INTERPOL’s $293 Million Fraud Operation: Lessons for Asset Tracing

A global operation coordinated by INTERPOL has demonstrated the scale of modern social-engineering fraud and the speed with which criminal proceeds can move across accounts, cryptocurrency wallets and international borders.

Operation First Light 2026 involved authorities in 97 countries and territories. INTERPOL reported that the operation led to 5,811 arrests and the interception of $293 million in illicit assets.

More than 142,000 victims were identified. Authorities also analysed 152,808 cases, blocked 31,014 bank accounts and identified 15,606 suspects. The operation ran from 15 January to 30 April 2026 and targeted social-engineering scams and associated money-laundering activity.

The cases uncovered during the operation included impersonation fraud, romance scams, investment fraud, business email compromise and cryptocurrency laundering.

They also highlight an important distinction. Blocking a payment, freezing an account, seizing an asset and returning money to a victim are separate outcomes. Asset tracing may help identify where funds moved and which parties or institutions became involved, but it does not itself freeze or recover money.

What Was Operation First Light 2026?

Operation First Light was an international enforcement initiative focused on fraud schemes that manipulate victims into transferring money or disclosing sensitive information.

Social-engineering fraud relies on trust, fear, urgency or authority rather than technical intrusion alone. Criminals may pose as police officers, government officials, banks, suppliers, romantic partners or investment advisers.

Once a victim transfers money, the proceeds may be moved through:

• Bank accounts controlled by money mules
• Shell companies
• Payment platforms
• Cryptocurrency wallets
• Exchanges and decentralised services
• Accounts in several jurisdictions
• Businesses used to disguise the source of funds

Participating authorities used criminal intelligence, searches, arrests, account restrictions and INTERPOL’s Global Rapid Intervention of Payments mechanism to disrupt these movements.

The operation shows that the fraud itself and the laundering of its proceeds are often parts of the same organised network.

A Global Network of Social-Engineering Fraud

The fraud types targeted by Operation First Light may appear different to victims.

A romance scam may involve months of emotional manipulation. Business email compromise may rely on a single false invoice. An impersonation scam may frighten someone into transferring money within hours.

Despite those differences, the underlying methods often share common features:

• A false identity or fabricated organisation
• A convincing explanation for the payment
• Pressure to act before checking independently
• Instructions to use a particular account or wallet
• Efforts to prevent the victim from speaking to others
• Rapid movement of the funds after payment
• Further requests once the first transfer succeeds

Money from multiple victims may then be combined, divided between accounts or converted into cryptocurrency.

This can make the financial trail more difficult to follow, particularly where money-mule accounts, false companies and cross-border transfers are involved.

The Fake Police Station Used to Deceive Victims

One of the most striking cases arose in Eswatini.

Authorities dismantled a network involved in impersonation scams, illegal online gambling and money laundering. During the operation, police seized 240 electronic devices, foreign currency and a realistic replica of a Brazilian police station, complete with uniforms, signs and equipment.

The fraudsters reportedly posed as members of Brazil’s Federal Police during video calls. Victims were told that they were involved in a criminal investigation and persuaded to transfer funds for supposed safekeeping. The money was then stolen.

The case demonstrates how physical sets, professional presentation and digital communication can be combined to create authority and credibility.

Victims should therefore verify unexpected claims through independently obtained contact details. Telephone numbers, websites and payment instructions supplied by the person making the allegation should not be treated as independent confirmation.

How Cryptocurrency Was Used to Move Fraud Proceeds

In Thailand, authorities identified an alleged money-laundering operation that moved proceeds from romance scams into different cryptocurrencies.

INTERPOL reported that the network used cross-chain token swaps in an apparent effort to obscure the financial trail. One wallet linked to a 20-year-old suspect had reportedly processed more than $122.5 million over ten months.

Moving funds between cryptocurrencies and blockchain networks can complicate analysis. Transactions may pass through:

• Several wallet addresses
• Centralised exchanges
• Decentralised exchanges
• Cross-chain bridges
• Stablecoins
• Mixing or privacy services

These steps do not necessarily make the movement impossible to analyse. Public blockchain records may still allow transactions to be mapped across relevant supported networks.

However, following the funds is not the same as identifying the person controlling each wallet. Attribution may depend on exchange records, bank information, communications, device data or legal disclosure.

How a $6.6 Million Fraudulent Transfer Was Blocked

Operation First Light also included a business email compromise case involving a commodity trading company in Singapore.

Criminals impersonated one of the company’s suppliers and directed a $6.6 million payment to a fraudulent account. Authorities in Singapore and Oman used INTERPOL’s rapid payment intervention mechanism to block the transfer before the funds settled.

The case demonstrates why speed matters after a suspicious corporate payment.

A business that discovers a potentially fraudulent transfer should promptly:

• Contact its bank through an official channel
• Request an urgent payment recall or fraud review
• Notify the genuine supplier separately
• Preserve the fraudulent invoice and payment instructions
• Retain the complete email headers and message chain
• Secure affected email accounts
• Record when the payment was authorised
• Report the matter to the appropriate authorities
• Obtain legal advice where the loss is substantial

A bank may not always be able to stop a transfer, particularly if the funds have already moved. Prompt reporting can nevertheless increase the available options.

Interception, Freezing, Seizure and Recovery Are Different

The $293 million figure reported by INTERPOL refers to illicit assets that were intercepted during the operation. It should not be interpreted as confirmation that the same amount was returned directly to victims.

The terminology describes different stages and powers:

Interception may include stopping or blocking a transfer before it is completed.

Freezing restricts dealings with an account or asset. This may be carried out by a bank, exchange, court or authorised public body.

Seizure involves an authority taking control of property under relevant legal powers.

Recovery refers to assets being legally or voluntarily returned, realised or applied for the benefit of a claimant or victim.

An asset trace may identify transactions, accounts, companies, wallets or property connected to the movement of funds. Further action usually depends on banks, exchanges, lawyers, courts or enforcement authorities.

How Asset Tracing Supports Cross-Border Enquiries

Cross-border fraud rarely involves only the account that first receives the victim’s payment.

Funds may be divided between several recipients, transferred into companies, converted into cryptocurrency or used to acquire other assets.

Asset tracing may help establish:

• The route taken by a payment
• Companies connected to relevant recipients
• Property or business interests
• Relationships between people and entities
• Cryptocurrency wallet activity
• Exchange or payment-provider touchpoints
• Jurisdictions requiring further enquiries
• Possible assets for legal advisers to consider

The availability and reliability of information differ between jurisdictions. Private banking records and complete investment holdings are not available through a universal public search.

For a broader explanation of the process and its limitations, see What Is Asset Tracing?.

What Businesses Can Learn from Operation First Light

The operation shows that fraud prevention cannot depend on one control alone.

Businesses should combine:

• Independent verification of payment changes
• Dual approval for significant transfers
• Staff training on impersonation tactics
• Secure email and account access
• Clear procedures for urgent payment requests
• Supplier and counterparty verification
• Rapid escalation of suspected fraud
• Accurate preservation of financial and digital evidence

No process can remove every risk. Strong controls can, however, make it harder for criminals to exploit urgency, trust or weaknesses in payment procedures.

Asset Tracing Services

Conflict International provides Asset Tracing Services for individuals, businesses, law firms and professional advisers dealing with fraud, disputed payments and cross-border asset concerns.

Our work may include transaction mapping, corporate and property research, connected-party analysis and cryptocurrency tracing where relevant.

Reports distinguish confirmed findings, apparent connections and matters that may require legal or institutional disclosure. Asset tracing cannot guarantee that money will be frozen or recovered, but it can provide intelligence to support informed reporting, legal and recovery decisions.

To discuss a cross-border fraud or asset-tracing matter in confidence, contact Conflict International.