European Law Enforcement Dismantles Ukrainian Call Center Fraud Network
European law enforcement agencies, supported by Eurojust, have dismantled a large-scale fraud network operating multiple call centers in Ukraine that targeted victims across Europe. Authorities from Ukraine, the Czech Republic, Latvia, and Lithuania arrested 12 suspects and identified 45 individuals involved in the operation, which defrauded over 400 victims of more than 10 million euros. The criminal group used various schemes, including impersonating police officers and bank employees, convincing victims their accounts were compromised, and instructing them to transfer funds to "safe" accounts controlled by the network. In some cases, victims were persuaded to install remote access software, allowing the criminals to hijack their bank accounts, and some fraudsters even met victims in person to collect cash using stolen card details.
The call centers, located in Dnipro, Ivano-Frankivsk, and Kyiv, employed around 100 people recruited from several European countries. Employees were paid commissions of up to 7% of the stolen funds and were promised bonuses such as cash, cars, or apartments for exceeding certain fraud targets, though these rewards were never distributed. During coordinated raids on December 9, 2025, authorities conducted 72 searches, seizing vehicles, weapons, computers, cash, and forged identification documents. The operation highlights the transnational nature of organized fraud and the effectiveness of coordinated law enforcement action across European borders.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
4 events from the most recent confirmed update back to the earliest known activity.
Czech and Ukrainian authorities dismantle separate Kyiv investment scam ring
In a related but separate operation, Czech and Ukrainian authorities took down another fraud group based in Kyiv that used fake investment websites. That scheme caused nearly $2 million in losses.
European authorities raid Ukrainian call centers and arrest 12 suspects
In a coordinated operation led with Eurojust support, law enforcement carried out 72 searches in three Ukrainian cities and dismantled the fraud network. Authorities arrested 12 people, identified 45 suspects, and seized forged IDs, computers and other electronics, cash, vehicles, and weapons.
Scam campaign steals over €10 million from more than 400 victims
Over the course of the operation, the network defrauded more than 400 victims across Europe of over 10 million euros by convincing them to transfer funds or grant access to their bank accounts. Investigators said the true number of victims may be higher.
Fraud network operates call centers across three Ukrainian cities
A criminal organization established professional scam call centers in Kyiv, Dnipro, and Ivano-Frankivsk, recruiting staff from multiple European countries. The group impersonated police officers and bank employees and used social engineering and remote-access tools to steal money from victims across Europe.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
3 references tracked. Mallory keeps watching after this page renders.
European police bust Ukraine-based call center network behind $11 million in scams
therecord.media
Open sourceEuropean authorities dismantle call center fraud ring in Ukraine
bleepingcomputer.com
Open sourceEuropean police busts Ukraine scam call centers
helpnetsecurity.com
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
European Law Enforcement Takedowns of Phishing and Investment-Fraud Networks
European law enforcement reported multiple cyber-enabled fraud disruptions, including a Eurojust-supported operation that dismantled a **fraudulent call-centre network** operating from three offices in Dnipro. Authorities from Latvia, Lithuania, and Ukraine arrested **11 suspects**, seized **more than €400,000** in cash, and collected electronic evidence (computers, SIM cards, documents) during searches at **32 locations**. The group allegedly ran a fake cryptocurrency investment platform and used **remote access software** to gain access to victims’ online banking and move funds to accounts and crypto wallets under their control. Separately, Poland’s Central Bureau for Combating Cybercrime (CBZC) dismantled an organized group operating in Poland and Germany that used **phishing** to hijack Facebook accounts and extract **BLIK** payment codes. Investigators identified **11 group members**, placed **six** in pretrial detention, and seized **over 100,000** stolen Facebook credentials; prosecutors filed **400+ charges** including unauthorized access, online fraud, and money laundering. A South Korean case involving the breach of Seoul’s bike-hire service *Ttareungyi* (4.62 million users affected) is a distinct incident and not part of the European takedown actions described above.
Mar 21, 2026
European Police Dismantle €50 Million Crypto Investment Fraud Call-Center Network
Austrian and Albanian authorities, supported by **Europol** and **Eurojust**, dismantled a large online investment fraud operation that allegedly stole at least **€50 million** from victims across Europe and other regions. The network operated from call centers in **Tirana, Albania**, where investigators said it was run like a legitimate business with up to **450 employees** spanning management, finance, IT, HR, customer acquisition, and retention roles. Victims were lured through fake broker and cryptocurrency investment platforms promoted on search engines, websites, and social media, then pressured by multilingual operators posing as brokers or advisers to transfer more money. A coordinated action on **17 April** led to **10 arrests**, searches of **three call centers** and **nine homes**, and the seizure of **€891,735 in cash** along with hundreds of computers and phones. Investigators said the group used remote access software and an international money-laundering scheme to divert funds rather than invest them, and in some cases targeted victims a second time with a bogus recovery service that demanded a **€500** cryptocurrency payment. Authorities said the seized infrastructure and data are expected to support additional investigations in other affected countries.
May 4, 2026
Europol-Backed Takedown of Gambling Fraud Ring Exploiting Ukrainian Refugees
Spanish and Ukrainian authorities, supported by **Europol**, dismantled a criminal network that exploited war-displaced **Ukrainian women** to facilitate an online gambling fraud and money-laundering operation. Investigators said the group recruited vulnerable women from heavily attacked regions, transported them to Spain, and escorted them through obtaining temporary protection status and opening bank accounts and credit cards—then seized control of those accounts to run the scheme. Police arrested **12 suspects** following a **two-year investigation** and identified **55 Ukrainian women** used in the operation, which generated roughly **€4.75 million (about $5.5 million)** in illicit proceeds. The network allegedly used **bot-driven automation** to place thousands of simultaneous **low-odds bets** across online gambling platforms to produce steady, seemingly legitimate returns, while leveraging **stolen identities** (over **5,000** across **17 nationalities**) to create and operate large numbers of betting accounts; authorities said proceeds were also funneled into assets including **luxury real estate** in Europe.
Mar 21, 2026