Tech Giants Unite to Disrupt West African Cybercrime Networks

Key Takeaways

• Major tech companies, including Meta, Google, Microsoft, and OpenAI, collaborated with law enforcement in a global operation targeting West African cybercrime networks.
• The initiative resulted in the removal of over 3.7 million fraudulent accounts across Facebook and Instagram, 28 arrests, and the rescue of 117 human trafficking victims.
• The scam networks primarily leveraged social engineering tactics, fake identities, and payment fraud, rather than technical vulnerabilities or specific malware.
• Victims, predominantly in the US and UK, suffered losses totaling approximately $8.3 million, with an additional $11 million in potentially freezable funds identified.
• The operation highlights the critical need for a multi-faceted approach combining platform-level account disruption, financial tracing, and on-the-ground law enforcement action to combat sophisticated online fraud.

Tech Giants and Law Enforcement Disrupt West African Cybercrime

In a significant international effort, leading technology companies Meta, Google, Microsoft, and OpenAI joined forces with law enforcement agencies worldwide to dismantle extensive cybercrime networks operating out of West Africa. This collaborative operation, announced on October 13, 2026, resulted in the removal of more than 3.7 million fraudulent accounts, pages, and groups across Meta’s platforms, Facebook and Instagram. Beyond digital disruptions, the crackdown led to 28 arrests and the rescue of 117 individuals who were forced into labor within scam centers.

The United Kingdom’s National Crime Agency spearheaded this initiative from London, bringing together technology sector partners and law enforcement from ten different nations. The “Joint Disruption Week” commenced on October 6, with investigators pooling intelligence on criminal operations primarily based in Nigeria, Ghana, and other African countries, as detailed in a Department of Justice announcement.

Unmasking the Scam Networks

Investigators from the Department of Justice and analysts at Meta identified the core of these illicit activities to be sophisticated scam networks and abusive online behaviors, rather than a singular, identifiable malware family. The published reports from neither organization disclosed specific malware samples, file hashes, or detailed infection chains. Instead, the findings underscored a reliance on coordinated social engineering, the creation of fake online identities, and various forms of payment fraud disseminated across multiple online platforms.

Meta reported that the majority of the removed accounts were designed to target individuals in the United States and the United Kingdom, often by masquerading as American and British users. These account removals are part of Meta’s ongoing commitment to enhancing its anti-scam tools, effectively depriving criminals of the means to reach potential victims.

Microsoft also contributed to the operation by suspending accounts identified as having connections to these scam activities. While Google and OpenAI participated, their specific account takedown figures were not separately disclosed. OpenAI confirmed its role in sharing intelligence with partners and leveraging artificial intelligence to aid in the detection of these scam networks across various platforms.

The intelligence gathered led authorities to over 30 suspected scam centers. In Sasaabi, near Accra, Ghanaian law enforcement apprehended 19 individuals and confiscated 303 electronic devices. Crucially, they also identified 117 human trafficking victims awaiting repatriation to Nigeria and 89 fraud victims who collectively suffered losses amounting to approximately $8.3 million. Nigerian authorities made an additional nine arrests and seized 53 devices. It is vital to differentiate between the arrested suspects and the trafficking victims; Meta explicitly stated that those rescued in Ghana were held against their will, subjected to inadequate living conditions, and endured both physical and psychological abuse. This distinction emphasizes that individuals found within these compounds may themselves be victims of the overarching criminal enterprise.

How the Scam Networks Operated

The West African cybercrime networks employed diverse fraud models, moving beyond traditional technical exploits. A common tactic involved investment scams, where perpetrators would cultivate fake romantic or professional relationships with victims before steering them toward fraudulent investment opportunities, often including deceptive cryptocurrency schemes.

Other prevalent fraud types included impersonating military personnel, advertising goods that were never delivered, and making false claims that criminals could recover money previously stolen from victims. Law enforcement impersonation and digital arrest schemes were also utilized, employing threats to coerce victims into making payments. Additionally, job and task scams lured applicants with promises of simple work, only to demand upfront fees or transfers. These methods predominantly exploited human psychology—trust, fear, and false authority—rather than relying on disclosed software vulnerabilities.

The technical response to these operations involved meticulously connecting online accounts, web infrastructure, communication channels, and financial transaction trails. Silent Push reported mapping over 35,000 malicious domains and nearly 700 communication channels linked to these African scam centers. This crucial intelligence enabled investigators to establish connections between online criminal activities and their physical locations and operators.

For individuals evaluating suspicious offers, prior warnings from the FBI concerning fake work-from-home job scams remain highly relevant. These warnings highlight the importance of scrutinizing requests for cryptocurrency payments before any work is received, a payment pressure tactic frequently observed among the fraud types identified during this recent operation. Separately, Coinbase successfully identified over 65 active scam victims and prevented more than $415,000 in potential losses before payments were finalized.

This extensive operation underscores that merely removing fraudulent accounts is insufficient. A comprehensive strategy involves disrupting victim contact, tracing financial flows to expose illicit payment routes, and enabling law enforcement to seize devices and apprehend suspected organizers. While investigators have garnered valuable new leads, it has not been confirmed that every linked scam center has been entirely shut down.

Indicators of Compromise (IoCs):-

What You Should Do

• Preserve Evidence: If you believe you have been targeted by a scam, meticulously save all communications, payment records, and transaction details. This information is vital for investigators.
• Cease All Payments: Immediately stop sending any money or making any further payments to the suspected scammer.
• Contact Payment Providers: Reach out to your bank, credit card company, or cryptocurrency exchange to report the fraud and attempt to halt or reverse transactions.
• Report Online Fraud: Report the incident to relevant authorities such as your local law enforcement, the FBI (for US victims), or national cybercrime units.
• Beware of Recovery Scams: Be highly skeptical of anyone who promises to recover lost cryptocurrency or funds in exchange for an upfront payment or fee. These are often secondary scams targeting previous victims.
• Verify Identities: Always independently verify the identity of individuals or organizations requesting money or personal information, especially those claiming to be military personnel, law enforcement, or offering lucrative investment opportunities.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.