Meta, Google, Microsoft and OpenAI have partnered with international law enforcement agencies in a large-scale operation aimed at dismantling cyber-enabled fraud networks operating across West Africa. The coordinated initiative led to the removal of more than 3.7 million fraudulent Facebook and Instagram accounts, pages and groups that were allegedly used to facilitate a wide range of online scams.
Announced on October 13, 2026, the operation resulted in the arrest of 28 individuals and the rescue of 117 people who authorities say were being forced to work within scam compounds. The effort highlights the growing collaboration between technology companies and global law enforcement in combating organized online fraud and human trafficking.
International Coalition Targets Online Fraud Ecosystem
The operation was coordinated by the United Kingdom’s National Crime Agency (NCA), which hosted representatives from major technology firms and law enforcement agencies from ten countries during a week-long disruption campaign held in London.
Beginning on October 6, investigators exchanged intelligence relating to scam operations linked to Nigeria, Ghana and several other African nations. The collaborative effort focused on identifying criminal networks that use social media platforms, messaging services and financial channels to target victims worldwide.
According to authorities, the investigation centered on organized fraud activity rather than a specific malware family or cyberattack toolkit. Analysts from Meta and investigators from the U.S. Department of Justice tracked coordinated scam campaigns involving fraudulent personas, social engineering tactics and financial deception schemes designed to manipulate victims into sending money.
Public disclosures surrounding the operation did not reference malware samples, file hashes or technical indicators of compromise. Instead, investigators highlighted the extensive use of fake identities and online manipulation techniques to conduct fraud at scale.
Millions of Fraudulent Accounts Removed
Meta revealed that a significant portion of the removed accounts targeted individuals in the United States and the United Kingdom. Many of the profiles impersonated legitimate American and British users to establish trust and engage potential victims.
The company said the enforcement action aligns with its broader anti-scam initiatives and the deployment of new fraud-detection capabilities designed to identify and remove malicious accounts before they can reach additional targets.
Microsoft also suspended accounts suspected of being linked to the criminal networks, while Google and OpenAI contributed intelligence and analytical support to the operation. Although both companies participated in the coordinated effort, neither disclosed separate takedown figures.
OpenAI reported that it shared investigative insights with partners and utilized artificial intelligence to help identify scam-related activity spanning multiple platforms. Information generated during the investigation provided authorities with leads on more than 30 suspected scam compounds.
Ghana and Nigeria Raids Yield Arrests and Rescues
One of the most significant enforcement actions occurred in Sasaabi, a community near Accra, Ghana, where law enforcement officers arrested 19 suspects and seized 303 electronic devices believed to be connected to fraud operations.
Authorities also located 117 individuals identified as trafficking victims who were awaiting repatriation to Nigeria. Investigators further identified 89 fraud victims whose combined financial losses were estimated at approximately $8.3 million.
In Nigeria, authorities arrested an additional nine suspects and confiscated 53 electronic devices during related operations.
Officials emphasized that many individuals discovered inside scam compounds should not automatically be regarded as participants in criminal activity. According to Meta, those rescued in Ghana had allegedly been held against their will, denied adequate food and subjected to both physical and psychological abuse.
The findings underscore the increasing overlap between cybercrime and human trafficking, where criminal organizations exploit vulnerable individuals and force them to participate in fraudulent campaigns.
How the Scam Networks Operated
Rather than relying on technical exploits, the networks employed a variety of social engineering techniques designed to manipulate victims emotionally and financially.
One of the most common schemes involved investment fraud, in which scammers cultivated romantic, personal or professional relationships before directing victims toward bogus investment opportunities, including fake cryptocurrency platforms.
Other fraud models included:
- Impersonation of military personnel
- Online shopping scams involving goods that never arrived
- Fake fund-recovery services claiming to recover stolen money
- Cryptocurrency-related investment schemes
- Law enforcement impersonation scams
- "Digital arrest" extortion tactics
- Job and task-based scams requiring upfront payments
These operations succeeded primarily through deception, coercion and abuse of trust rather than through software vulnerabilities or malware infections.
Tracking the Digital Infrastructure
Investigators expanded their analysis beyond social media profiles and examined the broader infrastructure supporting the fraud networks, including websites, domains, communication platforms and payment channels.
Cyber intelligence firm Silent Push reported identifying more than 35,000 malicious domains and nearly 700 communication channels associated with African scam operations. Mapping these assets enabled investigators to connect online activities with physical locations and individuals suspected of orchestrating the fraud campaigns.
Authorities also followed financial trails associated with the scams. Industry partners identified more than $11 million in funds that could potentially be frozen or investigated. However, officials noted that the figure represents potentially recoverable assets and does not necessarily indicate funds that have already been seized or returned to victims.
Separately, Coinbase reported identifying more than 65 active scam victims and preventing over $415,000 in potential losses by intervening before transactions were completed.
A Multi-Pronged Approach to Disrupting Cybercrime
The operation demonstrates why removing fraudulent online accounts alone is not enough to dismantle organized scam networks. While platform takedowns can disrupt communications between criminals and victims, long-term impact requires financial investigations, infrastructure disruption and coordinated law enforcement action.
By combining intelligence from technology providers with traditional investigative methods, authorities were able to identify physical scam centers, trace illicit financial activity and make arrests linked to the broader criminal ecosystem.
Although investigators have developed numerous new leads, officials cautioned that the operation does not confirm the closure of every scam center connected to the networks.
Guidance for Potential Victims
Authorities advise anyone who believes they may have been targeted by an online scam to:
- Preserve chat histories, emails and communication records.
- Retain payment receipts and transaction details.
- Stop sending funds immediately.
- Contact their bank, cryptocurrency exchange or payment provider.
- Report the incident to relevant law enforcement authorities.
- Avoid unsolicited "recovery services" that demand upfront payments to retrieve lost funds.
Experts warn that many recovery offers are themselves fraudulent and are often designed to exploit victims a second time after an initial scam has already occurred.
The coordinated operation highlights an increasingly aggressive global effort to dismantle transnational fraud networks by combining technology-sector intelligence, financial tracing and law enforcement action against both digital infrastructure and the criminal organizations behind it.
Found this article interesting? Follow us on X(Twitter) ,Threads and FaceBook to read more exclusive content we post.
