A criminal network operating a large-scale online fraud scheme has been dismantled through a collaborative investigation involving Austrian and Albanian authorities, with support from Europol and Eurojust. The operation, which spanned over two years, resulted in the arrest of ten individuals, the search of multiple premises, and the seizure of nearly EUR 900 000 in cash.
The criminal network, allegedly operating several call centres in Tirana, Albania, is believed to have caused significant financial damage, totalling at least EUR 50 million. The call centres were professionally set up and organised, resembling legitimate business structures featuring a clear division of roles and hierarchical management.
Too-good-to-be-true investment promises
Victims were drawn to seemingly legitimate online investment platforms through deceptive advertisements on social media or web searches, enticed by the promise of profitable investments. Upon initial registration with these fake online brokers, victims were assigned “retention agents” who impersonated investment advisors or brokers.
These agents managed victims’ accounts over extended periods, often using remote access software to gain full control of the victims’ electronic devices. The fraudsters feigned professional expertise and employed psychological pressure to persuade victims to make additional investments, falsely claiming they would be profitable. In truth, the funds were never invested but were instead channelled into an intricate international money-laundering scheme, ultimately disappearing into the hands of the criminal organisation.
Corporate-like criminal call centres
Operators were organised into teams of six to eight individuals, each specialising in a specific language to target their respective national markets. Languages covered included German, English, Italian, Greek, and Spanish. As is common in investment scams, language familiarity was used to create and build trust. The suspects relied on this element to deceive their victims, presenting false investment opportunities and convincing them to transfer significant amounts of money.
The scale and professionalism of the criminal network were evident in its structure, which involved up to 450 employees across various departments, including customer acquisition, handled by “conversion agents,” and customer service, managed by “retention agents.” Additionally, the network had dedicated teams for management, finance, IT, human resources, and various back-office activities.
Team leaders supervised the daily activities of their teams, while a manager at each call centre coordinated and guided the team leaders and overall operations. Operators received a monthly salary of approximately EUR 800, along with a progressive commission per successful contract, partly paid in cash and partly via bank transfer.
Fraud and follow-up fraud
As a result of these fraudulent schemes, victims transferred significant amounts of money, estimated to exceed EUR 50 million. The perpetrators also re-contacted victims who had already suffered losses through fraudulent platforms, offering services to recover their funds. Interested individuals were instructed to open accounts on cryptocurrency platforms and make an initial deposit of EUR 500. Operators, using usernames and operating under pseudonyms, persuaded victims to make this initial payment in an attempt to scam them again.
Austrian-Albanian investigation linked via Europol
The investigation was initially launched by the Austrian authorities due to the large number of victims identified in Vienna around June 2023. In April 2024, the Austrian authorities, through Europol, addressed the Albanian authorities with a request for information regarding an IP address suspected of being used by the perpetrators, who were located in the territory of the Republic of Albania. Following this request, the Albanian authorities initiated a criminal investigation.
With the support of Eurojust, a joint investigation was launched, leading to a coordinated action day on 17 April 2026. The raids conducted resulted in the arrest of ten individuals in Tirana, the searches conducted at three call centres and nine private homes lead to the seizure of
- EUR 891 735 in cash,
- 443 computers,
- 238 mobile phones,
- 6 laptops,
- as well as various data carriers and storage mediums.
Victims of this fraud scheme were located across Europe and worldwide, including in Italy, Germany, Greece, Spain, Canada, and the United Kingdom. The full dismantling of the IT infrastructure and the ongoing analysis of seized data are expected to provide further insights into the criminal network’s operations.
Europol’s experts deployed to support the operational measures helped securing large volumes of data relevant to the criminal investigations. This data will subsequently be shared with the investigating authorities of other affected countries. To support the action day, a Virtual Command Post (VCP) was established to facilitate the exchange of data and evidence.
Eurojust coordinated a joint investigation team (JIT) between Austrian and Albanian authorities with the support of its Western Balkans Criminal Justice Project. In addition to setting up the joint investigation team, Eurojust assisted with coordination meetings, funding for the action day and through the Western Balkans Criminal Justice Project, interpretation services.
Participating authorities:
- Albania: Prosecutor’s Office at the Court of First Instance of General Jurisdiction, Tirana (Prokuroria pranë Gjykatës së Shkallës së Parë të Juridiksionit të Përgjitshëm Tiranë); Cybercrime Investigation Directorate and Operational Forces Directorate within the Criminal Police Department of the Albanian State Police (Drejtoria për Hetimin e Krimeve Kibernetike dhe Drejtoria e Forcave Operacionale në Departamentin e Policisë Kriminale të Policisë së Shtetit)
- Austria: Federal Criminal Intelligence Service (Bundeskriminalamt); Public Prosecutor‘s Office for Combatting Economic Crimes and Corruption (Wirtschafts- und Korruptionsstaatsanwaltschaft – WKStA)
- Europol
- Eurojust
