Operation Jackal IV: 58 arrests, and a shared laundering layer underneath

What happened

INTERPOL announced on 25 August 2026 that Operation Jackal IV produced 58 arrests and identified 263 suspects. The operation ran from November 2025 to June 2026. It brought together 22 countries from six continents, in response to what INTERPOL describes as the escalating global threat posed by West African criminal networks such as the Black Axe and similar groups. Participating countries included Nigeria, South Africa, Cote d’Ivoire, France, the United States and the United Kingdom.

INTERPOL states the aims as disrupting money laundering, identifying high-value targets, seizing assets, and supporting arrests and prosecution. Three country strands carry most of the detail.

In South Africa, 39 suspects were arrested and police raided seven locations in Johannesburg linked to a syndicate accused of running romance and investment scams. Officers seized $2.67 million and blocked 257 bank accounts linked to that network. In Argentina, 196 people were identified as allegedly connected to a crime-as-a-service network that supplied website domains and money laundering support to the organised crime groups, and 17 of them were arrested.

In Romania, authorities dismantled a group accused of running an investment scam through a call centre that attracted victims with promises of high returns before diverting the money. INTERPOL puts the estimate at approximately EUR 143 million stolen and laundered internationally. That strand brought 11 arrests and the seizure of EUR 330,000 in cash and cryptocurrency, six real estate properties and several luxury watches.

Why it matters

The Argentina strand is the one to sit with. A network accused of selling website domains and laundering support to other criminal groups is a supplier, not a scam crew. The likely effect is that the same laundering rails carry proceeds from scams that otherwise share no victims, no script, and no geography. Treating each fraud as its own closed case will miss that shared layer entirely.

The South Africa numbers suggest how wide the account footprint of one syndicate gets. One accused romance and investment scam network sat behind 257 blocked accounts. On that arithmetic, an institution reviewing a single mule account is probably looking at one node in something considerably larger, and an alert closed at the account level tells you nothing about the other nodes.

Read together, the two strands argue for network-level detection. Analysis, not a finding: if infrastructure is being bought as a service, then domain registration data, payout patterns, and account opening cohorts are likely to be better linking signals than the individual customer’s behaviour.

Practitioner angle

• Run a retrospective link analysis across accounts you have already exited or filed on for romance and investment fraud in the past 18 months. Look for shared devices, IP ranges, phone numbers, payee details, and onboarding dates, not just shared counterparties.
• Add the beneficiary domain and merchant website to the data you capture on investment fraud reports. If a supplier network is registering domains at volume, domain age and registrar are cheap enrichment fields with real linking value.
• Pressure-test whether your anti-money laundering (AML) case management can group related alerts into a single network case. Many systems can technically do it and are configured never to.
• Review your mule account exit process. Closing the account without a network sweep leaves the rest of the cohort live.

The single most important step: stop closing scam-linked accounts one at a time, and make one confirmed mule account trigger a search for its cohort.