In the early hours of 18 April 2024, German, Albanian, Bosnian-Herzegovinian, Kosovar* and Lebanese police forces raided 12 call centres identified as the source of thousands of daily scam calls. 21 persons were taken into custody during this Europol-supported action day, which took down a criminal network responsible for defrauding thousands of victims through the use of various modus operandi. The callers’ playbooks would range from shocking fake police calls, persuasive investment fraud or heart-wrenching romance scams. In an unprecedented law enforcement effort, a large-scale German investigation evolved into Operation PANDORA, which identified 39 suspects.

Operation PANDORA started with a bank teller in Freiburg, Germany. When in December 2023 a customer asked to withdraw over EUR 100 000 in cash, the bank teller grew suspicious and quickly learned the customer had fallen victim to a ‘fake police officer scam’. He informed the real police, which prevented the victim from handing the money over to the fraudsters.

Instead receiving the massive sum of cash, the collectors were arrested by Freiburg Police (Polizeipräsidium Freiburg) officers. Subsequently, surveillance was placed on the victim's phone line. Looking into this individual case, investigators soon realised that the telephone numbers used by the perpetrators could be linked to over 28 000 scam calls in only 48 hours.

From fake investment opportunities to shock calls

As the investigation expanded, it was handed over to the Baden-Württemberg State Criminal Police Office (Landeskriminalamt Baden-Württemberg), which was supported by the Federal Criminal Police Office (Bundeskriminalamt) throughout the operation. Early findings showed that the perpetrators, located in a variety of countries, conducted all kinds of telephone fraud. Scam callers would pose as close relatives, bank employees, customer service agents, or police officers. Using a variety of manipulation tactics, they would shock and cheat their victims out of their savings. Ranging from fake promises of lottery pay-outs, investment opportunities, debt collection demands, prepaid card fraud, or shock-calls, scammers relentlessly targeted their next potential victims.

To learn more about how to protect yourself from scams such as these, read our cyber scam prevention guide.

As the investigation grew in size and complexity, law enforcement experts were closing in on call centres located in Albania, Bosnia-Herzegovina, Kosovo* and Lebanon. The criminal network responsible for the fraudulent calls set up its operation in a coordinated manner, focusing on a different priority in each country. While debt collection fraud was predominantly conducted from Bosnia-Herzegovina, online banking fraud calls were made from Kosovo. Investment fraudsters called mostly from Albania and the criminals specialised in prepaid card fraud sat at desks in Lebanon.

Countering call centres with a call centre

German investigators managed to track the actual conversations coming from the many call centres in real time. From December 2023 on, over a hundred officers were deployed around the clock in the Baden-Württemberg State Criminal Police Office and subsequently secured the content of over 1.3 million nefarious conversations. In consultation with the Freiburg Public Prosecutor's Office (Staatsanwaltschaft Freiburg) and later the Karlsruhe Public Prosecutor's Office (Generalstaatsanwaltschaft Karlsruhe), the aim was to prevent this crime throughout Germany.

The posted officers monitored up to 30 conversations of varying lengths at the same time. The State Criminal Police Office had set up its own call centre to counter the international criminal activities. Investigators worked in shifts and had one primary goal: to prevent fraud from happening. As soon as it materialised that anyone who had received a call could fall victim to the scams, the police reached out to warn potential victims.

In just four months, over 7 500 calls surpassed the threshold that warrants authorities to initiate criminal proceedings. In total, the deployed officers managed to prevent financial losses for the victims in over eighty percent of these indicted crimes. In total, the potential damages would have amounted to over EUR 10 million.

Swooping down on call centres

Apart from preventing crime, investigators mapped the locations where the calls were coming from. Obtaining information about the phone numbers, the owners, and the technical infrastructure such as servers, the plan was to eventually take down the perpetrators' entire call centre infrastructure. Europol supported this investigation by providing tailored analytical support, thus contributing to the overall intelligence picture.

Leading up to the action day, Europol hosted several operational meetings, providing operational coordination and financial support in preparation of the planned raids. When the time came to shut down the criminals’ operation across several countries, Europol hosted the operational coordination centre in its headquarters. Apart from providing operational support on the action day, Europol also deployed officers with mobile offices to locations abroad, thus facilitating the collection and analysis of forensic evidence.

Over 60 German law enforcement officers, supported by hundreds of their colleagues in Albania, Bosnia and Herzegovina, Kosovo* and Lebanon, as well as Europol specialists, swarmed dozens of residential and business premises. Apart from arresting 21 persons, officers were able to secure extensive evidence such as data carriers, documents, cash and assets amounting to EUR 1 million. A large number of electronic evidence was also seized, which should enable the investigating authorities to obtain information about possible further call centres and more fraudsters.

Participating countries:

Germany, Albania, Bosnia and Herzegovina, Kosovo*, Lebanon