INTERPOL said it has traced more than $2.4 million in suspected criminal proceeds to an international investment fraud scheme promoted through messaging applications in Nigeria, in an operation that resulted in 1,462 arrests across 21 countries.

The Nigerian investigation was conducted under Operation Serengeti III, a major cybercrime crackdown coordinated by INTERPOL between June 29 and August 31, 2026, targeting cyber-enabled fraud, ransomware, business email compromise (BEC), online scams and digital extortion across Africa.

A suspect was arrested in Nigeria in connection with the investment fraud investigation, while financial inquiries traced the movement of more than $2.4 million in suspected criminal proceeds. INTERPOL said much of the money had been laundered through cryptocurrency transactions, according to the international law enforcement agency.

In a separate investigation, Nigerian authorities arrested a suspect linked to a large-scale phishing and business email compromise operation that harvested software credentials and amassed approximately 2.1 million email addresses. Investigators also recovered a luxury vehicle suspected to have been purchased with criminal proceeds.

INTERPOL did not identify the Nigerian suspect or disclose the messaging applications used to promote the fraudulent investment opportunities. It also did not provide details on the number of victims associated with the Nigerian investigation.

Across the wider operation, authorities identified 65,929 victims targeted by cybercriminal networks and linked criminal activities to financial losses exceeding $385 million. Law enforcement agencies recovered more than $105 million in illicit funds and disrupted 10,909 malicious networks.

Two Nigerian cybercrime investigations

The Nigerian investment fraud case was one of two investigations highlighted by INTERPOL from the operation.

In a separate investigation, Nigerian authorities arrested a suspect linked to a large-scale phishing and business email compromise operation that harvested software credentials and amassed approximately 2.1 million email addresses. Investigators also recovered a luxury vehicle suspected to have been purchased with criminal proceeds.

The two cases demonstrate the range of cyber-enabled crimes investigated by Nigerian authorities during Operation Serengeti III, from investment fraud involving cryptocurrency to attacks designed to steal email credentials and compromise business communications.

Cross-border cybercrime

Operation Serengeti III brought together law enforcement agencies from 21 countries to identify suspects, disrupt criminal infrastructure and trace funds linked to cybercrime.

Before the operation began, investigators from 20 African countries and the United States received actionable intelligence on suspicious domains, IP addresses and command-and-control infrastructure associated with criminal activity.

Private-sector partners also supported the operation by providing intelligence, technical analysis and operational expertise to help investigators identify targets, map criminal networks and support investigations.

Neal Jetton, INTERPOL Director of Cybercrime, said the operation demonstrated the importance of international cooperation against criminal networks that operate across national borders.

“Cybercrime networks operate without regard for borders, exploiting technology to target victims on an unprecedented scale,” Jetton said.

“Operation Serengeti III reinforces a clear message: while cybercrime is increasingly borderless, international cooperation remains one of the most effective tools for disrupting criminal networks, recovering criminal assets and protecting communities from digital harm,” he added. The operation produced significant arrests and seizures elsewhere in Africa.

In Uganda, authorities dismantled two transnational fraud rings and arrested 365 foreign nationals linked to online investment and pension fraud schemes targeting victims across Asia.

Investigators uncovered a rotating call-centre model in which suspects allegedly used scripted communications, fake trading platforms and fraudulent websites to persuade pensioners to invest in non-existent opportunities.

In Angola, authorities dismantled two illegal cryptocurrency mining centres, arrested nine suspects and seized more than 2,000 cryptocurrency mining devices, alongside six illegal power transformation stations. The seized electrical infrastructure alone was valued at more than $1 million.

Elsewhere, authorities dismantled a malicious mobile loan application scheme in Tanzania, disrupted a social media-based vehicle import fraud network in Gabon and arrested 30 suspects linked to a cybercrime operation in the Republic of Congo.

AI and evolving cyber threats

The operation comes as cybercrime across Africa evolves alongside wider adoption of artificial intelligence and digital financial services.

INTERPOL’s African Cyber Threat Assessment Report 2026 identifies AI as an increasingly important enabler of cybercrime, with the technology being used across different stages of attacks, while cyber-enabled financial losses continue to rise.

The growing use of digital platforms for financial transactions and investment promotion is also creating new opportunities for criminals to reach potential victims across borders.

Investment scams promoted through messaging applications can exploit trust in online communications, while cryptocurrency transactions can add complexity to efforts to trace and recover suspected criminal proceeds.

However, INTERPOL’s information on Operation Serengeti III does not establish that artificial intelligence was used in the Nigerian investment fraud investigation.

Several investigations arising from the operation remain active, with authorities continuing efforts to identify additional suspects, trace illicit proceeds and analyse seized digital evidence.

The Nigerian investigation forms part of a broader international effort to disrupt cybercriminal networks, recover funds linked to suspected offences and strengthen cooperation among law enforcement agencies confronting increasingly sophisticated digital threats.