On 3 November 2026, a simultaneous operation in seven countries targeted the infrastructure of a company suspected of supplying ready-made fake trading sites to criminal groups. More than 100 servers were seized, 17 locations were searched and 7 suspects were arrested.
The investigation began in 2022 with a complaint from a German couple who could not withdraw the money they had invested. Potential victims are in at least 50 countries; estimated losses exceed €4 million.
The company suspected of supplying fake trading sites to criminal groups as a ready-made service. The target of the 3 November operation.
The Public Prosecutor’s Office in Itzehoe, Germany, led the operation, supported by Europol and Eurojust. Authorities in Germany, Albania, Finland, Israel, Cyprus, Kosovo and North Macedonia acted simultaneously on 3 November.
The target was a company suspected of supplying fake trading sites to criminal groups as a ready-made service. According to the investigation, the company was run from Cyprus and Israel; its customers included groups operating fake call centres in Albania, Kosovo and North Macedonia.
This structure shows fraud split into parts: one company builds the site, advertising brings in the victims and call centres collect the money. The company, the platforms and their domains have not been officially named, and they do not appear on this page.
Where it breaks today: Adverts and domains that use a company or investment brand name should be detected on the day they go live.
Where it breaks today: Lists of people who have shown interest in investing changing hands is a warning sign that comes before the fraud itself.
Where it breaks today: Genuine brokers state their licence openly; no money should be sent to a broker whose licence cannot be verified.
Where it breaks today: A profit on screen is not money that can be withdrawn; no new payment should be made before a small withdrawal has been confirmed.
Where it breaks today: A request for an extra payment, tax or verification fee before a withdrawal is a clear sign of fraud.
The investigation began in 2022 with a complaint from a German couple. In the first operation that year two people were arrested; Europol-supported analysis identified seven further suspects, including call centre managers.
Material seized in the second operation in 2025 pointed to the company supplying the fake trading sites and its links to the call centres. The 3 November 2026 operation targeted this infrastructure provider directly.
Europol coordinated the international investigation and cross-checked data against its databases; on the action day it deployed experts to Albania and Kosovo. Eurojust supported European Investigation Orders, European Arrest Warrants and freezing orders; two joint investigation teams were set up.
Potential victims are in at least 50 countries. Investigators estimate losses at more than €4 million.
Victims first invested a small amount; fake profits on screen led to larger payments. When they tried to withdraw, payments were held up and contact eventually stopped.
Fake investment platforms often use a real company’s name, logo or an address that resembles its domain. Seeing domains, sites and adverts that use your name early lets you start the takedown process before victims receive a call.
Promises of fast returns, profits that show on screen but cannot be withdrawn, and growing pressure to pay are the three warning signs of this fraud.
Monitor domains, phishing pages, ads and listings that impersonate your brand, and open takedown requests from the panel.
We use cookies to ensure proper operation of our website, analyze usage, and deliver relevant content and advertisements. You can manage your preferences at any time. Cookie Policy