// Large Investment Fraud Network Disrupted After Cross-Border Operation

Call Centres Structured Like Businesses

According to investigators, the network operated through several call centres based in Tirana, Albania. These facilities were described as highly organised, mirroring legitimate corporate environments with structured hierarchies and clearly defined roles.

The operation allegedly involved up to 450 individuals working across different departments, including customer acquisition, customer management, IT, finance, and administration. Teams were typically composed of six to eight operators, each focusing on specific language groups such as German, English, Italian, Greek, and Spanish. Team leaders oversaw daily activities, while overall operations were managed at the call centre level. Employees were reportedly paid a base salary of around €800 per month, supplemented by commissions tied to successful scams, with payments made both in cash and through bank transfers.

How Victims Were Targeted

Authorities state that victims were initially drawn in through online advertisements and fake investment platforms promising high returns. After registering, individuals were contacted by so-called “conversion agents” who introduced the investment opportunity and encouraged initial deposits.

Once engaged, victims were handed over to “retention agents,” who posed as financial advisors and maintained ongoing contact. These agents reportedly used various tactics to build trust, including communicating in the victim’s native language and presenting themselves as experienced professionals. In some cases, victims were persuaded to install remote access software, allowing operators to take control of their devices. This access was allegedly used to manipulate transactions and convince victims to commit additional funds under the impression of profitable investments.

Follow-Up Scams and Cryptocurrency Use

Investigators also describe a secondary phase of the scheme targeting individuals who had already lost money. These victims were re-contacted with offers to recover their funds, only to be asked to make further payments. A common method involved instructing victims to open accounts on cryptocurrency platforms and deposit an initial amount, typically around €500. This process was presented as part of the recovery effort but was allegedly used to extract additional funds. Authorities claim that none of the invested money was actually used for trading or investment, but instead moved through a broader international laundering network.

Investigation and Coordinated Action

The investigation reportedly began in Austria in mid-2023 after a concentration of victims was identified in Vienna. In 2024, Austrian authorities requested assistance through Europol regarding a suspicious IP address linked to Albania. This led to the launch of a parallel investigation by Albanian authorities. With coordination support from Eurojust, a joint investigation team was established. A coordinated action day took place on April 17, 2026, resulting in the arrest of ten suspects in Tirana.

Searches were conducted at three call centres and nine private residences. Authorities report seizing approximately €891,735 in cash, along with hundreds of electronic devices, including computers, mobile phones, laptops, and various storage media. The data recovered is expected to undergo further forensic analysis.

Ongoing Analysis

Victims linked to the operation were reportedly located in multiple countries, including Italy, Germany, Greece, Spain, the United Kingdom, and Canada. Europol personnel were deployed to assist in securing and processing large volumes of digital evidence, which is expected to be shared with authorities in affected jurisdictions. Officials also noted that a Virtual Command Post was used during the operation to coordinate real-time information exchange. Eurojust is said to have facilitated cooperation between agencies, including logistical and financial support for the joint effort.

Conclusion

While authorities present the operation as a significant disruption of an organised fraud network, the full scope of the activities and the extent of the damage remain subject to ongoing investigation. Further analysis of seized data is expected to provide additional insight into how the network operated and how funds were distributed.