INTERPOL Operation Serengeti III: 1,462 Arrests, $105 Million Recovered and the Scams Behind the Crackdown
INTERPOL has announced the results of Operation Serengeti III, a coordinated law enforcement operation targeting cybercrime and related criminal networks across 21 countries.
Announced on Thursday, October 22, 2026, the operation resulted in 1,462 arrests, the disruption of 10,909 malicious networks and the recovery of more than $105 million.
INTERPOL also counted 65,929 victims and linked the criminal activity to losses exceeding $385 million.
The figures provide an indication of the scale of the criminal operations targeted during the crackdown. Behind them were different schemes, including online investment and pension fraud, phishing, business email compromise, cryptocurrency-related crimes and other forms of online financial deception.
The operation ran from June 29 to August 31, 2026, bringing law enforcement agencies together to identify suspects, disrupt criminal infrastructure and investigate activity affecting victims across multiple countries.
For ordinary internet users, the announcement is also a reminder that online scams are not always isolated incidents involving one suspicious message or one fraudulent website. Criminal operations may rely on organised networks, compromised accounts, phishing infrastructure and methods for moving money across borders.
What Is INTERPOL Operation Serengeti III?
Operation Serengeti III is the third wave of a coordinated law enforcement effort targeting cybercrime.
The first operation ran during September and October 2024, while the second took place from June to August 2025.
Together with the latest operation, the three waves have produced more than 2,000 arrests, according to the supplied information.
The participating countries in Operation Serengeti III were Angola, Benin, Cameroon, Congo, Côte d’Ivoire, the Democratic Republic of Congo, Eswatini, Gabon, Gambia, Ghana, Kenya, Mozambique, Nigeria, Rwanda, Senegal, South Africa, Tanzania, Uganda, Zambia, Zimbabwe and the United States.
The international nature of the operation matters because cybercriminals can target victims in one country while operating infrastructure, accounts or financial channels elsewhere.
Cooperation between law enforcement agencies can help investigators connect evidence across borders, identify suspects and disrupt the systems used to carry out fraud.
Operation Serengeti III Results: Arrests, Networks and Financial Losses
The main figures announced by INTERPOL show the scale of the crackdown.
- 1,462 suspects arrested: Authorities arrested suspects connected to the criminal activity investigated during the operation.
- 10,909 malicious networks disrupted: Law enforcement agencies reported disrupting thousands of networks associated with malicious activity.
- More than $105 million recovered: Authorities reported recovering funds during the operation.
- 65,929 victims identified: The investigation counted tens of thousands of victims.
- More than $385 million in associated losses: INTERPOL linked the criminal activity to losses exceeding this amount.
These figures should be understood in context. The amount recovered is not the same as the total amount lost, and the total losses associated with the investigated activity exceed the reported recovery figure.
For victims of online fraud, recovering money can be difficult, especially when criminals move funds through several accounts or convert proceeds into cryptocurrency. That is why reporting suspicious transactions quickly can be important.
Uganda: Online Investment and Pension Fraud
One of the cases described in the supplied reporting involved Uganda, where authorities disrupted two transnational fraud rings and arrested 365 foreign nationals.
The suspects were linked to online investment and pension fraud targeting victims across Asia.
Investment scams often rely on the promise of attractive returns, professional-looking websites and repeated communication designed to build confidence. Victims may be encouraged to transfer money into platforms that appear legitimate but are controlled by criminals.
Pension fraud can be particularly damaging because victims may be risking money they have saved for retirement or other long-term needs.
People should be cautious when an online contact promises unusually high or guaranteed returns. Before transferring money, verify the investment provider independently and check with the relevant national financial regulator.
Do not rely solely on a website, social media advertisement or messaging group to establish that an investment opportunity is legitimate.
Angola: Illegal Cryptocurrency Mining Centres Disrupted
In Angola, police dismantled two illegal cryptocurrency mining centres, arrested nine suspects and seized 2,000 mining devices and six illegal power transformation stations.
The seized equipment was reportedly worth more than $1 million.
Cryptocurrency mining requires computing equipment and electricity. Illegal operations can create additional risks when equipment or power infrastructure is used without proper authorisation.
The case demonstrates that cybercrime investigations can involve more than online messages, fraudulent websites and stolen credentials. They can also target the physical infrastructure supporting illegal digital activities.
The reported seizure formed part of the wider operation to disrupt criminal activity and associated infrastructure.
Nigeria: Phishing and Business Email Compromise
The supplied case summaries included a Nigerian suspect arrested over a large phishing and business email compromise operation.
The operation reportedly harvested software credentials and collected approximately 2.1 million email addresses.
Phishing is a technique used to deceive people into revealing sensitive information, often through fake login pages, misleading messages or links that imitate legitimate services.
Business email compromise, commonly known as BEC, involves attacks that exploit email accounts or impersonate trusted business contacts. Criminals may use these methods to manipulate employees into revealing information or transferring money.
These scams can affect both individuals and businesses. An employee might receive a message that appears to come from a manager, while a business may receive fraudulent payment instructions that appear to come from a supplier.
The lesson is to verify unusual requests before acting, especially when they involve passwords, sensitive documents or changes to payment details
Nigeria: International Investment Scam Moved More Than $2.4 Million
Another Nigerian suspect was reportedly arrested over an international investment scam advertised through messaging applications.
The scheme allegedly moved more than $2.4 million in suspected proceeds, much of which was laundered through cryptocurrency.
Messaging apps can make it easy for investment scams to spread through groups and personal contacts. A fraudulent offer may appear more trustworthy when it is shared by someone familiar or presented alongside screenshots of supposed profits.
However, the presence of other participants, positive comments or claims of successful withdrawals does not establish that an investment platform is genuine.
Before sending money, independently verify the company, its regulatory status and the identity of the people offering the investment. Be particularly cautious if you are pressured to recruit others, deposit additional money to withdraw your balance or send funds to unfamiliar cryptocurrency addresses.
Republic of Congo: Further Arrests
The supplied reporting also stated that 30 suspects were arrested in the Republic of Congo.
Although the provided details do not describe the full circumstances of that case, the arrests form part of the wider multinational operation.
The overall results show how investigators worked across different countries and criminal activities rather than focusing on a single type of online scam.
How Private Cybersecurity Companies Supported the Operation
Private companies also supplied intelligence during Operation Serengeti III.
Group-IB contributed information concerning phishing kits, botnets and other malicious resources hosted in Africa or used against the region. Team Cymru also contributed intelligence.
Team Cymru’s Jacomo Piccolini highlighted an important point: criminals need infrastructure to operate, and building and maintaining that infrastructure can leave traces that investigators can follow.
Phishing websites, malicious servers, botnets and related technical resources may help investigators connect separate incidents and identify the systems supporting criminal operations.
This kind of collaboration can be valuable because law enforcement agencies and private cybersecurity researchers may see different parts of the same activity.
How to Protect Yourself From the Scams Identified by INTERPOL
The scams described in Operation Serengeti III may appear in everyday email inboxes, social media accounts and messaging applications. A few practical precautions can help reduce the risk.
1. Verify investment opportunities independently
Do not trust an investment simply because it appeared in a popular messaging group or was recommended by an online contact.
Check the provider with the relevant national financial regulator using independently obtained contact information. Avoid relying on links supplied by the person promoting the investment.
2. Be careful with urgent payment requests
If a message appears to come from your boss, a supplier or a business partner and asks for an urgent transfer, verify the request through a separate, trusted communication channel.
For payment changes, call a number you already have on record instead of using the number or contact details included in the unexpected message.
3. Avoid suspicious login links
Emails and messages asking you to log in through a link may be attempts to steal credentials.
When in doubt, open the official website or application directly instead of following the link in the message.
4. Protect your email account
Use a strong, unique password and enable multifactor authentication where available. Email accounts can be valuable targets because they may contain sensitive information and can be used to reset passwords for other services.
5. Be suspicious of guaranteed profits
Promises of guaranteed returns, pressure to deposit money immediately and demands for additional payments before withdrawals are warning signs that deserve careful investigation.
6. Report fraud quickly
If you have transferred money to a suspected scammer, contact your bank or payment provider immediately. Report the incident to the relevant national cybercrime authorities.
Acting quickly may improve the chances of stopping or tracing a transaction, although recovery is never guaranteed.
What Operation Serengeti III Means for Cybercrime Prevention
Operation Serengeti III demonstrates the scale of online fraud and the importance of international cooperation in investigating criminal networks.
The cases involved different techniques, from investment scams and phishing to business email compromise and illegal cryptocurrency mining. Yet they share a common theme: criminals exploit technology, trust and weaknesses in verification to obtain money or access to sensitive information.
For individuals and businesses, cybersecurity is not limited to installing software or avoiding suspicious websites. It also involves verifying identities, protecting credentials, checking payment instructions and responding quickly when something looks wrong.
