INTERPOL's Serengeti III: 1,462 arrests across Africa and USD 105m recovered

What happened

On 22 October 2026, INTERPOL announced the results of Operation Serengeti III, which ran from 29 June to 31 August 2026. Law enforcement agencies from 21 countries, 20 in Africa plus the United States, arrested 1,462 suspects, disrupted 10,909 malicious networks, and recovered more than USD 105 million. The operation targeted cyber-enabled fraud, ransomware, business email compromise (BEC), online scams, and digital extortion.

INTERPOL says authorities identified 65,929 victims, and financial investigations linked the criminal activity to losses exceeding USD 385 million. Private-sector partners provided intelligence and technical analysis, and investigators received intelligence on suspicious domains, IP addresses, and command-and-control infrastructure before the operation began.

Among the highlights, authorities in Uganda dismantled two transnational fraud rings and arrested 365 foreign nationals linked to investment and pension fraud targeting victims across Asia. INTERPOL describes a rotating call-centre model using scripted communications, fake trading platforms, and fraudulent websites. In Nigeria, a separate investment fraud promoted through messaging apps moved more than USD 2.4 million in suspected proceeds, much of it laundered through cryptocurrency. Angolan authorities seized more than 2,000 cryptocurrency mining devices from two illegal mining centres.

Why it matters

The recovery figure is meaningful, and the gap is too. On INTERPOL’s own numbers, about USD 105 million was recovered against more than USD 385 million in linked losses, roughly a quarter. That gap suggests prevention at the point of payment will do more for most victims than recovery afterwards.

The Uganda case shows the call-centre model INTERPOL describes, built around scripts, fake platforms, and rotation, operating in Africa against victims in Asia. For banks, the jurisdiction of the scam operation matters less than the pattern of the payments it produces.

The operation also depended on data shared before arrests began. Intelligence on domains, IP addresses, and infrastructure came partly from private partners, which suggests that financial institutions’ own fraud data could add value to the same kind of effort.

Practitioner angle

• Re-test BEC controls: verify any change to a supplier’s bank details through a known contact, not the email that requested it.
• Watch for customers, particularly pension-age customers, sending repeated payments to investment platforms they found through messaging apps.
• Treat crypto-linked outflows that follow an investment approach by message or phone as a fraud indicator as well as an AML one.
• If your institution shares fraud intelligence through industry schemes, check whether domain and infrastructure indicators from scams you see are included.

Review your last month of BEC near misses first. The ones you stopped show how the attempts against your customers are built.