Germany Busts ‘Crime-as-a-Service’ Investment Fraud Outfit
German police led a multinational probe that exposed an alleged crime-as-a-service provider supplying fraudulent trading platforms to investment scammers.
German police led a multinational probe that exposed an alleged crime-as-a-service provider supplying fraudulent trading platforms to investment scammers.
You see an online advertisement promising quick returns from trading cryptocurrency, foreign currencies, and stocks. You give the “investment firm” your information, and an operator calls you and convinces you to transfer a small amount of money into a platform. You make early profits quick, so you deposit increasingly large sums of money. But when you attempt to withdraw your earnings, the operator stalls for a while until finally cutting off contact.
This pattern is familiar to victims of investment fraud, a multinational criminal industry that relies on social engineering to convince would-be-investors that they’re about to make substantial gains before pulling the rug out from under them.
Europol today shared news of the disruption of one such operation, an investment fraud scheme with potential victims across more than 50 countries and a company allegedly supplying fraudulent trading platforms and leads to criminal groups. According to a press release, Europol and Eurojust supported an international operation involving authorities in Albania, Cyprus, Finland, Germany, Israel, Kosovo, and North Macedonia.
The German Itzehoe Public Prosecutor’s Office led the operation, targeting a company suspected of supplying phony trading websites and multiple call centers to criminal groups; investigators estimate losses to exceed 4 million euros.
International authorities searched 17 locations, including a call center in Kosovo, leading to the seizure of 100 servers and the arrests of seven suspects.
A Fraud Investigation That Spans Years
The law enforcement action reflects a multiyear investigation that began in 2022, according to Europol, when a German couple reported they could not withdraw money invested through an online trading platform. This led to two previous “action days” by authorities, one in 2022 (involving two arrests and the seizure of evidence) and another in 2025 (involving more arrests and seizures of money and evidence).
“Analysis of the material recovered exposed the suspected infrastructure provider and its links to call centre operators, paving the way for the latest operation,” the press release read.
A Eurojust press release provided further detail regarding the extent of the operation. The analysis of evidence seized during the second action day exposed a company based in Cyprus and Israel allegedly offering “crime-as-a-service,” supplying criminal groups with fraudulent websites that funnel targets into the central investment scam.
The data of potential victims visiting these websites and expressing interest would be sold as leads to call centers, which contacted the victims to persuade them to invest their money, leading to repeated demands for additional investments. Authorities identified suspected call center-operating clients of this company in Albania, Kosovo, and North Macedonia.
The fraud operation guaranteed singificant returns for trades in cryptocurrencies, foreign currencies, or stocks, according to Europol. But authorities found that the seemingly legitimate platforms were run by “brokers” that used phony profits and social engineering tactics to convince victims to keep investing. Additionally, investigators also found the operators used affiliate marketing services and deceptive advertisements to lure in potential victims.
Austin Anderson, director of threat intel at cybercrime disruption firm Netcraft, tells Dark Reading that operations like these that target upstream providers can help disrupt investment fraud operations at scale.
“Fraudsters have increasingly specialized in one piece of an attack’s supply chain, as seen in this scheme where websites collected personal data that was sold to call centers to ultimately coerce funds from victims,” he says. “While this can breed sophistication in each actor’s niche, it also introduces fragility when a large dependency like the call center is disrupted. Ultimately, without arrests that remove fraudsters from the market, these operations only temporarily disrupt operations while actors rebuild their infrastructure.”
