A large-scale online investment fraud network allegedly operating through call centres in Tirana has been dismantled after a two-year investigation involving Austrian and Albanian authorities, with support from Europol and Eurojust.
The coordinated operation led to the arrest of ten individuals, searches at multiple premises, and the seizure of nearly EUR 900,000 in cash, while investigators estimate that victims suffered losses of at least EUR 50 million.
Fake Investment Platforms Used to Target Victims
The network is believed to have drawn victims to seemingly legitimate online investment platforms through deceptive advertisements on social media and web searches. Victims were attracted by promises of profitable investment opportunities and, after registering with fake online brokers, were assigned “retention agents” who posed as investment advisers or brokers.
These agents allegedly managed victims’ accounts over long periods and often used remote access software to take full control of victims’ electronic devices. The fraudsters presented themselves as professionals and applied psychological pressure to convince victims to make further investments. According to the information available, the funds were never invested and were instead channelled into an international money-laundering scheme before reaching the criminal organisation.
The suspects also allegedly targeted victims a second time through follow-up fraud. People who had already suffered losses on fraudulent platforms were re-contacted and offered services to recover their money. Interested victims were instructed to open accounts on cryptocurrency platforms and make an initial deposit of EUR 500, after which operators using pseudonyms persuaded them to make the payment in another attempt to defraud them.
FCRF Academy Launches Premier Anti-Money Laundering Certification Program
Corporate-Style Call Centres Ran the Operation
The call centres were reportedly organised in a professional structure resembling a legitimate business, with a clear division of roles and hierarchical management. Operators worked in teams of six to eight people, each specialising in specific languages to target different national markets. Languages used included German, English, Italian, Greek and Spanish.
Investigators found that language familiarity was used to build trust with victims and persuade them to transfer significant sums of money. The scale of the network was reflected in its structure, which allegedly involved up to 450 employees across departments such as customer acquisition, customer service, management, finance, IT, human resources and back-office operations.
Customer acquisition was handled by “conversion agents,” while customer service was managed by “retention agents.” Team leaders supervised daily work, while managers at each call centre coordinated team leaders and overall operations. Operators reportedly received a monthly salary of about EUR 800, along with progressive commission for successful contracts, paid partly in cash and partly through bank transfers.
Austria, Albania, Europol and Eurojust Coordinated Probe
The investigation was first launched by Austrian authorities after a large number of victims were identified in Vienna around June 2023. In April 2024, Austrian authorities, through Europol, requested information from Albanian authorities about an IP address suspected to have been used by perpetrators located in Albania. Following the request, Albanian authorities opened a criminal investigation.
With Eurojust’s support, a joint investigation was launched, leading to a coordinated action day on 17 April 2026. The raids in Tirana resulted in the arrest of ten individuals, while searches were conducted at three call centres and nine private homes. Authorities seized EUR 891,735 in cash, 443 computers, 238 mobile phones, six laptops, and various data carriers and storage devices.
Victims were located across Europe and worldwide, including in Italy, Germany, Greece, Spain, Canada and the United Kingdom. The dismantling of the IT infrastructure and ongoing analysis of seized data are expected to provide further information about the network’s operations. Europol experts supported operational measures by securing large volumes of data relevant to the criminal investigations, which will later be shared with authorities in other affected countries.
A Virtual Command Post was also established to support the action day and facilitate the exchange of data and evidence. Eurojust coordinated a joint investigation team between Austrian and Albanian authorities with support from its Western Balkans Criminal Justice Project. Participating authorities included Albanian prosecution and cybercrime investigation units, Austrian criminal intelligence and economic crime authorities, Europol and Eurojust.
About the author – Rehan Khan is a law student and legal journalist with a keen interest in cybercrime, digital fraud, and emerging technology laws. He writes on the intersection of law, cybersecurity, and online safety, focusing on developments that impact individuals and institutions in India.
