{"meta":{"database":"Global Social Engineering Impact Database","license":"CC BY 4.0 — attribute to Netarx Social Engineering Incident Database","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2025-interpol-operation-serengeti-2-0-nets-1-209-arrests-over-bec-and-romance"},"incident":{"slug":"2025-interpol-operation-serengeti-2-0-nets-1-209-arrests-over-bec-and-romance","title":"Interpol Operation Serengeti 2.0 nets 1,209 arrests over BEC and romance fraud","date":"2025-08","date_precision":"month","year":2025,"victim_org":"Approximately 88,000 victims across 18 African countries and the UK","sector":"Other","country":"Multiple","primary_vector":"Business Email Compromise","secondary_vectors":["Romance / Investment Scam","Spear Phishing (Email)"],"ai_involvement":"No AI reported","ai_notes":"","outcomes":["Wire Fraud / Financial Loss","Identity Theft"],"loss_usd":485000000,"loss_kind":"aggregate","loss_note":"Interpol put victim losses across the operation at about $485 million, with roughly $97.4 million recovered.","records_affected":null,"threat_actor":null,"summary":"Interpol announced in August 2025 that Operation Serengeti 2.0, conducted from June to August across 18 African countries and the UK, led to 1,209 arrests, the dismantling of 11,432 malicious infrastructures and the recovery of about $97.4 million. The operation targeted ransomware, business email compromise, online scams and investment fraud affecting some 88,000 victims, with total losses estimated at roughly $485 million.","how_it_worked":"The networks disrupted ran industrialised deception. Business email compromise crews compromised or spoofed corporate mailboxes, watched invoice threads, then sent payment-diversion instructions from an address one character off the real one, timed to arrive when a genuine payment was due. Romance and investment crews cultivated victims over weeks on dating and messaging apps before introducing fake trading platforms that displayed fabricated gains to encourage larger deposits. In both cases the trust signal abused was an established relationship, commercial or personal, and the pressure was a closing window: a supplier deadline, or a limited investment opportunity.","lessons":"Verified callback to a previously known phone number before any change of bank details, and platform-level friction on first-time large transfers to new payees, cut the largest share of these losses.","confidence":"Confirmed","sources":[{"title":"African authorities dismantle massive cybercrime and fraud networks, recover millions","url":"https://www.interpol.int/en/News-and-Events/News/2025/African-authorities-dismantle-massive-cybercrime-and-fraud-networks-recover-millions","publisher":"Interpol"},{"title":"Massive anti-cybercrime operation leads to over 1,200 arrests in Africa","url":"https://www.bleepingcomputer.com/news/security/massive-anti-cybercrime-operation-leads-to-over-1-200-arrests-in-africa/","publisher":"BleepingComputer"}],"entry_type":"campaign","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2025-interpol-operation-serengeti-2-0-nets-1-209-arrests-over-bec-and-romance"}}