What Operation Serengeti III Shows About Fraud Hitting Cross-Border Small Businesses

On 22 October 2026, INTERPOL announced the results of Operation Serengeti III. The operation ran from 29 June to 31 August 2026 and involved law enforcement agencies from 21 countries: 20 in Africa and the United States. Investigators disrupted 10,909 malicious networks, arrested 1,462 suspects and recovered more than $105 million in illicit funds.

The operation targeted cyber-enabled fraud, ransomware, business email compromise (BEC), online scams and digital extortion. For founders with customers, suppliers or payment partners abroad, the named crime types include threats to company payments and accounts, and some checks for everyday finance work follow below.

What the Operation Covered

INTERPOL reports that investigators identified 65,929 victims and links more than $385 million in losses to the criminal activity examined. INTERPOL describes these as losses linked to that activity.

Investigators from the 20 African countries and the United States received intelligence before the operation began. The Hacker News lists the participating African countries as Angola, Benin, Cameroon, Congo, Côte d’Ivoire, DR Congo, Eswatini, Gabon, Gambia, Ghana, Kenya, Mozambique, Nigeria, Rwanda, Senegal, South Africa, Tanzania, Uganda, Zambia and Zimbabwe.

The operation followed two earlier waves. According to The Hacker News, the waves run from September to October 2024 and from June to August 2025 together led to more than 2,000 arrests.

Figures vary slightly by outlet. The Record gives the arrest total as more than 1,400 and the network count as more than 10,000, while INTERPOL’s figures are 1,462 and 10,909.

INTERPOL says investigators are still working to identify more suspects, trace illicit proceeds and analyse seized digital evidence.

Operation Scope
INTERPOL reports that Operation Serengeti III ran from 29 June to 31 August 2026, disrupted 10,909 malicious networks and recovered more than $105 million in illicit funds.

Credential Theft Behind Business Email Compromise

The Nigerian case is the one INTERPOL ties directly to business email compromise. INTERPOL reports one arrest in a phishing and BEC operation that harvested software credentials and amassed about 2.1 million email addresses.

The FBI’s Internet Crime Complaint Center (IC3) describes BEC as a scam that often starts when criminals compromise a legitimate business email account, through social engineering or computer intrusion, and then carry out an unauthorised transfer of funds.

For a company that pays suppliers abroad, a request to change account information can arrive from a compromised legitimate email account. IC3 advises verifying such requests with the intended recipient.

Investment and Pension Scams Reaching Foreign Accounts

In Uganda, INTERPOL reports that two transnational fraud rings were dismantled and 365 foreign nationals were arrested. The rings ran investment and pension scams aimed at victims across Asia, using call centres, fake trading platforms and fraudulent websites.

According to The Record, Simon Mundeyi, a spokesman for Uganda’s Ministry of Internal Affairs, said most detained people came from South and East Asia and worked from an apartment complex that appeared to restrict their ability to exit. The Record also reports that INTERPOL said the groups targeted pensioners in Asia.

In Nigeria, one arrest followed an investment fraud promoted through messaging apps. INTERPOL reports that more than $2.4 million in suspected proceeds moved through the scheme, much of it laundered through cryptocurrency.

Malicious Apps, Vehicle Fraud and Crypto Mining

INTERPOL lists a malicious mobile loan application scheme dismantled in Tanzania and a social media-based vehicle import fraud network disrupted in Gabon. Both appear in the operation’s list of highlights.

In Angola, two illegal cryptocurrency mining centres were dismantled. INTERPOL reports nine suspects arrested and more than 2,000 mining devices and six power transformation stations seized, with the electrical infrastructure valued at over $1 million. INTERPOL reports 30 suspects arrested in a separate cybercrime operation in the Republic of Congo.

Ransomware and digital extortion also appear in the operation’s list of crime types. Those threats sit alongside payment fraud in the operation’s scope, and the controls below cover only part of that scope.

Payment Controls to Put in Place Now

IC3’s BEC guidance lists four preventive steps. Verify requests to change account information with the intended recipient through a secondary channel or two-factor authentication. Check the sender’s actual email address, especially on a mobile device. Turn on settings that show full email addresses. Monitor personal financial accounts for irregularities, such as missing deposits.

If fraud is recognised, IC3 recommends contacting the originating financial institution as soon as possible to request a recall or reversal, along with a Hold Harmless Letter or Letter of Indemnity. It also advises filing a detailed complaint at ic3.gov, including all required fields and banking information.

IC3 also directs readers to its public service announcements for updated BEC trends.

How Private Partners Fed the Investigation

INTERPOL lists Group-IB, Kaspersky, Fortinet, Team Cymru, Uppsala Security, the Cybercrime Atlas, Meta and the Global Anti-Scam Alliance among its private and technical partners. The Postal and Telecommunications Regulatory Authority of Zimbabwe also took part, and the GLACY-e project, a joint initiative of the European Union and the Council of Europe, co-funded the work.

According to The Record, INTERPOL provided intelligence on suspicious domains, IP addresses and command-and-control servers. The Hacker News reports that Group-IB supplied threat intelligence on phishing kits, botnets and other malicious infrastructure.

Neal Jetton, INTERPOL’s director of cybercrime, is reported by The Hacker News as saying that international cooperation is among the most effective tools for disrupting criminal networks.