An eight-month international investigation has exposed a criminal ecosystem stretching across six continents, where romance scams, investment fraud, cryptocurrency schemes, business email compromise, money laundering and sextortion are being connected through increasingly specialized networks. Operation Jackal IV produced 58 arrests and identified 263 suspects—but the deeper evidence points to a criminal economy designed to operate across borders.
Table of Contents
- The Eight-Month Operation
- A Criminal Network Without a Single Crime Scene
- The Johannesburg Scam Operation
- Crime-as-a-Service and the Argentina Connection
- The EUR 143 Million Investment Scam
- Following the Money Through Europe
- The Shift Toward Sextortion of Minors
- Black Axe and the Wider West African Threat
- The Forensic Evidence Behind the Crackdown
- What the 58 Arrests Really Reveal
The Eight-Month Operation
Operation Jackal IV was not a single raid conducted in one country. It was an eight-month international enforcement effort running from November 2025 through June 2026, coordinated by INTERPOL against West African organized crime groups and the financial infrastructure supporting them. The operation brought together 23 countries spanning six continents and focused on money laundering, high-value targets, criminal assets, arrests and prosecutions.
By the time the operation ended, authorities had arrested 58 people and identified 263 suspects. INTERPOL described the operation as a response to the escalating international threat posed by West African criminal networks, including Black Axe and similar groups that have been linked by investigators to cyber-enabled financial fraud and other serious crimes.
The numbers are significant, but they represent only the visible enforcement outcome. Much of the investigation was concerned with the less visible architecture surrounding the fraud: who creates the digital infrastructure, who recruits victims, who moves money, who provides accounts, who launders proceeds, who supplies technical services and who coordinates activities across jurisdictions.
That structure is increasingly important in modern organized crime. A fraud operation does not necessarily require every participant to know one another. Specialized actors can provide websites, payment channels, money-laundering services, cryptocurrency infrastructure or technical assistance while remaining physically and organizationally separate from the people communicating directly with victims.
INTERPOL said it facilitated cross-border coordination and intelligence sharing during Jackal IV, while providing analytical support, operational assistance and specialized training for international money-laundering investigations. The investigation therefore treated financial crime as a network problem rather than a collection of isolated fraud complaints.
A Criminal Network Without a Single Crime Scene
Traditional investigations often begin with a recognizable crime scene: a building, a vehicle, a weapon, a victim or a physical location. The cases examined during Operation Jackal IV demonstrate a different investigative reality. The crime scene can be distributed across bank accounts, social-media profiles, cryptocurrency wallets, websites, phones, call centres and corporate structures located in different countries.
Romance fraud is a clear example. An offender may create a fictional identity, establish contact with a victim through social media or a dating platform, maintain the relationship for weeks or months and eventually introduce a financial emergency or investment opportunity. The person communicating with the victim may not be the person receiving the money. The account receiving the funds may itself be controlled by an intermediary whose role is to move or convert the proceeds.
Investment fraud adds another layer. Victims can be shown convincing websites displaying fabricated account balances or supposed trading results. Once money is transferred, the criminal network can divide it among multiple accounts, convert it into cryptocurrency, send it through intermediaries or move it into another jurisdiction.
Business email compromise operates differently but follows the same financial logic. Criminals impersonate executives, suppliers or trusted business contacts and manipulate employees into authorizing payments. The technical method may differ from romance fraud, but both ultimately depend on controlling the movement of money.
For investigators, the common thread is the financial trail. INTERPOL’s Financial Crime and Anti-Corruption Centre used intelligence from participating countries to help connect people, accounts, transactions and criminal services. That approach can expose relationships that would remain hidden if each victim report were investigated independently.
The Johannesburg Scam Operation
One of the clearest operational results came from South Africa. Authorities raided seven locations in Johannesburg linked to a syndicate running romance and investment scams against retirees in English-speaking countries. The operation resulted in 39 arrests, making South Africa responsible for the largest single cluster of arrests publicly identified in the Jackal IV results.
Investigators said the syndicate had an internal division of labour. Members were assigned specific functions, including roles described as “conversion” and “retention” agents. The terminology reveals an important characteristic of industrialized fraud: victims can be treated as a pipeline moving through different stages rather than as individual targets handled from beginning to end by one offender.
A conversion role can involve persuading a victim to move from an initial interaction into a financial transaction, while retention can involve maintaining the relationship or keeping the victim engaged. Such specialization allows a network to scale its operations and potentially replace individual participants without shutting down the entire system.
South African authorities seized approximately USD 2.67 million and blocked 257 bank accounts during the investigation. An INTERPOL Operational Support Team was deployed to assist local investigators, providing analytical support and helping connect intelligence from the operation with information held internationally.
The financial seizures are important because they provide investigators with physical evidence of the economic side of the network. Bank records, account ownership information, transaction histories and seized devices can help reconstruct how money entered the system, where it travelled and who controlled it at different stages.
Crime-as-a-Service and the Argentina Connection
In Argentina, investigators identified 196 individuals associated with what INTERPOL described as a major Crime-as-a-Service network. Seventeen arrests followed. The network was suspected of providing website domains and money-laundering support to West African organized crime groups.
The case is significant because it shows how criminal groups can purchase capabilities rather than build every capability themselves. A fraud network may need a website that looks legitimate, infrastructure capable of hosting it, accounts through which proceeds can be moved and specialists who understand how to disguise the source of the money. If those services can be purchased from another criminal provider, the primary fraud group can focus on victim recruitment and extraction.
This is one of the reasons cybercrime increasingly resembles a service economy. Specialized criminal actors can supply individual components to other groups. The result is a modular system in which one network may provide fraud expertise, another may provide money laundering, and another may provide technical infrastructure.
INTERPOL deployed an Operational Support Team to Argentina to assist with analysis of seized data, identify criminal networks and suspects, and engage with international partners. Seized digital information can be particularly valuable in such cases because one device or account may contain evidence linking multiple jurisdictions.
The Argentina case also demonstrates why arrest totals alone cannot describe the scale of an investigation. Identifying 196 people does not mean every individual had the same role or level of involvement. Some may have been direct participants, while others may have provided infrastructure or financial services. Determining those distinctions requires continuing investigation and evidence.
The EUR 143 Million Investment Scam
Romania produced one of the most financially significant cases associated with Operation Jackal IV. Authorities dismantled a criminal group operating an investment scam through a call centre that promoted supposedly high-return opportunities involving stocks or cryptocurrencies.
Investigators estimated that approximately EUR 143 million had been stolen and laundered globally. Eleven people were arrested, while police seized about EUR 330,000 in cash and cryptocurrency, six real-estate properties and several luxury watches.
The contrast between the estimated criminal proceeds and the assets seized illustrates a recurring difficulty in financial investigations. Money can move through multiple jurisdictions before investigators act. Some funds may already have been spent, converted, transferred to other people or placed into assets that require separate legal procedures to freeze or recover.
The call-centre structure is also revealing. A fraudulent investment operation can look superficially similar to a legitimate financial business: employees make calls, scripts are used, websites display information and victims are assigned contacts. The criminal character of the enterprise lies in the deception and the destination of the money.
Forensic examination of communications, payment records, digital wallets, property ownership and corporate structures can therefore become as important as traditional police work. Investigators must reconstruct the operation sufficiently to show how the representations made to victims connected to the movement of funds.
Following the Money Through Europe
Italy provided another example of how money-laundering networks can hide the origins of criminal proceeds. INTERPOL said one person was identified in connection with a pan-European laundering network that used shell companies, remittance services and cash withdrawals to obscure the source of funds.
One account alone was used to move approximately EUR 845,000, or about USD 736,000, across 560 transactions involving 20 different financial instruments. Such transaction patterns can become valuable investigative evidence because the frequency, volume and movement of funds may reveal relationships that individual transfers do not.
A financial investigation is therefore partly a reconstruction exercise. Investigators must establish which accounts were controlled by whom, why payments were made, how funds were transferred and what happened after the money arrived. The presence of legitimate businesses or financial services does not by itself establish criminal activity; investigators need evidence connecting the transactions to the underlying offences and the people responsible.
That distinction is particularly important in international cases. A suspicious transaction can be an investigative lead, but it does not automatically prove that the account holder participated in a criminal network. The evidentiary process requires corroboration, documentation and, ultimately, legal findings by the relevant authorities.
The Shift Toward Sextortion of Minors
Perhaps the most disturbing emerging pattern identified through Jackal IV was the use of sextortion against minors. INTERPOL said investigators observed a rise in West African organized crime groups using sextortion to target victims as young as 14.
The basic mechanism is built around trust and coercion. Offenders contact a young person through social media, establish a relationship or otherwise persuade the victim to share intimate images or videos, and then threaten to distribute the material to the victim’s contacts unless money or another demand is met.
For victims, the crime can move rapidly from an apparently private online interaction to a coercive situation involving fear, shame and threats. For investigators, the evidence may be distributed across messaging applications, social-media accounts, cloud storage, payment services and devices.
The emergence of sextortion within organized financial-crime investigations also demonstrates how criminal groups can diversify their revenue sources. A network already capable of online deception, anonymous communication and cross-border payments can potentially apply similar infrastructure to different forms of exploitation.
That does not mean every sextortion case is connected to a large organized-crime group. Individual offenders and smaller networks also commit these crimes. The significance of the Jackal IV finding is narrower: investigators identified cases in which West African organized crime groups were using the method as part of their broader criminal activity.
Black Axe and the Wider West African Threat
INTERPOL identified Black Axe and similar West African criminal networks as part of the broader threat targeted by Operation Jackal IV. The organization has been associated by international law-enforcement agencies with cyber-enabled financial fraud and other serious crimes. INTERPOL’s wording is important: Jackal IV targeted organized crime groups and networks rather than attempting to reduce the entire problem to one organization.
West African organized crime has long been international in its reach. The modern version can combine social engineering, digital communications, financial intermediaries and traditional criminal relationships. Geographic distance no longer prevents a criminal group from targeting victims in another continent.
Romance scams, cryptocurrency and investment fraud and business email compromise are particularly suited to this environment because the offender does not need to be physically near the victim. A person in one country can communicate with a victim in another, direct funds into a third country and rely on a fourth jurisdiction for laundering or infrastructure.
That is why INTERPOL’s role is primarily connective rather than equivalent to a single national police force. The organization can facilitate information exchange, analytical support, coordination and specialized assistance, while national authorities conduct arrests, searches, seizures and prosecutions under their own laws.
The Forensic Evidence Behind the Crackdown
The most valuable evidence from an operation such as Jackal IV is often not the arrest itself. It is what investigators can recover from the digital and financial environment surrounding the suspects. Phones, computers, account records, cryptocurrency transactions, domain registrations, communications and financial documents can create a chronological picture of the criminal operation.
Digital forensics can establish links between accounts and devices, identify repeated usernames or email addresses, recover deleted information where technically possible and reveal communication patterns. Financial forensics can then connect those digital identities to payments, transfers and assets.
The combination is particularly powerful in cyber-enabled fraud because the same criminal identity may appear in several systems. A domain registration can lead to an email address. The email address can lead to a payment account. The payment account can lead to a bank transaction. That transaction can connect to another person or business in another jurisdiction.
But digital evidence must still be handled carefully. A username is not automatically proof of the person behind it. A cryptocurrency wallet address does not by itself establish who controlled it. An account receiving money does not necessarily prove knowledge of the criminal source. Investigators need corroboration, lawful acquisition and a documented chain of custody before evidence can support criminal proceedings.
Jackal IV’s international structure makes that evidentiary discipline even more important. Different countries may have different rules governing searches, electronic evidence, financial records and privacy. The investigative objective is therefore not simply to collect information but to transform fragmented intelligence into evidence that can survive legal scrutiny.
What the 58 Arrests Really Reveal
The 58 arrests announced by INTERPOL are the most visible result of Operation Jackal IV, but the investigation reveals something broader about the changing structure of organized crime. The networks being targeted are not dependent on one method. They can shift between romance fraud, investment scams, cryptocurrency schemes, business email compromise, money laundering and sextortion.
They can also outsource. The Argentina investigation demonstrated the emergence of Crime-as-a-Service providers capable of supplying infrastructure and laundering support. The South African investigation showed how a scam operation can divide victim manipulation into specialized roles. The Romanian case demonstrated the scale that can be reached through organized investment fraud. The Italian investigation showed how money can be fragmented across hundreds of transactions and multiple financial instruments.
Together, the cases show why following the money has become central to international organized-crime investigations. Criminal networks need financial infrastructure to turn deception into profit and profit into usable assets. Disrupting that infrastructure can expose relationships that are difficult to see through victim reports alone.
Operation Jackal IV also demonstrates the limits of a single enforcement operation. INTERPOL said many cases remained under investigation when the results were announced. Identification is not conviction, an arrest is not a final finding of guilt, and seized assets do not necessarily represent the total value generated by a criminal network.
The next stage will therefore be measured through prosecutions, asset recovery, additional suspects identified from seized evidence and the dismantling of the services that allow these networks to regenerate. If one group loses members but can replace them through an external Crime-as-a-Service market, the underlying criminal economy remains intact.
The deeper lesson from Jackal IV is that modern organized crime is increasingly borderless not because criminals have abandoned traditional methods, but because they have combined them with digital infrastructure and specialized financial services. The investigators confronting that system are doing the same in reverse: connecting jurisdictions, following money, analyzing seized data and assembling evidence across borders.
The 58 arrests are therefore one chapter in a much larger investigation. The 263 suspects identified, the financial networks uncovered and the emerging use of sextortion against minors point to a criminal ecosystem that continues to adapt. The long-term measure of Operation Jackal IV will be whether international investigators can keep pace with that adaptation—and whether the evidence gathered across six continents can ultimately dismantle the structures that make the fraud possible.
ForensicTimes · forensictimes.com · Global Investigative Journalism on Crime, Justice, and Forensic Science · This report reflects verified open-source and wire reporting current as of publication. © 2026 ForensicTimes. All Rights Reserved.
