INTERPOL fraud sweep: 5,811 arrests and 31,014 bank accounts blocked in 97 countries

What happened

INTERPOL published the results of Operation First Light 2026 on 9 July 2026. The operation ran from 15 January 2026 to 30 April 2026, and 97 countries and territories took part. Police made 5,811 arrests, intercepted USD 293 million in illicit assets, blocked 31,014 bank accounts, and solved 23,715 cases.

The target was social engineering fraud. INTERPOL describes the scope as business email compromise, or BEC, sextortion, and romance, impersonation, or investment scams, together with the money laundering that follows them.

Two country examples carry the detail that matters. In Thailand, INTERPOL says one 20-year-old suspect’s digital wallet processed over USD 122.5 million in 10 months, with romance scam proceeds converted into various cryptocurrencies using cross-chain token swaps. In Palau, suspects ran cryptocurrency and illegal gambling schemes aimed at foreign victims.

Why it matters

Read the numbers as a laundering chain, not a fraud tally. The 31,014 blocked bank accounts are the mule layer, and the mule layer is the part a bank actually controls. Arrests happen abroad. Seizures depend on speed. Account blocks depend on detection.

Blocked accounts outnumber arrests by more than five to one. The people running these scams are scarce. The accounts moving their money are not. That ratio is the argument for putting analyst hours into beneficiary accounts rather than into chasing the offshore organiser, and it is the argument for fraud and anti-money laundering, or AML, teams to stop working in separate rooms.

The Thailand wallet shows the next step in the chain. Once romance scam funds land in a mule account, they leave the banking system quickly and become cryptocurrency. Cross-chain swaps then break the trail before an analyst opens the alert. USD 122.5 million in 10 months through one wallet is not a fraud loss. It is a laundering pipeline with a front end. INTERPOL has published no country-level breakdown beyond these two examples, so treat the operation as a sample of the scam economy rather than a measurement of it.

Practitioner angle

• Tune mule-account detection. The signature is a recently opened account receiving many small inbound payments from unrelated payers and forwarding them within hours. Layer identity signals on top: shared device fingerprints, shared phone numbers, and reused identity documents across customers who claim no connection.
• Reclassify scam proceeds. Romance and investment scam payments are placement, not a loss line. Route them into the AML typology library, and make sure the receiving account gets a look-through review, not just a chargeback decision.
• Watch the conversion step. Flag bank-to-exchange transfers from accounts with no prior crypto history, and ask your chain analytics provider directly how it handles cross-chain swaps. The Thailand case is a warning about the point where your visibility ends.
• Link fraud alerts to AML alerts. A confirmed victim payment on the fraud side should automatically open a case on the beneficiary account on the AML side, in your own book and with the correspondent.
• Measure your freeze time. INTERPOL reports intercepted assets. The bank equivalent is the hours from first alert to account block, and that number is usually worse than teams assume.

The single most important action: wire the handoff so that every confirmed scam payment triggers an automatic mule-account review of the beneficiary. Detection without that link is a fraud statistic. With it, it is a laundering case.