A coordinated operation by European law enforcement authorities (Europol) has led to the dismantling of a highly organised online fraud ring, which had extracted over €50 million from victims in many countries in Europe and beyond. The case highlights how modern criminal networks exploit corporate operating models to hide behind a veneer of legitimacy.
Coordinated operation in Austria and Albania with the support of Europol and Eurojust
The Austrian and Albanian authorities , in close cooperation with Europol and Eurojust , carried out a joint operation on 17 April 2026, following an investigation lasting more than two years. The operation included arrests , raids on call centres and the seizure of large sums of money and equipment.
See also: Hackers arrested for hacking and selling Roblox accounts
Specifically, ten people were arrested in Tirana, three call centers and nine residences were searched, while almost 900,000 euros in cash, as well as hundreds of IT and mobile phone devices, were seized.
“Corporate” type organization and professional fraud structure
The criminal network operated from the Albanian capital with up to 450 employees, who were divided into departments similar to those of a legitimate business. There were teams for customer acquisition, support, financial management, human resources and technical infrastructure.
The so-called “conversion agents” made initial contact with the victims, while the “retention agents” acted as investment advisors, guiding the victims throughout the fraud and reinforcing the illusion of credibility.
Europol stressed that this corporate structure was a decisive factor in the escalation of the fraud, as it provided organization, hierarchy and stability that made it difficult to detect .
Psychological manipulation and remote access technology
Victims were identified through fake advertisements on social networks and search engines, which promoted non-existent investment platforms with promises of high returns. After registering, users were assigned “personal advisors” who were actually members of the scheme.
See also: Tri-Force Sentinel Operation: Authorities dismantle international fraud network
software Remote access to gain complete control of the victims' computers was then used . This allowed the perpetrators to monitor accounts, fabricate fake profits, and exert intense psychological pressure for new deposits. The money was never invested, but instead funneled directly into the laundering network.
Europol: Targeting users in multiple countries
A particular feature of the scheme was the use of teams speaking different languages, such as German, English, Italian, Greek and Spanish. This allowed for a personalized approach to victims in many countries, significantly increasing the effectiveness of the deception.
Employees received a monthly salary of approximately 800 euros, while commissions were added for each successful fraud, which enhanced the productivity of the circuit.
Research timeline and international collaboration
The investigation began in June 2023 after multiple reports of victims in Austria. In April 2024, through Europol, authorities identified digital traces leading to Albania, resulting in the launch of a parallel investigation by local authorities.
Eurojust played a key role in coordinating the joint investigation team, providing funding, interpretation and operational support. This cooperation allowed the major operation in 2026 to be carried out with high precision and speed.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
See also: Taylor Swift deepfakes promote scams on TikTok
Second level of fraud through “fund recoveries”
Even more worrying was the practice of retargeting the same victims. The perpetrators would re-contact people who had already lost money, promising that they could recover their funds.
They demanded a deposit of around 500 euros on cryptocurrency platforms as a “final payment”, thus carrying out a second round of fraud. To avoid detection, they used new aliases and different identities.
Warnings and cybersecurity
The authorities point out that every investment platform must be verified by official regulators before any financial transaction. In addition, unsolicited “money-back” offers are often part of secondary fraud and should be reported immediately to the relevant authorities.
The case highlights the ongoing evolution of cybercrime, where technology, psychological manipulation, and corporate-style organizational structure combine to create highly efficient and difficult-to-detect networks.
