Authorities arrested seven people allegedly involved in an investment fraud scheme that claimed potential victims in more than 50 countries, Europol said Tuesday. Officials said the operation caused estimated losses of at least $4.5 million. 

The takedown effort involved searches across 17 countries Tuesday and netted the seizure of more than 100 servers, according to Europol.

Officials targeted the scheme run by a company that allegedly provided cybercrime groups a series of trading websites and an assortment of call centers tasked with tricking victims into transferring their savings. 

The company, operated from Cyprus and Israel, was linked to call centers in Albania, Kosovo and North Macedonia, officials said. 

“The scheme promised substantial, quick returns from trading in cryptocurrencies, foreign currencies or stocks,” Europol wrote in a news release. “Behind seemingly legitimate platforms, supposed brokers used fictitious profits and sustained psychological pressure to persuade victims to invest more.”

The investment scam’s operators used affiliate marketing to target potential victims with advertisements that led them to fraudulent investment platforms. Cybercrime groups running the call centers purchased data collected through those ads to contact potential victims, officials said.

Operators duped victims by displaying fictitious profits and pressured victims to transfer large sums of money. “When victims asked to withdraw their money, the operators used delaying tactics to block payments. Eventually, contact ceased, leaving victims unable to recover their funds,” Europol wrote. 

Authorities were tipped off to the investment scam in 2022 when a German couple reported they couldn’t withdraw funds invested in an online trading platform. Authorities arrested two people allegedly involved in the scheme that year and seized evidence that eventually led to further arrests and seizures in 2025.

The joint investigation and takedown effort was supported by officials in Albania, Cyprus, Finland, Germany, Israel, Kosovo, North Macedonia and Poland. The seven people arrested Tuesday, who were not identified, are facing extradition to Germany to face charges, Europol said.

The post Europol dismantles investment scheme that impacted potential victims in 50 countries appeared first on CyberScoop.

Prosecutors announced charges against six alleged scammers based out of Africa who targeted Americans with fake non-fungible token (NFT) investment scams by posing as women on dating websites, netting hundreds of victims.

According to an affidavit for the arrest of of the six people — Chui Kok Wa, Gislen Neukeu, Shamusa Ninsiima, Clement Mugiraneza, Merveille Mudacumura and Nicodemus Hingima Monyancha — the criminal group with connections to China and Malaysia opened a scam compound in Madagascar early last year.

“In the scheme, scammers posed as beautiful women who met victims on dating websites, eventually enlisting them to connect their cryptocurrency wallets to fraudulent websites associated with the NFT investments,” the Justice Department said in a news release Tuesday. “Once connected, the scammers willed the victims to continue to fund their cryptocurrency wallets, and then surreptitiously pulled money from the victims’ wallets without their knowledge.”

The FBI identified approximately 74 cryptocurrency wallets associated with approximately 800 victims in the scheme, for an estimated loss of at least approximately $516,695, according to the affidavit and news release.

The U.S. District of Columbia’s Scam Center Task Force, the FBI’s field office in Honolulu and the U.S. Attorney’s Office for the District of Alaska made a trip to Madagascar in August to review electronic devices seized from scam compounds. Interviews with scam compound workers there revealed that Cambodian police activity and armed conflict between Thailand and Cambodia led to operations at a Cambodian scam compound being moved to Madagascar.

Phones for the alleged scheme leader, Wa, contained employment contracts and scripts for what scammers should say to victims, which said they would be committing “an emotional scam.” The devices that officials reviewed and the interviews also established further connections between the scammers and Southeast Asia and China.

After the initial interviews, though, Madagascar repatriated some suspects to China before the investigation was complete, according to the Justice Department.

“Today, [D.C.] U.S. Attorney Pirro called on the Madagascar government to cooperate with the United States, extradite the six charged defendants, and further noted that the government had obtained a material witness warrant to interview 15 employees of the scheme, who claimed they were human trafficked and abused by Wa, but are believed to be held in jail in Madagascar,” the release stated.

In the same release, DOJ said that the Scam Center Strike Force had crossed the $1 billion threshold in cryptocurrency recovered in its first year. 

The post Prosecutors charge Madagascar scammers in NFT-stealing scheme based on fake online dating profiles appeared first on CyberScoop.

A 44-year-old Chinese national was extradited to the United States and arraigned in federal court for his alleged involvement in a sweeping investment scam network that tricked at least 174 U.S. residents out of nearly $37 million, the Justice Department said Friday. 

Zheng Zhao was extradited from the Netherlands to the United States to face a conspiracy to commit money laundering charge that could keep him in prison for 20 years. 

Prosecutors accuse Zhao and his co-conspirators of operating a global cryptocurrency investment scheme out of multiple countries, including scam centers in Cambodia. 

The cybercrime ring allegedly reached out to U.S.-based victims proactively via social media, phone calls, text messages and online dating sites to establish a deceitful relationship and build trust. Eventually, Zhao and his co-conspirators promoted cryptocurrency investments to the victims and directed them to send funds through fake sites that resembled legitimate trading platforms.

Victims were told their investments were growing in value, yet they were already transferred from U.S. bank accounts controlled by the co-conspirators to an account at Deltec Bank in the Bahamas, officials said. The crew allegedly converted the victim funds to Tether before transferring the assets to a digital wallet controlled in Cambodia.

The stolen funds were ultimately distributed to leaders of scam networks throughout the region, officials said.

Eight of Zhao’s co-conspirators previously pleaded guilty participating in the investment scam conspiracy, including Shengsheng He and Jingliang Su, who were sentenced to 51 months and 46 months in prison, respectively. 

Joseph Wong, a co-conspirator living in California, managed a network of money launderers in Los Angeles who registered shell companies, opened U.S. bank accounts and transferred stolen victim funds to international bank accounts.

“This case should serve as a warning to scammers in every corner of the world: there is nowhere to hide,” Todd Bratz, special agent in charge of the U.S. Secret Service Criminal Investigation Division, said in a statement. “Secret Service investigators and our law enforcement partners remain unwavering in their commitment to identify those who operate scam centers, disrupt their financial infrastructure and bring them to justice.”

The post Authorities extradite Chinese national for alleged $37M investment scam appeared first on CyberScoop.

A 40-year-old Nigerian national was sentenced to eight years in prison for running a years-long hacking, tax fraud and investment scheme, the Justice Department said Monday.

Chukwuemeka Victor Amachukwu enriched himself from 2019 to 2023 by hacking into U.S.-based tax preparation businesses, filing false tax returns with federal and state authorities using identities stolen from victim organizations and enticing victims to send him money for investments that did not exist, according to court records.

Amachukwu pleaded guilty to conspiracy to commit computer intrusions and wire fraud in April. He was arrested in France in July 2023 and extradited to the United States in August 2025.

“Chukwuemeka Amachukwu believed he was operating safely offshore when he targeted his victims, but he has now been held to account and now faces a serious sentence for his crimes,” Jamie McDonald, U.S. attorney for the Southern District of New York, said in a statement. 

“Amachukwu took part in sophisticated schemes to hack into U.S. businesses, steal and use stolen identity information of victims, and commit fraud,” McDonald added. “These crimes imposed significant harm on the victims and the public, and so it is only appropriate that the crimes also come with a significant sentence for the defendant.”

The financial penalties imposed on Amachukwu for his crimes accentuate the damage he inflicted at scale. A federal judge ordered him to pay nearly $3.65 million in restitution to his many victims and forfeit almost $10.85 million.

Prosecutors said Amachukwu and his alleged co-conspirators obtained more than $7 million in fraudulent investment schemes, about $2.5 million in fraudulent tax returns and $819,000 in fraudulent payouts from the Small Business Administration’s Economic Injury Disaster Loan program. 

Amachukwu, his alleged co-conspirator Kingsley Uchelue Utulu and other alleged Nigeria-based co-conspirators also stole the tax and personal data of at least 800 business customers after hacking into tax businesses based in New York, Texas and elsewhere, according to court records.

In one of those attacks, in May 2021, members of the conspiracy sent a spearfishing email to an employee of a New York-based tax preparation business, which infected the firm’s computer systems with malware.

The FBI, Justice Department’s Office of International Affairs and the U.S. Marshals Service assisted the investigation, which led to Amachukwu’s arrest and extradition from France.

The post Nigerian sentenced to 8 years for long-running tax business hacking and fraud scheme appeared first on CyberScoop.

The Federal Trade Commission is asking a court to force the owner of multiple digital security and privacy companies from further operations, saying the businesses are serially defrauding their customers out of millions of dollars.

Earlier this month, the FTC filed a federal lawsuit in Ohio against Dmitry Belkin and 12 of his businesses, alleging they engaged in unfair and deceptive trade practices under the Federal Trade Act and violated the Telemarketing Act’s prohibition against deceptive and abusive telemarketing acts since at least 2020.

The majority of Belkin’s companies, with names like Digital Forensics Corp., 1^st All Data Recovery and Remote Backup Corp., advertised services to help people deal with ongoing online romance or “sextortion” scams, where a scammer threatens to publish a nude or sexual photo of the victim unless they pay a ransom.

They operated websites like BlackmailHelpline.com, DigitalForensics.com and other sites that would routinely be advertised on Google, YouTube, X and other sites when users are searching for help with sextortion attacks.

The FTC alleges that despite taking in at least $60 million from customers, Belkin and his companies routinely failed to deliver most of the listed services meant to protect customers from ongoing scams, generated fake transcripts to fool customers into believing a sextortion threat had dissipated and routinely denied requests for refunds.

“Defendants falsely portray themselves as digital forensics experts, claiming they can track and identify sextortionists, prevent the spread of explicit material, and coordinate with law enforcement to bring criminals to justice,” the FTC said in its complaint. “Defendants further mislead victims by asserting that law enforcement will not help stop the sextortion attack” and that contacting the police is “the last thing you want to do.”

According to the complaint, Belkin’s businesses would first pitch a “Phase 1” package of services, between $1,499 and $20,000, that included “stopping” an ongoing attack, handling communications with the sextortionist, tracing their location, sending a legal cease-and-desist letter and reporting the evidence to law enforcement.

The FTC complaint alleges that in reality, the companies simply use the customer’s account to communicate with the scammer, before changing account settings to block them, fabricating chat transcripts and using pre-saved geolocation coordinates to fool customers.

After customers purchased Phase 1 services, Belkin’s companies would routinely pressure them for thousands of dollars in additional “Phase 2” services, which were advertised as monitoring services for victim accounts that could detect and prevent future attacks.

“Defendants do not perform any of these services either,” the FTC alleged.

The complaint alleges that Belkin drafted a script for employees at his companies to use during telemarketing calls, designed explicitly to exploit victims’ fears and anxieties around their nude images being made public. This included comments implying that a bad actor could alter a real photo of the victim to include sexual acts with minors, spurring concerns about legal liability. After each call, employees filled out a form confirming they had used certain keywords or phrases, such as “pedophile,” “devastating consequences,” “life altering” and “no coming back after this.”

“I’ve seen these situations ruin people’s retirement all from the accusation of being a child predator,” the script said at one point, according to the complaint. “We need to make sure nothing gets posted.”

Some customers were also asked seemingly unrelated questions about their personal lives, such as if their marriage was “on the rocks,” had cheated on their spouses, or had young children that could “mean a custody battle” if the images were released publicly.  

The companies received hundreds of requests for refunds but often denied them, also going to great lengths to prevent or drown out negative reviews online. Unhappy customers were directed to a fake version of the Better Business Bureau’s website, controlled by Belkin, to submit their complaints.

The actual Better Business Bureau page for one of the businesses, Digital Forensics Corp., still includes numerous complaints from customers alleging they were defrauded. One customer complaint, filed in August, states that they signed a contract in 2023 “out of sheer panic and fear” and were still making payments because “they had my personal information and would contact me if I didn’t pay.”

Another review from a customer in June said they were “pressured” into a contract with the company in 2024, were still making monthly payments and when they contacted the company to cancel, were told they “could not close the account and must continue making payments.”

In both cases, the company responded within days, offering “alternative” options to resolve the disputes, such as paying a reduced settlement for the remaining balance.

They also allegedly flooded their own websites with fake positive reviews, gave partial refunds paired with non-disparagement agreements to push some customers to take down their negative reviews, and even hired Uber drivers to post fake testimonials with staged photographs.

Requests for comment sent to Belkin’s attorney and his personal LinkedIn account were not returned.

The post FTC says ‘sextortion’ protection companies deceived customers about services  appeared first on CyberScoop.

A joint international law enforcement and industry operation against scammers netted 28 arrests, rescued 117 trafficking victims and led to the takedown of more than 3.7 million accounts, the Justice Department announced Tuesday.

The crackdown, billed as “Joint Disruption Week,” focused on West Africa and also identified more than $11 million in freezable funds and led to the seizure of hundreds of electronic devices. The range of scams involved included law enforcement impersonation scams, digital arrest extortion schemes, pig butchering and other online fraud operations targeting victims around the world.

Participants heralded it as the largest joint scam operation to date, and the first focused on West Africa.

“For so long, the problem of international scams seemed impossible to tackle,” Kelly Milliron, acting chief of staff and counselor to the Assistant Attorney General leading the Criminal Division, told reporters. “But now, because of collaborations like Joint Disruption Week, we have a plan, a consolidated approach, bringing together people that can bring solutions and, most of all, safety for our citizens.”

It’s the latest effort in the Trump administration’s ongoing bid to make countering scam operations a theme of his term, and to make disrupting cyber adversaries and criminals a central focus of its cyber strategy. 

Participating agencies in the London-hosted operation beyond the Justice Department were the Scam Center Strike Force under the U.S. Attorney’s Office for the District of Columbia, the FBI, the Secret Service, the Treasury Department, Homeland Security Investigations, the Homeland Security Task Force, the United Kingdom’s National Crime Agency, the Nigerian Joint Case Team on Cybercrimes, the Nigeria Police Force’s National Cybercrime Center and the Ghanaian Cyber Security Authority, INTERPOL and agencies from Australia, Canada, India and New Zealand also were involved. 

Adobe, Binance, Coinbase, Cyjax, Elliptic, Chainalysis, Flashpoint, Google, Meta, Microsoft, OpenAI, Silent Push, Starlink and TRM Labs were companies that participated in the operation. Meta said it removed more than 3.7 million accounts, groups and pages from Facebook and Instagram based in West Africa, a majority of which targeted people in the United States and United Kingdom.

Some on Capitol Hill have raised concerns about whether U.S. operations to counter scams are coordinated enough.

The operation actually began in September, with a series of raids in Ghana before last week’s designated action. Jeanine Pirro, U.S. Attorney for the District of Columbia, said Disruption Week occurred not long after a new partnership with the United Kingdom.

“The aim is to bring cases in parallel and also to combat fraud together through joint targeting,” she said. “This was the perfect time to continue that partnership.”

It’s not clear how many of the potentially freezable funds will actually be frozen as a result of the operation.

“Identifying the assets is the easy part, and tracing them, going after and developing probable cause within our investigations so that we can legally seize them does require a little bit of work,” said Matthew Floyd, deputy assistant director of the FBI’s Criminal Investigative Division. “So at this point, that’s why it’s much easier in these efforts to identify assets initially, and then they’ll fold into our investigations as we move forward.”

Disruption Week was the culmination of agencies meeting to combine forces, something that will happen on a regular basis, Floyd said, but at an interval to be determined going forward. The operation led to the sharing of more than 30 leads on scam centers, participants said.

The post West African scammers targeted in joint international government-industry operation appeared first on CyberScoop.

Five alleged leaders of the South African wing of Black Axe, a global cybercrime group with operations spanning dozens of countries, were extradited to the United States Friday to face multiple charges, the Justice Department said.

Officials accuse the five people, all originally from Nigeria, of running romance scams and advance fee scams from at least 2011 until they were all arrested in South Africa in 2021. The defendants were due Monday for initial court appearances and arraignments in a federal court in Trenton, N.J.

“Black Axe is a notoriously violent transnational criminal organization that also happens to dabble in romance scams to make money,” Stefanie Roddy, special agent in charge of the FBI Newark field office, said in a statement. “The ability of FBI Newark and our partner agencies to reach into South Africa illustrates our resolve to hold accountable any and every type of fraudster who preys on innocent victims here in the United States.”

The accused include Perry Osagiede, founder and leader of the Cape Town Zone of Black Axe; Franklyn Edosa Osagiede, the zone’s “chief ihaza” Osariemen Eric Clement, “assistant eye of the zone,” Collins Owhofasa Otughwor, the zone’s “chief eye,” and Musa Mudashiru, one of the group’s “assistant butchers.”

Prosecutors said the five defendants and their co-conspirators used fake identities to pose as a love interest, relatives, business partners or friends to trick victims into sending them money.

Many of the scams involved claims that the alleged cybercriminals needed money for work travel or to hold them over financially following a series of unfortunate events. This included requests for loans, often involving issues with a construction site, delayed inheritance, or expensive health costs for claimed relatives, according to an unsealed indictment filed in the U.S. District Court of New Jersey in 2021. 

Prosecutors said the co-conspirators also used business entities and gained access to the financial accounts of some victims to conceal the funds illegally obtained from other victims. In some cases, the alleged Black Axe members threatened to distribute sensitive photos of victims when they hesitated to send money, officials added.

The extradition follows a heightened period of law enforcement activity targeting Black Axe in multiple countries. 

Authorities arrested 34 alleged cybercriminals in Spain, including some Black Axe leaders, for adversary-in-the-middle scams such as business email compromise, money laundering and vehicle trafficking in January. 

Officials seized millions in assets, arrested 58 individuals and identified 263 suspects, including members of Black Axe, in a multi-country sting operation in August. 

Black Axe is a highly structured, hierarchical group that generates billions of dollars in criminal proceeds annually from many small-scale operations spanning dozens of countries. 

All five of the extradited individuals are charged with conspiracy to commit wire fraud and money laundering. Perry Osagiede and Franklyn Osagiede are also charged with wire fraud and aggravated identity theft. Officials also charged Clement with wire fraud and Otughwor with aggravated identity theft. The combined charges carry up to 62 years in prison. 

“This case reflects the result of a years-long effort by the U.S. Secret Service and our law enforcement partners to identify, investigate, and bring to justice those who allegedly preyed on victims through sophisticated online fraud and money laundering schemes,” Craig Marech, special agent in charge of the U.S. Secret Service’s Newark field office, said in a statement. 

The Justice Department published additional information about the Cape Town Zone wing of Black Axe, including multiple aliases and business entities used by the group’s members, and encouraged potential victims to contact the FBI.

The post Five alleged leaders of Black Axe’s operations in South Africa extradited to US appeared first on CyberScoop.

The Federal Communications Commission wants to set up a new scorecard system that would allow rate telecoms’ ability to prevent or deter unwanted robocalls.

According to the agency, the scorecard “will empower consumers and encourage providers to continue to combat illegal robocalls by providing the public with an assessment of the effectiveness of voice service providers’ efforts to protect consumers from illegal robocalls,” the FCC said in a Wednesday public notice.

The notice does not prescribe or define technical solutions or systems for the scorecard, instead laying out broad goals for the project. Those include creating a public guide for evaluating how well providers prevent robocalls, and how transparent they are with their metrics.

The agency expressed a desire for more than “a simple administrative checklist,” such as whether the provider offered the right tools or filed the right paperwork, but rather “a composite set of metrics that reflects both operational practices and measurable outcomes, including how often legitimate calls are blocked.”

The scorecard would apply only to domestic voice service providers with retail customers, including wireless, wireline, VoIP providers and hybrid networks, but the agency is seeking comment from the public on whether to focus on larger providers, exclude small or regional networks and other questions around who would be evaluated.

The FCC says it intends to publish the scorecard results, but characterized it as a tool to help consumers understand how effectively voice service providers address robocalls on their networks and “not a rulemaking that will result in new rules or requirements for voice service providers.”

However, the notice does flag a number of federal data systems built around enforcement that the agency said it believes would be “best” for evaluating companies, including Robocall Mitigation Database filings, FCC Consumer Complaints Center data, and FCC enforcement action data, along with third-party or industry sources like Industry Traceback Group data and Federal Trade Commission complaint data.

Peter Hyun, former acting head of enforcement at the FCC, endorsed the general concept behind the idea, likening it to the Department of Transportation’s creation of an airline customer service dashboard in 2024.

That transparency “helped foster adoption of improved practices and a strong focus on better outcomes for consumers,” Hyun told CyberScoop in a text message. “With recent legal and policy fights over FCC enforcement, this is a creative effort to use other tools to combat what is an ever-tormenting issue for consumers: illegal calls.”

FCC officials have emphasized that the most frequent complaints they hear from consumers are around robocalling, and they are seeking to address that demand in a variety of ways.

On the same day the scorecard was unveiled, the FCC announced it had booted 14 telecommunications providers from the Robocall Mitigation Database. The federal system is used by companies to document their compliance with anti-robocalling standards — like STIR/SHAKEN protocols — that FCC officials say are vital to helping them validate legitimate network traffic moving through the U.S. and identify bad actors.

Removing a company from the database effectively cuts it off from connecting to U.S. telecom networks. FCC regulations give other U.S. providers two days to block all traffic coming from violators.

“Today’s action pushes more than a dozen providers off of U.S. networks for failing to abide by our robocall rules,” said FCC Chair Brendan Carr. “The FCC continues to attack the problem of illegal robocalls at every point along the call path, and everyone in this ecosystem has an obligation to step up and do what they can to protect consumers against fraud and scammers.”

According to the FCC, the 14 companies failed to respond to take necessary steps when informed that their database certifications were out of compliance. The list of affected companies includes Apps Communications, CFX Business Solutions, Conference America, Convergence Technology Solutions, CSB Technologies, Digital Division, Dixie Net Communications, HighComm, Inatech Solutions, makrodepot, Opex Communications, ReachME, SECURE, and SkyCom Healthcare.

The post FCC proposes public scorecard to rate telecoms on anti-robocall efforts appeared first on CyberScoop.

Senators from both parties Thursday probed Trump administration officials about whether federal agencies and foreign governments are coordinated enough in the battle against scammers, something witnesses told the Foreign Relations Committee they were working to remedy.

At least 13 federal agencies have authorities to counter scams, raising questions about whether someone needs to be in charge of all those efforts. And while there was some bipartisan sentiment at Thursday’s hearing that the Trump administration has taken good actions to battle scammers, both lawmakers and administration officials said that scam operations have demonstrated that cracking down on them in one place often just leads to them going elsewhere.

Sen. Pete Ricketts, R-Neb., compared the situation to an international initiative that gained prominence in the 1990s to counter drug trafficking, Joint Interagency Task Force South.

“Given that today’s scam centers are similarly transnational, combining cybercrime, human trafficking, money laundering and cryptocurrency, has the threat reached the point that we should establish a comparable multinational coordination mechanism?” he asked.

Sen. Jeanne Shaheen, D-N.H., focused on federal coordination: She paraphrased a former federal official who said, “there is nobody that is heading that effort up across agencies. We need to treat this like combat, and so we need somebody in charge.”

Shaheen, the top Democrat on the panel, is a co-sponsor of the bipartisan Scam Compound Accountability and Mobilization (SCAM) Act, which seeks to unify federal efforts on the subject.

A State Department official told Shaeen scammers were a national security priority for President Donald Trump, and that his executive order on the topic sought to tackle coordination.

“I do understand that this is a whole-of-government approach, and many agencies are focused on this,” said David Bedard, deputy assistant secretary at State’s Bureau of International Narcotics and Law Enforcement Affairs “The Action plan that was directed by the president is currently in the interagency review process to deconflict some of the concerns that you have raised. We certainly think the task force that will be implanted through the executive order will solve the problems you might be referencing.”

There’s also an international plan under the task force, he said. Currently, the administration shares intelligence on scammers with foreign allies, and Interpol has “productive” channels to work through there and is setting up its own task force, Bedard said, but there are concerns about other countries taking similar, duplicative action.

There have been signs of progress on the international front, Bedard and another State Department witness told the panel.

Michael DeSombre, assistant secretary at the Bureau of East Asian and Pacific Affairs, said Trump has raised the subject with Chinese President Xi Jinping, and that China has used its influence in Asia as its own citizens have become scam victims. Still, there’s been more progress in countries where the United States has stronger relations, such as Cambodia, than in those where ties aren’t as close, like Burma and Laos.

In Cambodia, one key has been pursuing scam center bosses first and foremost, Bedard said.

The post Capitol Hill wants to know if executive branch, foreign allies coordinated enough to combat scams appeared first on CyberScoop.

A 41-year-old Ghanaian national was sentenced to 85 months in prison for stealing more than $10 million from mostly older, lonely and vulnerable victims via romance scams, the Justice Department said Tuesday. 

Derrick Van Yeboah was a longtime and high-ranking member of a criminal organization primarily based in Ghana linked to more than $100 million stolen from romance scams and business email compromises, officials said. Van Yeboah served as a “sakawa boy,” impersonating fake romantic partners and directly interacting with victims online from February 2015 to October 2024.

“Romance scammers do not simply steal money — they weaponize trust,” Jay Clayton, U.S. attorney for the Southern District of New York, said in a statement. 

Van Yeboah was arrested in Ghana in June 2025, acting on a request from the Justice Department, and extradited to the United States two months later. He pleaded guilty to conspiracy to commit wire fraud and agreed to forfeit $10.15 million in fraudulent proceeds as part of a plea agreement in March.

Authorities said they identified at least 20 of Van Yeboah’s victims, noting that some were deceived into sending their money to the criminal organization, creating companies and using those entities to unwittingly launder funds from other victims. 

Victims include a woman from Delaware who either sent or laundered $1.9 million, a woman from Ohio who sent or laundered $2.3 million and another woman who sent or laundered about $1 million. Van Yeboah also tricked a North Carolina man to send $123,000, claiming he needed a loan to pay for his mother’s funeral expenses and to remove imaginary gold and diamonds from storage in Italy, according to court records.

Officials said Van Yeboah received a substantial amount of money from his criminal acts. He told pretrial services his assets include a house worth $1.5 million and jewelry worth $515,000. When he was arrested, Ghanaian police found him in possession of two vehicles stolen from the United States and Canada.

“Victims lost large portions of their life savings, money they had counted on for retirement. They were emotionally devastated to learn that the personas they had been talking to every day, personas who claimed to be in love with them, were in fact frauds,” Clayton wrote in a pre-sentencing letter to the court. 

Van Yeboah’s conduct was cruel, and he fully understood the financial and emotional harm he was causing to his victims, he added. 

“Van Yeboah’s conduct was far from an aberration. Van Yeboah engaged in the fraud scheme for nine years. It wasn’t isolated conduct; it wasn’t a blip,” Clayton wrote. “Indeed, it appears to be the only real job Van Yeboah has ever had. Day after day, for years, he targeted vulnerable victims, lied to them, and stole from them.”

The post Ghanaian national sentenced to 7 years in prison for stealing $10M from romance scam victims appeared first on CyberScoop.

The State Department will restrict visas for cybercriminals like scammers to sextortionists, and in some cases even their family members, Secretary of State Marco Rubio said Thursday.

The Trump administration has sought to make a crackdown on foreign-based scams one of the signature issues of his second term. An executive order that the president signed in March indicated that visa restrictions would be on the table as one response.

“By restricting visa issuance to those who are responsible for or complicit in these criminal enterprises, we are sending a clear message: The United States will go after those who prey on our citizens,” Rubio said.

Other departments have also made efforts to reduce foreign-run scams. In June, the Department of Justice seized infrastructure used by subsidiaries of the Huione Group, a Cambodia-based corporate conglomerate tied to one of the world’s most prolific criminal marketplaces used to commit cyber scams and other crimes.

Rubio authorized the visa restrictions under a 1952 law that gives the State Department the ability to deport or rule as inadmissible someone who poses “potentially serious adverse foreign policy consequences.”

Critics have accused the Trump administration of abusing that provision of the law for political purposes.

Rubio’s statement on the visa restrictions mentions “individuals responsible for, or complicit in, cybercrime and cyber-enabled crime, such as those involved in cyberscams, and sextortion.”  Furthermore, he said, “Immediate family members of individuals engaged in such illicit activities may also be subjected to visa restrictions.”

Betsy Cooper, Founding Director of the Aspen Policy Academy, said the visa restrictions on cybercriminals could be valuable, but offered a caveat.

“Scamming people is a growing global enterprise, and it is a laudable goal to penalize those who scam and defraud people since they so rarely suffer consequences for their actions,” she said in a statement to CyberScoop. “So long as the new visa controls are used narrowly and deployed only against verified scammers and fraudsters, this is a positive step toward combatting cyber-enabled crime.”

While some cyber experts have questioned how much visa restrictions, prosecutions and other punishments of cyber miscreants who are based overseas will affect them, others maintain that it can serve as a deterrent to those who would consider getting into the line of work but want freedom to travel the globe.

FightCyberCrime.org, a nonprofit that seeks to help cybercrime victims, applauded the restrictions on the cybercriminals.

“We welcome efforts to hold cybercriminals accountable across borders. Cryptocurrency investment scams, romance scams, and sextortion cause devastating financial and emotional harm to victims,” it said in a statement to CyberScoop. “Meaningful disruption of these transnational criminal networks is an essential part of the response.”

But there’s still a long way to go in the fight, the statement continued.

“At the same time, we must invest more in victim support, prevention, and recovery resources,” the organization said. “Accountability is critical, but ensuring victims have access to trauma-informed support and resources is equally important.”

The post Rubio restricts visas for sextortionists, cyber scammers appeared first on CyberScoop.

Authorities arrested more than 5,800 alleged cybercriminals and seized $293 million in a global operation targeting social-engineering scams and money laundering across 97 countries, Interpol said Thursday.

The anti-fraud crackdown, dubbed Operation First Light, identified more than 142,000 victims, including people, businesses and governments, officials said. 

“Social engineering scams continue to pose a significant threat to our society. Criminal syndicates exploit human psychology to manipulate their targets, and no nation can stay safe unless all countries are equipped and committed to jointly fighting back,” Tomonobu Kaya, director of Interpol’s Financial Crime and Anti-Corruption Centre, said in a statement.

Police identified more than 15,500 cybercrime suspects during the operation, which spanned more than three months ending in late April, according to Interpol. Officials also analyzed more than 152,800 cases of cybercrime, including business email compromise, sextortion, romance scams, impersonation and investment schemes. 

Interpol said nearly 24,000 cases of cybercrime were solved and investigators blocked more than 31,000 bank accounts linked to malicious activity during the crackdown.

Authorities involved in the globally coordinated operation seized a high volume of devices and other equipment used to allegedly facilitate cybercrime. 

In Eswatini, police seized a replica of a Brazilian police station, including fake uniforms, signage and equipment that cybercriminals allegedly used to deceive targets into thinking they were victims of a crime, duping them into transferring funds.

While uncovering a romance scam money laundering operation in Thailand, investigators identified a 20-year-old suspect that allegedly processed more than $122.5 million in 10 months, according to Interpol. Officials in Palau identified and deported 22 people allegedly involved in a pair of scam centers operating from hotels.

“Interpol is dedicated to supporting member countries in building a comprehensive, coordinated strategy to tackle cyber-enabled financial crimes, organized criminal networks and the money laundering that fuels them,” Kaya said.

The post Interpol cybercrime crackdown nets 5,800 arrests across 97 countries appeared first on CyberScoop.

In recent years, the landscape of cyber scams has evolved, targeting even the tools designed to protect consumers. One such concerning development involves the exploitation of trusted services to mislead and scam users. This article explores a specific case in which scammers may have taken advantage of these services to deceive users into divulging sensitive information, leading to potential financial losses and identity theft.

The Mechanics of the Cyber Scams

At the core of this issue lies a highly sophisticated cyber scam that exploits the trust consumers place in services that were designed to alert users regarding suspicious activities or data breaches. In this case, however, scammers have managed to breach the very systems intended to safeguard user identities. Here’s how the scam operates:

1. Compromised Alerts: Users receive seemingly legitimate alert emails from a trusted organization, notifying them of potential security issues. These emails include clickable links that direct users to what appear to be secure websites.
2. Redirects to Malicious Sites: Upon clicking the link, users are redirected to malicious domains designed to look like legitimate websites or are taken directly to scam sites hosted on platforms like Telegram. These sites may request further sensitive information under the guise of security checks or offer downloads that contain malware.
3. Exploitation of User Trust: The effectiveness of this scam lies in its exploitation of user trust. Since the alerts originate from a trusted source, users are more likely to click on the links without their usual level of scrutiny. This bypasses standard phishing detection mechanisms, which often filter out emails from suspicious or unknown sources.

Indicators of Deceptive Practices

Several red flags were identified during the investigation into these compromised alerts:

• Clickable Links in Alerts: Unlike more secure practices adopted by other identity protection services, some alerts include clickable links. This practice is risky because it can easily be exploited to redirect users to malicious sites.
• Use of Scam Domains: The domains used in these alerts were found to be registered for the explicit purpose of hosting scam operations. For example, one domain redirected users to a Telegram channel that further directed them to malicious downloads or additional scams.
• High Click-Through Rates: Analysis of traffic to these scam domains revealed a substantial number of users clicking through from these alerts. This suggests a significant exploitation of these alerts, driving traffic to malicious sites and potentially resulting in a high number of compromised users.

Potential Implications and Risks of Cyber Scams

The consequences of this scam could be far-reaching:

• Financial Loss: Users deceived by these scams might inadvertently provide sensitive information such as banking details, leading to financial fraud or unauthorized transactions.
• Identity Theft: The exposure of personal information can lead to identity theft, where attackers use the information to open new accounts, make purchases, or engage in other forms of fraud.
• Malware Infections: Users who download files from these scam sites could infect their devices with malware, further compromising their security and potentially leading to data loss or additional breaches.

Conclusion: How Constella Intelligence Leads the Way in Combatting These Threats

At Constella Intelligence, we’ve recognized the growing sophistication of scams targeting identity protection services and have implemented advanced mechanisms to safeguard our users.

Our systems incorporate a robust verification and curation process, designed to detect and mitigate these types of fraudulent attacks before they reach our customers. In line with the rigorous standards we detail in our blog Verifying the National Public Data Breach, we employ advanced data validation and monitoring techniques to ensure every alert is legitimate and free from manipulation. By continuously monitoring for suspicious patterns and ensuring that all alerts are authentic, we provide the most secure identity protection available on the market. As the leading identity protection provider, we’re committed to staying ahead of emerging threats and maintaining the trust our users place in us to protect their personal information.

Recommendations for Users

To safeguard against potential scams and enhance online security, consider the following steps:

1. Avoid Clicking on Links in Emails: Even if the email appears to be from a trusted source, manually navigate to the company’s official website instead of clicking on links in the email. This reduces the risk of being redirected to a malicious site.
2. Use a Password Manager: A password manager can help generate and store complex, unique passwords for each of your accounts, reducing the risk if one service is compromised.
3. Monitor Your Accounts Regularly: Frequently check your bank statements and credit reports for any unauthorized activity. Early detection of suspicious activity can prevent more significant financial losses.
4. Enable Multi-Factor Authentication (MFA): Whenever possible, use MFA on your online accounts. This adds an additional layer of security by requiring multiple forms of verification.

By following these recommendations, users can better protect themselves from the increasingly sophisticated tactics employed by scammers to exploit even the most trusted services.