prosecutor's office in Schleswig-Holstein, with Europol and Eurojust coordinating the cross-border work.

The target was not a call centre.

According to Europol, investigators went after a company suspected of supplying fraudulent trading platforms to the criminal groups that ran the call centres — allegedly operating a crime-as-a-service model out of Cyprus and Israel. Its clients, in the same account, operated boiler rooms in Albania, Kosovo and North Macedonia.

The funnel, step by step

The mechanism is depressingly repeatable. Deceptive affiliate-marketing advertisements pulled people onto what looked like a legitimate investment platform for cryptocurrencies, foreign exchange or stocks. The data those visitors left behind was sold on to criminal call centres. Supposed brokers then rang them with an investment opportunity.

A small first transfer was encouraged. The account then displayed fictitious profits, which made the platform look credible and the trade look successful. Those paper gains were used to push for larger transfers. When a victim asked to withdraw, the operators stalled, blocked or delayed. Eventually the contact stopped, and the money was gone.

In the investigators' tally, evidenced losses exceed EUR 4 million, with potential victims in more than 50 countries. That gap between a modest four-million figure and a fifty-country footprint is the story: the number reflects what police could reconstruct, not what was taken.

Why the supplier was the target

Going after the platform provider rather than the call centres is a deliberate choice about leverage. A single operator that supplies the websites, the trading front-ends and the fake account balances can be plugged into dozens of separate fraud operations. Removing it degrades many at once; arresting one boiler-room manager does not.

The investigation took four years. It started in 2022, when a German couple reported that they could not withdraw money invested through an online trading platform. A first international action day that year produced two arrests. A Europol-supported analysis identified seven further suspects, including suspected call-centre managers. A second action day in 2025 brought more arrests and more seized material — and analysis of that material is what exposed the suspected infrastructure provider, setting up this week's operation.

Eurojust coordinated the execution of European Investigation Orders, European Arrest Warrants and freezing orders, and set up two joint investigation teams: one with Albania, Germany and Poland, another with Albania and Kosovo. Europol's European Financial and Economic Crime Centre ran the analysis, and on the action day deployed experts to Albania and Kosovo for on-the-spot digital forensics and database checks, backed by a Virtual Command Post.

What is not settled

The seven suspects are suspects; no conviction exists and the allegations have yet to be tested in court. The servers are evidence now, not a service — the platforms they hosted are offline, but the people who paid into them are not made whole by a seizure. Asset recovery and victim identification across 50-plus jurisdictions move slowly, and most investment-fraud victims never report at all, which is precisely why the geographic spread in a Europol release usually understates the real thing.

What the case does establish is a template: when the fraud stack is rented as a service, the highest-value target is the landlord, not the tenants.

Sources