INTERPOL Cybercrime Crackdown Nets 1,462 Suspects, Recovers Sh13.6 Billion
An international crackdown on cybercrime has renewed attention on the growing threat posed by online fraud, digital financial crimes and organised criminal networks exploiting technology to steal money from unsuspecting victims. The reported operation, which has been associated with 1,462 suspects and the recovery of Sh13.6 billion, highlights the scale of the global effort to identify cybercriminals, disrupt their activities and recover proceeds linked to illegal operations.
The crackdown comes at a time when digital platforms have become central to banking, shopping, communication, investment and business transactions. While technological advancement has created new opportunities, it has also opened the door to criminals who exploit digital systems to deceive people, steal personal information and move illicit funds across borders.
Cybercrime has become a major concern for law enforcement agencies because offenders can target victims in several countries without physically entering those jurisdictions. Criminal networks may operate through anonymous online accounts, fraudulent websites, compromised email addresses and sophisticated financial channels designed to conceal the identities of those responsible.
INTERPOL has continued coordinating international operations to address these threats, working with national police services and private-sector cybersecurity partners to share intelligence, identify suspects and dismantle criminal infrastructure. Previous operations across Africa have targeted investment fraud, ransomware, romance scams, mobile-money fraud and business email compromise, demonstrating the wide range of crimes that can be carried out through digital platforms.
A major effort against organised cybercrime
The reported figures of 1,462 suspects and Sh13.6 billion recovered underline the importance of coordinated action against criminals who use technology to facilitate financial offences. However, the precise operation and its official figures should be confirmed against the original announcement before publication. INTERPOL’s Operation Serengeti 2.0, conducted between June and August 2025, provides a documented example of a major regional crackdown. The organisation reported 1,209 arrests and the recovery of approximately US$97.4 million, alongside the dismantling of thousands of malicious digital infrastructures. These figures are separate from the 1,462-suspect figure in the headline.
The importance of such operations extends beyond arresting individuals. Investigators must establish how criminal networks function, identify the people coordinating the schemes, trace money obtained through illegal activities and prevent the same systems from being used to target additional victims.
Cybercrime networks often involve people performing different roles. Some create fraudulent websites and applications, while others contact victims, manage accounts, collect payments or transfer stolen funds. More sophisticated groups may rely on money mules, compromised business accounts and cryptocurrency transactions to conceal the movement of proceeds.
This structure makes cybercrime difficult to investigate through isolated national efforts. A suspect may operate from one country, target victims in another and transfer the money through accounts or digital platforms in several additional jurisdictions. Effective investigations therefore require law enforcement agencies to exchange information and coordinate their responses.
INTERPOL supports cooperation among police services in its member countries, helping investigators connect information that might otherwise remain scattered across different jurisdictions. Such cooperation can help authorities identify links between apparently unrelated cases and build a clearer picture of the people and systems behind criminal activity.
Online scams remain a serious threat
One of the most widespread forms of cybercrime is online fraud, in which criminals use deception to persuade victims to send money or disclose confidential information.
Investment scams are particularly damaging because they often exploit people’s desire to improve their financial circumstances. Fraudsters may advertise opportunities involving shares, cryptocurrency, foreign exchange trading or other investments, promising unusually high returns within a short period.
They may use professional-looking websites, fabricated testimonials and fake account dashboards to make their operations appear legitimate. Some allow victims to make small initial deposits and display apparent profits to encourage larger payments.
The deception often becomes clear only when victims attempt to withdraw their money. Criminals may demand additional fees, taxes or verification payments before blocking access to the account or disappearing entirely.
During Operation Red Card 2.0, which ran from December 2025 to January 2026, INTERPOL reported that authorities in 16 African countries arrested 651 suspects and recovered more than US$4.3 million. The operation targeted high-yield investment scams, mobile-money fraud and fraudulent mobile loan applications. Investigators linked the schemes to more than US$45 million in financial losses and identified 1,247 victims.
The operation also demonstrated how fraudsters exploit social media and messaging platforms to reach potential victims. In Kenya, authorities made 27 arrests linked to fraudulent investment schemes that used fabricated testimonials and false representations about investment opportunities.
These methods can be convincing because criminals frequently impersonate legitimate businesses or misuse the names of well-known companies. Victims may believe they are dealing with an established investment provider when, in reality, they are communicating with an organised fraud network.
The cases illustrate why online investment offers require careful scrutiny. A professional website, convincing social media page or persuasive message does not guarantee that a company is legitimate. Promises of guaranteed profits, pressure to invest immediately and difficulties withdrawing funds should raise serious concerns.
Mobile-money fraud and fraudulent loan applications
Mobile-money services have transformed financial transactions across Africa by making it easier for people to send money, pay bills and conduct business without visiting a bank.
However, the popularity of these services has also attracted criminals seeking to exploit users through impersonation, social engineering and account compromise.
Fraudsters may pretend to be customer-care representatives, government officials, business owners or people known to their targets. They may claim that a transaction has failed, an account needs verification or a payment must be confirmed urgently.
The victim may then be persuaded to disclose a PIN, share a verification code or approve a transaction that transfers money to a criminal-controlled account.
Other schemes involve fraudulent loan applications. Such applications may advertise quick and unsecured loans while concealing excessive charges, collecting personal information without proper authorisation or subjecting borrowers to abusive debt-collection practices.
INTERPOL’s Operation Red Card 2.0 documented cases in Côte d’Ivoire involving fraudulent mobile loan schemes. Authorities arrested suspects and seized electronic devices and SIM cards during investigations into operations that exploited people seeking access to credit.
The threat is not limited to the direct loss of money. Personal information collected through deceptive applications can potentially be used for identity theft, targeted scams or other forms of exploitation.
As digital lending and mobile payments continue to expand, regulators, financial institutions, telecommunications companies and law enforcement agencies have an important role in protecting users. Clearer consumer information, secure authentication systems and effective reporting channels can help reduce opportunities for fraud.
Ransomware and attacks on businesses
Cybercriminals also target businesses, government institutions and other organisations through attacks that disrupt computer systems or compromise sensitive information.
One major threat is ransomware, a form of malicious software that can prevent organisations from accessing their files or systems until a payment is demanded. Some criminal groups also threaten to publish stolen information if the victim refuses to pay.
Such attacks can interrupt operations, delay services, expose confidential records and impose significant recovery costs. Hospitals, educational institutions, financial service providers and public agencies can face particularly serious consequences when essential systems become unavailable.
Business email compromise is another significant threat. In these schemes, criminals impersonate company executives, suppliers or trusted business partners to persuade employees to transfer money or disclose confidential information.
A fraudulent email may appear to come from a senior manager requesting an urgent payment. In other cases, criminals compromise a legitimate email account and use an ongoing business conversation to change payment instructions.
Because these messages may resemble ordinary workplace communication, employees can be deceived even when an organisation has basic cybersecurity measures in place.
INTERPOL’s documented Operation Serengeti 2.0 targeted ransomware, online scams and business email compromise, among other cyber-enabled offences. Its results demonstrated the value of combining digital investigation techniques with intelligence shared across borders.
For businesses, the implications are clear. Cybersecurity cannot rely entirely on antivirus software or passwords. Organisations also need secure payment-verification procedures, regular system updates, staff training, reliable data backups and clear processes for reporting suspicious activity.
The challenge of tracing and recovering stolen money
Recovering money linked to cybercrime can be as complicated as identifying the people responsible.
Once victims transfer funds, criminals may quickly move the money between accounts, use intermediaries or convert it into digital assets. These transactions can create additional investigative challenges, especially when several financial institutions and countries are involved.
Investigators must establish the connection between the money and the alleged crime, identify where the funds have moved and work with relevant institutions to freeze or seize assets where the law permits.
The process may involve bank records, mobile-money transaction histories, digital wallets, communications data and electronic devices. Digital evidence must be collected and handled appropriately to support legal proceedings.
The reported recovery of Sh13.6 billion is therefore an important headline figure, but the precise meaning of the recovery matters. Money recovered, money frozen, assets seized and losses prevented are not necessarily the same thing. Nor does the total automatically mean that every victim has received compensation.
The eventual return of funds may depend on investigations, court orders, ownership claims and the legal procedures governing seized assets.
For victims, the recovery process can be frustrating because money may have passed through multiple accounts or jurisdictions before investigators identify it. This makes early reporting particularly important. Prompt notification can give financial institutions and investigators a better chance of tracing transactions before the funds move further.
Authorities also need to communicate clearly about the status of recovered assets so that the public can distinguish between funds seized during an investigation and money actually returned to victims.
The growing role of artificial intelligence
Artificial intelligence is adding another dimension to the cybercrime challenge. Criminals can use automated tools to produce convincing messages, generate fraudulent content and scale up attempts to deceive potential victims.
INTERPOL’s African Cyberthreat Assessment Report published in August 2026 said artificial intelligence was linked to 55 per cent of reported cybercrimes across Africa. The report described a threat landscape in which criminals were using technology to make attacks faster, more scalable and harder to detect.
AI-assisted fraud can include convincing phishing messages, impersonation attempts and fabricated content designed to manipulate a target. Criminals may also use synthetic audio or images to make an impersonation appear more credible.
For example, a person may receive a message that appears to come from a colleague or relative asking for an urgent transfer. In more sophisticated cases, an impersonator may use manipulated audio or video to strengthen the deception.
These developments make it increasingly important to verify unusual requests through a separate, trusted communication channel. A familiar voice, profile picture or writing style should not be treated as conclusive proof of identity when money or sensitive information is involved.
The same technology can also support the fight against cybercrime. Investigators and cybersecurity professionals may use advanced analytical tools to examine large volumes of information, identify suspicious patterns and connect cases that appear unrelated.
However, technology alone cannot solve the problem. Effective responses also require trained investigators, reliable evidence, appropriate legal frameworks and cooperation between law enforcement agencies and private organisations.
Why international cooperation matters
Cybercrime frequently crosses borders, making international cooperation a central part of the response.
A criminal group may use infrastructure hosted in one country, recruit accomplices in another and target victims across several regions. Investigators working in only one jurisdiction may see part of the activity without understanding the full network.
INTERPOL helps national police services share information and coordinate efforts against such cross-border threats. Its operations can bring together law enforcement agencies, cybersecurity companies and other partners with relevant technical expertise.
Private-sector cooperation is particularly important because internet service providers, technology companies and financial institutions may hold information that helps investigators identify malicious websites, trace transactions or link suspicious accounts.
During coordinated operations, authorities can combine intelligence with searches, arrests, device seizures and the disruption of criminal infrastructure. This approach can make it harder for offenders to continue operating through the same websites, servers or communication channels.
Nevertheless, the arrest of suspects does not mean that every criminal network has been dismantled permanently. Other members may remain at large, and offenders may attempt to rebuild their operations using new accounts, domains or technical systems.
Successful enforcement must therefore be accompanied by sustained investigations, prosecution where evidence supports charges, improved cybersecurity and public awareness.
What the crackdown means for Kenya
Kenya’s widespread use of mobile money, digital banking, online marketplaces and social media makes cybercrime prevention an important national concern.
Individuals use digital services for everyday transactions, while businesses increasingly depend on online platforms to communicate with customers, receive payments and manage operations. These developments create opportunities for economic growth but also increase the importance of protecting personal and financial information.
Kenyan consumers should be alert to unsolicited messages asking them to reveal PINs, passwords or one-time verification codes. People should also be cautious about investment offers promoted through social media, particularly those promising unusually high or guaranteed returns.
Before sending money to an unfamiliar person or business, users should independently verify the recipient and the legitimacy of the service. They should avoid clicking suspicious links or installing applications from untrusted sources.
Anyone who suspects fraud should contact the relevant bank or mobile-money provider promptly, preserve transaction messages and other evidence, and report the matter to the appropriate law enforcement authorities.
Businesses should strengthen internal controls around payments and sensitive information. Employees should verify unusual requests for urgent transfers through established channels rather than relying exclusively on email or messaging applications.
Financial institutions and telecommunications providers also have an important role in detecting suspicious activity, protecting accounts and responding quickly to reports from customers.
At the institutional level, sustained investment in digital forensics, cybercrime investigation and information sharing can help strengthen Kenya’s response to increasingly complex offences.
Public education is equally important. People need practical guidance on recognising scams, securing accounts and responding when they suspect that their information has been compromised.
Arrests are only part of the solution
Large-scale cybercrime operations can disrupt criminal networks and demonstrate that online offences are not beyond the reach of law enforcement. However, the longer-term objective must be to make it harder for criminals to target victims in the first place.
This requires cooperation between governments, police services, technology companies, financial institutions, businesses and the public.
Authorities need the resources and technical skills to investigate sophisticated cases, while prosecutors and courts must be able to handle digital evidence through appropriate legal processes. Financial institutions should maintain effective safeguards, and technology providers should respond responsibly to credible reports of abuse.
Individuals also have a role to play by adopting safer online habits and reporting suspicious activity rather than allowing embarrassment or fear to prevent them from seeking assistance.
Victims should not automatically be blamed for falling for sophisticated scams. Criminals deliberately exploit trust, financial pressure, urgency and personal relationships. A strong response should focus on holding offenders accountable while helping affected people report crimes and access appropriate support.
The reported INTERPOL crackdown serves as a reminder that cybercrime is an international challenge requiring sustained attention. Recovering significant sums and arresting suspects can represent important progress, but the results must be supported by transparent reporting, effective prosecution and continued efforts to protect vulnerable users.
As digital services become even more deeply integrated into daily life, the fight against cybercrime will depend not only on the number of arrests made but also on the ability of authorities and institutions to prevent future attacks, trace illicit funds and reduce the harm suffered by victims.
