INTERPOL’s Operation Serengeti III arrested 1,462 suspects across 21 countries targeting fraud, phishing, business email compromise, ransomware, and digital extortion. In Uganda, investigators found scam call centres using prepared scripts and fake trading platforms to persuade people, including pensioners, to make fraudulent investments. A separate Nigerian investment scam was promoted through messaging apps.
Interpol's Operation Serengeti III brought together law enforcement from 21 countries and led to 1,462 arrests, the disruption of 10,909 malicious networks, and the recovery of more than $105 million. Investigators identified 65,929 victims linked to losses exceeding $385 million across fraud, phishing, business email compromise, ransomware, and digital extortion cases.
In Uganda, authorities dismantled two international fraud networks running call centers that used prepared scripts and fake trading platforms to convince people to invest. Victims included pensioners who believed they were making legitimate investments through what looked like a real trading platform. A separate case in Nigeria involved an investment scam promoted through messaging apps, with proceeds laundered through cryptocurrency.
The call center model relied on staff reading from prepared scripts rather than responding naturally, a hallmark of organized vishing operations. Callers presented themselves as representatives of legitimate-looking investment or pension-growth platforms, then directed targets to open accounts and transfer funds through websites built to resemble real trading services. The messaging app variant followed a similar logic: an unsolicited investment pitch arrived through a trusted communication channel and pushed recipients toward cryptocurrency payments that are harder to trace and reverse.
Several factors made these schemes effective:
A separate strand of the operation also involved stolen software credentials and roughly 2.1 million harvested email addresses used to enable phishing and business email compromise, showing how credential theft can feed into broader social engineering campaigns.
Organizations and individuals can reduce exposure by verifying any investment or pension-related outreach through official channels before acting, treating unsolicited calls and messaging app investment pitches with skepticism, and protecting software and email credentials so they cannot be reused to power phishing or business email compromise campaigns. Encouraging employees nearing retirement and finance teams to report suspicious investment contact can help catch these schemes early.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It was an Interpol led operation involving law enforcement from 21 countries that resulted in 1,462 arrests, disrupted 10,909 malicious networks, and recovered more than $105 million.
Call center staff followed prepared scripts to convince victims, including pensioners, to invest through fake trading platforms and websites presented as legitimate investment opportunities.
A separate Nigerian investment scam was promoted through messaging apps, and much of the resulting proceeds were laundered through cryptocurrency.
Yes, a Nigerian suspect was arrested in connection with phishing and business email compromise that involved stealing software credentials and collecting about 2.1 million email addresses.
That polished trading dashboard? It could be a prop. In Uganda, scam call centres used prepared scripts: ‘I’m calling about an investment opportunity.’ Then they steered people, including pensioners, to fake trading websites. Here’s the tell: the caller can pitch returns, but can’t give you independently verifiable firm details. A slick website isn’t proof. The offer might also arrive by messaging app. Before opening an account or sending money, look up the firm yourself in your regulator’s official register.
INTERPOL’s Operation Serengeti III led to 1,462 arrests across 21 countries and disrupted fraud, ransomware, business email compromise and other cybercrime operations. One major case involved rotating call centers that used scripted investment pitches, fake trading platforms and fraudulent websites…
Interpol's Serengeti III operation led to 1,462 arrests across Africa and the recovery of more than $105 million linked to cybercrime. In Uganda, fraud rings used call-center scripts, fake trading platforms, and fraudulent websites to persuade pensioners in Asia to invest in fictional…
This bulletin describes multiple real-world scams where attackers make fake pages and messages look like routine, trusted experiences (search answers, Google login pop-ups, “giveaways,” and official-sounding calls). Examples include a fake Claude Max giveaway using a convincing fake Google sign-in…
The bulletin describes real-world social engineering where staff were tricked into disclosing sensitive data or access. In one case, Revolut employees responded to fraudulent information requests sent from a real government-domain email account, exposing extensive customer records. Separately,…
This bulletin describes multiple real-world social engineering campaigns where attackers trick people into trusting a familiar screen, like a search result “install guide,” a recruiter outreach, or a helpdesk phone call. The lures push victims to paste commands, install fake software, or reset MFA,…
This bulletin describes multiple real-world social engineering campaigns where attackers impersonate IT support or use trusted-looking sharing and “Allow” prompts to gain access. Several campaigns abuse Microsoft Teams and document-sharing lures to trick employees into installing remote tools or…
