INTERPOL said a global fraud crackdown spanning 97 countries led to 5,811 arrests and the interception of $293 million in suspected illicit assets, in one of the broadest coordinated actions yet against online financial crime, social-engineering scams and related money-laundering networks.
The operation, named First Light, ran from January 15 to April 30, 2026, and targeted email fraud, romance scams, fraudulent investment schemes, impersonation networks, online betting scams and the financial channels used to move stolen funds. Authorities identified more than 142,000 victims, froze 31,014 bank accounts and resolved 23,715 cases worldwide, according to INTERPOL data.
The agency said 15,606 suspects were identified during the operation. Law enforcement agencies also issued 99 international notices and diffusions, tools used to alert police across borders about wanted persons, suspected criminals or requests for cooperation.
A major part of the operation focused on stopping payments before stolen funds could disappear through banking channels, digital wallets, cryptocurrency swaps or networks of money mules. INTERPOL said the action was supported by its Global Rapid Intervention of Payments system, which is designed to help authorities quickly halt both fiat and digital asset transfers linked to suspected criminal activity.
The results point to the growing scale of fraud operations that combine psychological manipulation with fast-moving digital payment systems. Fraud groups are increasingly using fake identities, romance-based deception, impersonation of officials and business email compromise to persuade victims to transfer funds voluntarily. Once the money moves, it is often routed through multiple accounts, payment processors, wallets or tokens to make recovery more difficult.
Authorities said the cases uncovered during First Light showed how cross-border fraud networks are adapting to law enforcement pressure by using more complex methods to obscure the origin and destination of stolen money. That includes the use of cryptocurrency, cross-chain token swaps, illegal gambling sites and fake online platforms designed to persuade victims that they are dealing with legitimate businesses or public officials.
The arrests do not by themselves establish guilt. Suspects detained during the operation will be handled under the legal systems of the countries where they were arrested or where charges are brought.
Crypto laundering drew closer scrutiny
One of the most significant cases disclosed by INTERPOL took place in Thailand, where police arrested two people accused of laundering proceeds from romance scams through multiple cryptocurrencies. Authorities said the suspects used cross-chain token swaps, a method that allows value to be moved between different blockchain networks, to disguise the flow of funds.
Thai investigators found that one suspect’s digital wallet had processed more than $122.5 million over a ten-month period. The size of that flow, according to authorities, showed the industrial scale of some romance-scam operations and the extent to which criminal groups now rely on digital assets to move money across borders.
Romance scams are among the most damaging forms of online fraud because they depend on long-term emotional manipulation. Victims may be groomed for weeks or months before being persuaded to send money, buy cryptocurrency, join a fake trading platform or help move funds. In many cases, victims believe they are helping someone they trust, supporting a relationship or taking part in what appears to be a legitimate financial opportunity.
The Thailand case also showed why digital asset tracing has become a priority for law enforcement. Criminals may use multiple wallets, convert one token into another, move funds across chains or attempt to mix stolen assets with other flows. While blockchain transactions can be visible on public ledgers, the speed and complexity of these movements can create challenges for investigators, especially when funds cross jurisdictions or move through poorly regulated services.
For digital asset traders, the case is a reminder that exposure to tainted funds can create serious legal and financial consequences. Accounts connected to suspicious transactions, even indirectly, can be frozen while authorities and compliance teams investigate the source of funds. That risk has become more visible as police, banks and financial intelligence units improve their ability to trace movement across conventional and decentralized payment channels.
Fraud networks used impersonation and fake authority
In Eswatini, police arrested 82 people linked to an online betting and impersonation network. Authorities said the group operated what appeared to victims to be a fraudulent “Brazilian police station,” using the fake law-enforcement identity to pressure people into wiring money.
The funds were allegedly presented as being held for protection, but were later stolen. The case reflected a common technique in modern fraud: convincing victims that they are dealing with police, regulators, courts, banks or other trusted institutions. By creating a sense of urgency and authority, criminals can push victims into acting before they verify the contact.
Impersonation scams have become one of the fastest-growing forms of online financial crime. Fraudsters may pose as government officials, bank employees, corporate executives, technology support staff, law-enforcement officers or representatives of trading platforms. They often use forged documents, spoofed phone numbers, fake websites and messaging apps to make the contact appear legitimate.
The growth of these scams has raised concern among law-enforcement agencies because the victims are often persuaded to authorize the payment themselves. That can make recovery harder than in cases involving direct account hacking, as banks and payment providers may treat the transaction as approved unless fraud is quickly detected.
Singapore and Oman stopped a major transfer
Law enforcement agencies in Singapore and Oman also disrupted a suspected business email compromise case, stopping a $6.6 million transfer before the funds were lost.
Business email compromise, often called BEC, usually involves criminals impersonating a company executive, supplier, lawyer or trusted business partner. The fraudster may send altered invoices, fake payment instructions or urgent messages asking staff to redirect funds to a new account. In some cases, criminals first compromise a real email account and monitor communications before inserting fraudulent payment details at the right moment.
BEC remains one of the most expensive categories of cyber-enabled fraud because it targets businesses, professional service firms and organizations that regularly move large sums. The fraud does not always require sophisticated hacking. Often, the key elements are research, timing and social engineering.
The Singapore-Oman case illustrated the importance of rapid cross-border communication. Once funds are transferred internationally, they may be split across several accounts or withdrawn quickly. INTERPOL’s payment intervention system is designed to shorten the time between a fraud report and a freeze request, increasing the chance that stolen money can be recovered.
Macao and Palau cases add to wider pattern
In Macao, police prevented a victim from transferring nearly $372,000 to fraudsters who were posing as public officials. Authorities said the intervention stopped the victim before the money reached the criminals.
The Macao case reflected another frequent pattern in online fraud: official-sounding threats. Victims may be told that they are under investigation, that their bank account is linked to crime, that they owe a penalty or that they must transfer money to prove innocence. These schemes are designed to trigger fear and quick compliance.
In Palau, authorities deported 22 people accused of operating hotel-based scam centers linked to cryptocurrency and illegal gambling sites. Such operations have become a growing concern across parts of Asia and the Pacific, where criminal groups have used rented properties, hotels and office compounds to run online fraud campaigns targeting victims abroad.
Some scam centers rely on workers trained to build trust through chat applications, dating services and social media. Others direct victims to fake gambling sites, fake trading dashboards or fraudulent cryptocurrency platforms that show fabricated profits. Victims may initially be allowed to withdraw small amounts to build confidence before being pressured to deposit larger sums.
Why the money trail matters
The scale of First Light shows that financial fraud enforcement is increasingly focused not only on the people contacting victims, but also on the financial infrastructure behind the scams. That infrastructure can include bank accounts, payment processors, shell companies, online gambling services, digital wallets and informal networks of money movers.
Freezing more than 31,000 bank accounts sends a clear message that authorities are targeting the movement of stolen funds as aggressively as the fraud itself. For criminal groups, access to banking and digital payment rails is essential. Without a way to receive, layer and cash out stolen money, the scams become harder to sustain.
For traders and businesses handling digital assets, this creates a more complex risk environment. Funds that appear to come from a normal wallet or account may have passed through scams, phishing campaigns, illegal gambling operations or other criminal activity. If those funds are later traced, accounts connected to the chain of movement may face freezes, requests for information or extended compliance reviews.
The risk is not limited to direct participation in crime. A person or business that unknowingly receives tainted funds can still become part of an investigation. That does not mean wrongdoing has occurred, but it can lead to delays, reporting requirements and loss of access to funds while authorities examine the transaction history.
Criminal use of digital assets keeps expanding
Law-enforcement and cybersecurity reporting has warned that illicit funds moved through digital assets could exceed $17 billion for 2025, reflecting a rise from previous years. The increase suggests that criminals continue to see cryptocurrency and related payment tools as useful for moving value quickly, especially across borders.
At the same time, the use of digital assets in fraud does not mean the underlying technology is inherently criminal. Many transactions are legitimate, and blockchain records can provide investigators with a permanent trail that does not exist in cash-based crime. The challenge is that fraud networks are using speed, complexity and jurisdictional gaps to their advantage.
The rise in impersonation scams has added to that challenge. Reports cited by fraud-prevention groups show impersonation scams grew sharply in 2025, with some estimates pointing to a 1,400% increase. The growth has been driven by fake customer support accounts, forged regulator notices, cloned websites, artificial intelligence-generated messages and fraudulent social-media profiles.
For traders, the most dangerous approaches are often the ones that create urgency. Scammers may claim that an account will be frozen, a rare opportunity will expire, a tax issue must be settled immediately or a wallet must be “verified” through a link. Pressure to act quickly is one of the clearest warning signs of fraud.
Separate enforcement efforts have also targeted “approval phishing,” a tactic in which victims are tricked into granting attackers control over their wallets. In Operation Atlantic, authorities disrupted more than 120 web domains allegedly designed for that purpose. These sites typically mimic legitimate applications and ask users to approve permissions that allow attackers to drain assets later.
Security checks are becoming more important
The First Light results show why basic verification is no longer optional for people and firms operating online. Any request to move funds, change payment details, connect a wallet or approve a transaction should be checked through a separate trusted channel.
Businesses should review procedures for payment approvals, vendor changes and executive instructions. A phone call to a verified number can stop a fraudulent invoice. Dual approval for large transfers can reduce the risk of business email compromise. Staff training can also help employees recognize fake urgency, spoofed domains and unusual payment instructions.
Digital asset traders should examine new platforms, wallets and contacts before sending funds or connecting accounts. Fraudsters increasingly build polished websites and mobile applications that imitate legitimate services. Some show fake balances or fake trading profits to persuade victims to deposit more money. Others disappear once a large transfer is made.
The FBI has reported that Americans lost more than $11.3 billion to digital asset scams in 2025, underscoring the financial power and organization behind these operations. Criminal groups involved in online fraud are not isolated opportunists; many are structured networks with recruiters, scriptwriters, money launderers, technical staff and managers.
INTERPOL’s First Light operation suggests that global authorities are responding with broader coordination and faster payment intervention. The number of arrests, frozen accounts and identified victims shows both the scale of the threat and the resources now being directed against it.
The central lesson from the operation is straightforward: modern fraud moves quickly, but so does enforcement. As authorities become better at tracing funds across banks, wallets and borders, the space for criminals to hide is narrowing. For traders, businesses and everyday users, caution around unsolicited messages, unfamiliar platforms and rushed payment requests remains one of the strongest defenses.
Worried about rising fraud risks? Strengthen your defenses with Toobit’s crypto safety standards and trade with greater confidence.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
