Dutch police say fraud network ran twenty call centres like a company

What happened

The Netherlands National Police (Politie) announced on 15 July 2026 that it had disrupted an international criminal organisation allegedly running investment fraud with more than 700 workers. Politie says the group has been active at least since 2021. It puts worldwide visibility on about twenty call centres whose staff posed as financial advisers.

The main suspect is a 46-year-old man with dual Israeli and Polish nationality, arrested on 26 May at an airport in Poland at the request of Dutch police while travelling from Dubai. He has been surrendered to the Netherlands, where an examining magistrate ordered 14 days of pre-trial detention. Politie also cites online available information indicating he was previously prosecuted for hacking foreign government organisations, an attribution the release itself hedges.

Five further arrests followed. On 7 July, two Dutch nationals aged 45 and 34 and a 34-year-old Belgian were detained in Cyprus, where all three lived, and a 25-year-old resident of Belgium was arrested in Belgium. On 10 July a 44-year-old Dutch national of no fixed abode was arrested in Athens. Politie separately states that Belgian police arrested five of the organisation’s workers. Politie does not rule out more arrests, and everyone named remains a suspect.

Around 550 reports in the Netherlands are linked to the organisation, with roughly 200 in Belgium. Dutch victim losses total nearly EUR 25 million, and most victims in this investigation lost more than EUR 10,000. Politie estimates the organisation took more than EUR 100 million per month across various countries and that victims worldwide number in the tens of thousands. Both figures are police estimates, not established totals.

Why it matters

Read as analysis, the corporate shape is the story. Politie describes one head office directing about twenty offices, each holding multiple teams, with every team assigned a target country. That means a bank’s inbound fraud complaints are not random noise. They are the output of a specific team with a country quota, which is why complaints tend to arrive in clusters with matching scripts, matching platform look and feel, and matching payment rails.

The method Politie sets out is equally structured. Contact is near daily and can run for months. The first deposit is always a relatively low amount and always shows an immediate profit. The platform where victims check their holdings is indistinguishable from a real one, but nothing is invested, and the money, largely cryptocurrency, goes to the fraudsters. That small first deposit is the practical detection point, because it is the last moment before trust hardens.

One second-order risk is underweighted almost everywhere. Politie warns that victims who stop investing out of suspicion may later be approached by a recovery company promising to retrieve their money, usually after a request for an up-front deposit. Police suspect those recovery firms belong to the same organisations. A closed fraud case is therefore a live lead list.

Practitioner angle

• Treat a first-time, low-value transfer to a new investment platform followed by an immediate larger transfer as a monitoring pattern in its own right, not two unrelated payments.
• Cluster your investment-fraud complaints by platform name, payment corridor, and crypto exchange destination. If one team is assigned to your country, the overlap should be visible in your own data.
• Build a specific alert for outbound payments from customers who have already reported investment fraud. Politie’s recovery-fraud warning makes those customers the highest-risk population you hold, not the safest.
• Update outbound victim contact scripts. Politie approached many people who had not realised they were being defrauded, which is a reminder that no complaint does not mean no loss.
• Check that AML (anti-money laundering) and fraud teams share the same platform and wallet indicators. The abuse here sits across both.

The one thing to do this week: pull every customer who reported investment fraud in the past 24 months and put a watch on their outbound payments for recovery-fee requests.