Europol: Seven Arrested and 100 Servers Seized Over Fake Trading Platforms

The first complaint came in 2022 from a couple in Germany. They had put their savings into an online trading platform, watched the balance grow on screen, and then found they could not take the money out. On 3 November 2026, more than four years later, police in several countries searched 17 addresses, including a call centre in Kosovo, and seized more than 100 servers.

Eurojust, the European Union's agency for judicial cooperation, and Europol, its police agency, announced the operation the same day from The Hague. Seven people were arrested. The case is led by Germany: the Public Prosecutor's Office at the Itzehoe Regional Court, in northern Germany, with the State Criminal Investigation Office of Schleswig-Holstein. The seven are suspects. None has been convicted, and they are presumed innocent until a court decides otherwise.

The numbers

Investigators put the losses at more than EUR 4 million. That is an estimate, and the agencies describe the network as one believed to have targeted people around the world. The trade site The Cyber Express reported potential victims in more than 50 countries, a figure that does not appear in the Eurojust release itself and should be read as a secondary report.

The seven people were arrested so that they can be handed over, or extradited, to Germany. Authorities from seven countries took part: Germany, Cyprus, Finland, Albania, Israel, Kosovo and North Macedonia. Poland joined through a joint investigation team, a standing arrangement in which prosecutors from several countries share evidence in one case.

What was allegedly sold

The investigators describe two layers. The first is a company, operating from Cyprus and Israel, that allegedly built fake trading websites and supplied them to other criminal groups. The agencies call this "crime-as-a-service": one firm builds the shopfront and rents it out, much as a shop-fitting company might build a store and hand over the keys.

The second layer is the customers. Suspected clients in Albania, Kosovo and North Macedonia allegedly ran fraudulent call centres that used those websites to sell investments that did not exist. The Cyber Express reported that victims were reached through online adverts and affiliate marketing, in which a website pays other sites for every visitor they send. It also reported that the personal details collected this way were sold on to the call centre groups.

How a fake trading screen works

The pitch promised quick, large returns from trading cryptocurrency, foreign currencies and shares. A real broker passes an order on to a market, where a buyer and a seller meet. The fake platform, as described by the agencies, showed profits that were not real. The website displayed prices and a balance, with no genuine trading behind them.

The steps were simple. A victim first sent a small amount. The account then showed a healthy profit, which cost the operators nothing because the number was only typed onto a screen. A caller presenting as a broker then pushed the victim to deposit more, saying the gains would grow faster with a bigger stake. Every deposit was real money, moving to the operators. The profits were not.

The trap closed when the victim tried to withdraw. The agencies say payments were delayed and obstructed, and then the operators disappeared. Think of a bank statement printed by someone who never held the account. The first small deposit and the on-screen gain existed to make the second and third, larger deposits feel safe.

Why the sellers and the builders are different people

Splitting the work makes the fraud harder to catch. The firm that builds the website may never speak to a victim. The call centre that speaks to victims may never touch the code. A police force that raids one call centre finds staff, phones and scripts, but the website can be moved to a new server and rented to the next group within days. That is why the 100-plus servers matter in this case: servers are where a fake platform actually lives.

Nothing in the release says that any suspect has admitted anything, and the agencies do not name the company, the call centres or the people held. No charges have been announced.

How the case was built

The investigation began with the German couple's complaint in 2022. The press release refers to earlier arrests and evidence gathering in 2022 and 2025. The first international action day produced two arrests and a large amount of evidence, and analysis of that material identified seven more suspects, among them people believed to run call centres. A later action day brought further arrests and the seizure of evidence and money. That material in turn pointed to the company behind the platforms, which led to the November operation.

Eurojust handled the paperwork that lets one country's police act on another's behalf: European Investigation Orders, European Arrest Warrants and freezing orders for assets. It set up two joint investigation teams, one linking Germany, Poland and Albania, and one linking Albania and Kosovo. Its Western Balkan Criminal Justice Project supported the Albanian and Kosovar authorities.

Europol's European Financial and Economic Crime Centre analysed the data, checked it against its databases and brought national investigators together. On the day, Europol sent specialists to Albania and Kosovo for digital forensics and real-time checks of police databases, and ran a Virtual Command Post, an online coordination room, for the operation.

The authorities involved included the Cyprus Police, the Finnish National Bureau of Investigation, Albania's Special Prosecution Office against Corruption and Organised Crime (SPAK), the Albanian National Bureau of Investigation and State Police, Israel Police and its National Cybercrime Unit Lahav 433, the Special Prosecution and Police of Kosovo, and North Macedonia's public prosecution office for organised crime and its Ministry of Interior.