INTERPOL's Operation Serengeti III: 1,462 arrests and over USD 105 million recovered in Africa
INTERPOL says law enforcement from 21 countries arrested 1,462 suspects and recovered more than USD 105 million in illicit funds in a cybercrime operation across Africa.
INTERPOL announced on 22 October 2026 that law enforcement agencies from 21 countries took part in Operation Serengeti III between 29 June and 31 August 2026. According to INTERPOL, they arrested 1,462 suspects, disrupted 10,909 malicious networks and recovered more than USD 105 million in illicit funds.
The operation targeted cyber-enabled fraud, ransomware, business email compromise (BEC, where criminals pose as a known business contact to redirect payments), online scams and digital extortion. INTERPOL says authorities identified 65,929 victims and that financial investigations linked the criminal activity to losses exceeding USD 385 million.
INTERPOL gave country examples. In Uganda, authorities dismantled two transnational fraud rings and arrested 365 foreign nationals. In Angola, investigators dismantled two illegal cryptocurrency mining centres, arrested nine suspects and seized more than 2,000 mining devices. In Nigeria, INTERPOL says one suspect had amassed approximately 2.1 million email addresses, and financial investigations in a separate case revealed the movement of more than USD 2.4 million in suspected criminal proceeds.
The operation was co-funded by the Global Action on Cybercrime Enhanced (GLACY-e) project. The figures are as reported by INTERPOL; arrests are not convictions.
Why it matters to AML professionals
Fraud and business email compromise proceeds pass through bank and payment accounts before they are cashed out or converted to crypto. Large cross-border operations like this often lead to requests for information, freezes and new intelligence for financial institutions. AML professionals who know the typologies can spot mule accounts and fraud payments earlier.
Red flags in this case
- Incoming payments from many unrelated individuals followed by quick transfers abroad or to crypto exchanges
- A business customer that suddenly changes its payment details by email shortly before a large invoice is due
- Accounts opened by foreign nationals with no local ties that receive high volumes of retail transfers
- High electricity use or bulk equipment purchases inconsistent with the customer's stated business
If this landed in your queue
- Map where the money came from and where it went next, including any crypto exchange or overseas account
- Check whether the account shows mule patterns such as pass-through activity and many unrelated payers
- For a suspected BEC payment, contact the receiving institution quickly to request a recall or freeze
- File a suspicious activity report that explains the fraud typology and lists all linked accounts
Key terms
- Business email compromise (BEC)
- A fraud where criminals pose as a trusted business contact by email to trick a victim into sending money to an account they control.
- Money mule
- A person whose account is used to receive and pass on criminal proceeds, knowingly or not.
Interview angle
How would you spot an account being used to launder online scam proceeds?
Describe pass-through activity: many incoming payments from unrelated people, quick outgoing transfers or crypto purchases, and a profile that does not fit the customer.
Sources
Go deeper on AMLift
Every fact in AMLift News Desk stories comes from an official source: a regulator, court, government gazette or the company's own filing.
Report an error
Every report is checked against the official source. If we got something wrong, the story is corrected.