Key points
- Police in Albania, Cyprus, Finland, Germany, Kosovo and North Macedonia, supported by Europol and Eurojust, seized more than 100 servers and arrested seven people in coordinated action on Tuesday 3 November 2026, Europol says.
- The operation was led by the German public prosecutor’s office in Itzehoe and targeted a company suspected of supplying fraudulent trading websites to criminal groups, Europol says.
- Investigators estimate losses of more than €4 million, with potential victims in more than 50 countries; 17 locations were searched, Europol says.
- In Kosovo, three people were arrested at five locations and detained for 48 hours on the orders of the Special Prosecution Office, Kosovo prosecutors say via Nacionale.
Police across Europe have struck at the infrastructure of a suspected fake-investment network, seizing more than 100 servers and arresting seven people in a single coordinated day of action. Europol says the operation, carried out on Tuesday, involved authorities in Albania, Cyprus, Finland, Germany, Kosovo and North Macedonia, with Europol and Eurojust supporting the work. The seven people arrested face extradition to Germany, Europol says. Read more: Spanish police arrest suspected founder of 'Blocus' group ahead of Halloween after Barcelona looting
The target, according to Europol, was not a single call centre but the supplier behind them: a company suspected of providing fraudulent trading websites to criminal groups. Those groups, Europol says, ran call centres whose operators pressured victims into investing, promising large and quick returns from trading in cryptocurrencies, foreign currencies or shares. The money, investigators say, was not invested as promised.
What police say happened
The operation was led by the public prosecutor’s office in Itzehoe, in northern Germany, Europol says. Officers searched 17 locations and seized servers, other evidence and assets. The seven arrests were made, Europol says, with a view to extradition to Germany, where the investigation is based. Europol puts the estimated losses at more than €4 million and says the scheme had potential victims in more than 50 countries — a scale that explains why six jurisdictions had to move on the same day: seizing the servers, rather than only arresting the people answering the phones, is what takes the platforms themselves offline.
The key figures
| Measure | Figure | Source |
|---|---|---|
| Servers seized | More than 100 | Europol |
| People arrested across the operation | 7, with a view to extradition to Germany | Europol |
| Locations searched | 17 | Europol |
| Estimated losses | More than €4 million | Europol |
| Countries with potential victims | More than 50 | Europol |
| Arrests in Kosovo | 3, at five locations | Kosovo Special Prosecution Office, via Nacionale |
| Kosovo detention ordered | 48 hours | Kosovo Special Prosecution Office, via Nacionale |
The Kosovo leg
Kosovo’s part of the operation was the most fully described by any national authority on the day. Kosovo Police searched five locations in Pristina, Fushë Kosovë and Ferizaj, the country’s Special Prosecution Office says, and arrested three people, identified only by the initials M.P., I.H. and F.Z. They are suspected of participating in or organising an organised criminal group, fraud, unauthorised computer access and computer fraud, the prosecution says. Cars, mobile phones, computers and other electronic devices were seized as potential evidence, and the three were detained for 48 hours.
The Kosovo prosecution says those involved posed as financial agents or intermediaries and defrauded mainly people from German-speaking countries, persuading them to transfer money for purported investments in financial instruments and cryptocurrencies. The profits displayed on the platforms are suspected to have been fictitious, it says. A German prosecutor, German investigators and Europol cyber experts took part in executing the search warrants in Kosovo, according to the prosecution’s account.
A four-year investigation
Tuesday’s action was not the start of this case. Europol says it follows four years of investigation and earlier interventions against the same network in 2022 and 2025. Eurojust, the EU agency for criminal justice cooperation, has previously described the investigation’s earlier action days: a first day in September 2022, when locations in Belgium and Latvia were searched and two suspects arrested, and a second in May 2025, when eight searches took place in Albania, Cyprus and Israel and six people were questioned. That history matters for what happens next: the network has already survived two earlier disruptions, so whether Tuesday’s seizure of its servers proves more lasting than the earlier raids will depend on the prosecutions that follow in Germany.
For now, the charges remain allegations. No one arrested on Tuesday has been convicted in connection with this operation, and the suspects’ accounts have not been reported. The practical warning for readers is the one the case itself illustrates: a professional-looking trading platform, and a caller who sounds like a financial adviser, are not evidence that money is being invested at all.
Updates & corrections
Published 3 November 2026.
Europol published its account of the operation on 3 November 2026 and updated it the same day; the Kosovo prosecution’s account of its part of the operation was published later on 3 November 2026. No corrections have been made.
Sources
- Europol, Investment scams with potential victims in at least 50 countries: over 100 servers seized, 3 November 2026 (updated 3 November 2026), on the six jurisdictions involved, the Itzehoe lead, the 100-plus servers, seven arrests, 17 searches and the estimated losses of more than €4 million: europol.europa.eu
- Kosovo Special Prosecution Office, via Nacionale, Kosovo police arrest three over fake investment scheme, 3 November 2026, on the three arrests, five locations, 48-hour detention, seized cars, phones and computers, and the German and Europol presence at the searches: nacionale.com
- Eurojust, International coalition uncovers EUR 3 million online investment fraud, on the investigation’s earlier action days in September 2022 and May 2025: eurojust.europa.eu