Operation Serengeti III Arrests 1,462 as Africa’s Cybercrime Losses Rise Above $385 Million

African law enforcement agencies have arrested 1,462 suspects, disrupted 10,909 malicious cyber networks and recovered more than US$105 million in illicit funds in one of the continent’s largest coordinated cybercrime operations, but the financial evidence behind Operation Serengeti III suggests that the significance of the crackdown extends well beyond the number of arrests. INTERPOL says investigators linked the criminal activity uncovered during the operation to more than US$385 million in financial losses and identified 65,929 victims, while cases ranged from investment fraud and business email compromise to malicious lending applications, cryptocurrency enabled laundering and transnational scam centres. The operation ran from June 29 to August 31, 2026 and involved authorities from 21 countries, including Tanzania, Kenya, Uganda, Rwanda, Nigeria, South Africa, Ghana, Zambia and the United States. The numbers provide another indication that cybercrime in Africa is becoming less like a collection of isolated internet scams and more like an organised economic activity operating across payments systems, telecommunications networks, cryptocurrency infrastructure and national borders. INTERPOL’s African Cyberthreat Assessment 2026 estimates that reported cybercrime-related losses across Africa have more than doubled from about US$192 million in 2024 to US$484 million, while artificial intelligence is now involved in an estimated 55 percent of reported cybercrime on the continent. The same assessment identifies East Africa as a significant centre for mobile money fraud and ransomware targeting infrastructure, making Operation Serengeti III particularly relevant to economies where digital payments have expanded much faster than the investigative systems required to trace money across banks, telecom operators, cryptocurrency platforms and jurisdictions. Operation Serengeti III also shows how quickly the scale of coordinated cybercrime enforcement in Africa has increased. The first Operation Serengeti in 2024 involved 19 African countries, resulted in 1,006 arrests and identified more than 35,000 victims in cases associated with almost US$193 million in losses. Serengeti 2.0 followed between June and August 2025, resulting in 1,209 arrests, almost 88,000 identified victims and US$97.4 million recovered. The third operation has now pushed arrests to 1,462 and recoveries above US$105 million, although the numbers across the three operations cannot simply be added together as a measure of Africa’s cybercrime economy because investigations, victims and infrastructure can overlap and each operation used different operational targets. What the sequence does demonstrate is that INTERPOL and African law enforcement agencies are treating cyber-enabled financial crime as a sustained transnational enforcement problem rather than an occasional policing exercise. Uganda’s 365 Arrests Show How Industrialised Online Fraud Has Become One of the clearest examples of that shift came from Uganda, where authorities dismantled two transnational fraud rings and arrested 365 foreign nationals linked to online investment and pension fraud targeting victims in Asia. INTERPOL says investigators found an organised call centre model in which operators used prepared scripts, fraudulent websites and fake trading platforms to persuade pensioners to transfer money into investments that did not exist. The structure resembles legitimate financial sales operations closely enough to demonstrate why modern cybercrime can no longer be understood simply as individuals sending fraudulent messages from laptops. Criminal networks increasingly require recruiters, call centre workers, payment accounts, websites, technical infrastructure, money laundering channels and managers capable of coordinating activity across countries. The Ugandan case also illustrates a geographic characteristic of modern cybercrime that makes conventional policing difficult. The people operating a scam centre can be physically located in one African country, originate from several others, target victims in Asia or Europe, host websites elsewhere and move proceeds through banking and cryptocurrency systems spread across multiple jurisdictions. A national police investigation can therefore identify the location where part of the crime is being committed without controlling the infrastructure or money flows required to dismantle the entire operation. INTERPOL Cybercrime Director Neal Jetton described cybercrime networks as operating “without regard for borders” and argued that international cooperation remains one of the most effective ways to dismantle infrastructure and recover criminal assets. This cross-border structure also helps explain why private cybersecurity companies were deeply involved in the operation. INTERPOL says Group IB, Kaspersky, Fortinet, Team Cymru, Uppsala Security, Cybercrime Atlas, Meta, the Global Anti Scam Alliance and Zimbabwe’s telecommunications regulator provided intelligence, technical analysis or operational support. Before enforcement activity began, investigators received intelligence on suspicious domains, IP addresses and command and control infrastructure associated with criminal activity, allowing police agencies to start from identified technical relationships rather than treating every complaint as an isolated case. Team Cymru has said that infrastructure intelligence can reveal how malicious systems are connected and reused, allowing authorities to identify networks rather than waiting for individual attacks to occur. Tanzania Was Among the Countries Where Criminal Digital Infrastructure Was Dismantled Tanzania participated in Operation Serengeti III alongside Kenya, Uganda and Rwanda, with INTERPOL reporting that Tanzanian authorities dismantled a scheme involving a malicious mobile lending application. Public details released so far are limited compared with the larger operations in Uganda, Nigeria and Angola, but the Tanzanian case is economically relevant because mobile lending combines several areas where East African economies have digitised particularly rapidly: mobile payments, digital identity, smartphone applications and consumer credit. When those systems are exploited by fraudulent operators, victims can lose money while criminals potentially obtain personal data, payment credentials or access to broader financial networks. INTERPOL’s wider cyber threat assessment already identifies East Africa as particularly exposed to mobile money fraud, which is unsurprising given the region’s adoption of mobile payments. Digital financial infrastructure has lowered transaction costs, expanded financial inclusion and allowed millions of consumers and businesses to transfer money without relying entirely on banks, but those same systems create attractive targets because successful fraud can be monetised quickly. Criminals do not need to steal physical cash when money can move through mobile wallets, bank accounts, cryptocurrency exchanges and payment applications within minutes, while differences in reporting systems between financial institutions can give fraudsters enough time to layer or withdraw proceeds before investigators intervene. The economic cost therefore extends beyond money stolen directly from victims. Businesses must spend more on cybersecurity, banks and telecommunications companies have to strengthen monitoring and fraud detection, regulators face pressure to impose additional compliance requirements and consumers can become less willing to trust digital financial products. For countries such as Tanzania, Kenya, Uganda and Rwanda that increasingly depend on digital payments as infrastructure for commerce rather than merely as consumer conveniences, cybercrime becomes an economic competitiveness problem because the value of a digital economy depends partly on whether people believe transactions, identities and financial accounts can be trusted. Nigeria Shows How Cybercrime Can Reach Millions Before Authorities Intervene In Nigeria, investigators arrested a suspect associated with a phishing and business email compromise operation that had accumulated approximately 2.1 million email addresses and harvested software credentials. A separate Nigerian case involved an international investment fraud promoted through messaging applications, where investigators traced more than US$2.4 million in suspected criminal proceeds, much of which had moved through cryptocurrency transactions. The combination of credential theft, fraudulent communications and cryptocurrency laundering illustrates how different forms of cybercrime increasingly operate as parts of the same financial chain rather than separate offences. Business email compromise is particularly economically damaging because criminals often target legitimate commercial payments rather than small individual transfers. Attackers may impersonate executives, suppliers or business partners and convince finance departments to redirect payments into accounts controlled by criminals. Artificial intelligence makes these schemes easier to scale because fraudulent emails can be written convincingly, translated quickly and adapted to the language and circumstances of specific targets. INTERPOL says AI is increasingly being used across the cyberattack process, including reconnaissance, phishing, extortion and evasion, while synthetic identities combining real and fabricated information are being used to bypass financial verification systems, register SIM cards, access mobile loans and open accounts. The economics of AI enabled fraud differ from traditional fraud partly because automation reduces the cost of attempting an attack. A criminal does not need every phishing email or investment message to succeed when software can generate and distribute extremely large numbers of highly personalised communications. The cost of approaching another thousand potential victims becomes very small while the potential return from even a few successful transfers remains substantial. This creates the same scaling effect that digital technologies provide to legitimate businesses, except that criminals can apply it to fraud, extortion and identity theft. Angola’s Illegal Crypto Mines Show That Cybercrime Can Consume Physical Infrastructure Operation Serengeti III also included a different type of digital crime in Angola, where investigators dismantled two illegal cryptocurrency mining centres, arrested nine suspects and seized more than 2,000 mining devices together with six illegal electricity transformation stations. INTERPOL valued the seized electrical infrastructure alone at more than US$1 million. The case demonstrates that some forms of cyber related crime impose costs through physical resources as well as stolen money, particularly where cryptocurrency mining operations obtain electricity illegally or operate outside licensing and taxation systems. Large cryptocurrency mining facilities require substantial amounts of electricity, which can create direct costs for utilities and consumers where operators connect illegally or avoid paying the full cost of the power they consume. The distinction is important because not all cryptocurrency mining is criminal; legitimate mining businesses can operate legally where national regulation permits it. The Angolan operation concerned illegal facilities and infrastructure, making the relevant issue the way digital economic activity can intersect with electricity theft, unauthorised equipment and financial crime rather than cryptocurrency technology itself. The operation therefore covered a much wider economic landscape than conventional hacking. INTERPOL investigators targeted online investment schemes, fake trading platforms, BEC operations, malicious lending applications, social media vehicle import scams, cryptocurrency laundering and illegal mining infrastructure. The common element was not a particular technology but the use of digital networks to move, conceal or extract economic value across borders. The $105 Million Recovered Is Significant, but Most Losses Were Not Recovered The relationship between the US$105 million recovered and the more than US$385 million in losses linked to Operation Serengeti III is economically important. The recovered amount is equivalent to roughly 27 percent of the losses associated with the investigated criminal activity, although the two numbers should not be treated as a precise recovery ratio because INTERPOL does not state that every dollar in the loss estimate corresponds directly with the pool of assets authorities attempted to recover. Some investigations remain active, additional suspects are still being identified and authorities continue tracing illicit proceeds and analysing seized digital evidence. Even with that qualification, the gap illustrates one of the persistent problems in financial cybercrime: identifying the crime does not necessarily mean recovering the money. Criminal proceeds can move rapidly through accounts, money transfer services, cryptocurrency wallets and multiple jurisdictions before victims or institutions realise what has happened. By the time police receive a complaint, the funds may have been divided among numerous accounts, converted into different assets or moved to jurisdictions where recovery requires additional legal processes. This is why real time coordination between banks, telecommunications companies and law enforcement agencies has become increasingly important. INTERPOL’s 2026 assessment identifies the absence of rapid inter agency information sharing as a major weakness in African cybercrime response, because financial institutions can detect suspicious movement while telecom operators hold identity and communication information and police possess investigative powers, yet those pieces of information do not always move between institutions quickly enough to stop a transaction before the money disappears. Africa’s Digital Expansion Is Increasing Both Economic Opportunity and Criminal Opportunity The scale of the cybercrime problem should be understood alongside the expansion of Africa’s digital economy. INTERPOL estimates that the continent recorded more than 1.1 billion mobile subscriptions in 2025, while digital payments, e commerce, mobile lending, online investment platforms and social networks are becoming increasingly embedded in economic activity. That growth creates a larger pool of transactions and identities for legitimate companies to serve, but it also provides cybercriminals with a larger addressable market. INTERPOL says 72 percent of the African countries surveyed for its 2026 assessment reported the presence of scam centres, with particularly high concentrations in Southern and West Africa, while financial losses associated with cybercrime have increased sharply. The institution estimates losses at US$484 million, compared with US$192 million in 2024, although these figures should not be interpreted as the full economic cost of cybercrime across Africa because substantial amounts of fraud are never reported and different countries have uneven data collection capacity. The direction is more important than pretending the available numbers provide a complete continental estimate. Cybercrime is expanding into an economic sector with specialised labour, technical infrastructure, payment mechanisms and international networks. Scam centres can employ hundreds of people, phishing operations can target millions of accounts and fraudulent platforms can be designed to resemble legitimate investment companies closely enough to persuade victims to transfer significant amounts of money. Some operations also overlap with human trafficking, where individuals are recruited or transported and then compelled to work inside scam centres, adding another organised crime dimension to what initially appears to be an online financial offence. The Uchumi360 Insight Operation Serengeti III demonstrates that Africa’s cybercrime challenge is increasingly about the infrastructure of the digital economy rather than simply the behaviour of individual hackers. The same systems that make legitimate commerce faster, including mobile money, instant communications, online lending, cryptocurrency, social media and cross border digital payments, also allow criminals to approach more victims, move money rapidly and operate across several jurisdictions without maintaining a conventional physical presence in the country where the victim is located. The enforcement response is also becoming more sophisticated. Investigators from 21 countries were supported by private cybersecurity companies supplying data on domains, IP addresses, criminal accounts and command infrastructure, while financial investigations were used to trace proceeds rather than concentrating only on identifying the individuals responsible for attacks. This approach reflects the economics of organised cybercrime: arresting one operator has limited value if the websites, financial channels, call centres, malware infrastructure and replacement personnel that sustain the business remain intact. The three Serengeti operations since 2024 also show that large scale enforcement has not eliminated the underlying market. More than 1,000 arrests were recorded in the first operation, another 1,209 in Serengeti 2.0 and 1,462 in the latest operation, while the financial losses connected to investigated activity remain substantial. That should not be interpreted as evidence that enforcement has failed, because arrests and asset recovery can impose significant costs on criminal networks, but it does indicate that the incentives remain attractive enough for new actors and infrastructure to emerge. For African governments, banks, telecom companies and technology platforms, the economic policy challenge is therefore to increase the cost and difficulty of cybercrime faster than digitalisation increases the number of opportunities available to criminals. That will require faster sharing of fraud data, stronger digital forensic capability, better identity verification, law enforcement officers capable of investigating AI enabled attacks and financial systems that can freeze suspicious transactions before money moves through several jurisdictions. Africa’s digital economy will continue expanding because the productivity gains from digital payments, mobile connectivity and online commerce are too important to reverse. Operation Serengeti III shows that protecting those gains will increasingly require cybersecurity to be treated not simply as an information technology issue but as part of the infrastructure required for financial stability, business confidence and economic growth. FAQ What is Operation Serengeti III? Operation Serengeti III is an INTERPOL coordinated cybercrime enforcement operation conducted between June 29 and August 31, 2026, involving law enforcement authorities from 21 countries. How many people were arrested during Operation Serengeti III? Authorities arrested 1,462 suspects across participating countries. How much money was recovered? INTERPOL says authorities recovered more than US$105 million in illicit funds, while investigated criminal activity was linked to losses exceeding US$385 million. How many victims were identified? Authorities identified 65,929 victims targeted by the cybercriminal networks investigated during the operation. Did Tanzania participate in Operation Serengeti III? Yes. Tanzania was among the participating countries, and INTERPOL says authorities dismantled a malicious mobile lending application scheme in the country. What happened in Uganda? Ugandan authorities dismantled two transnational fraud operations and arrested 365 foreign nationals linked to online investment and pension fraud targeting victims in Asia. What types of cybercrime did the operation target? The operation targeted cyber enabled fraud, ransomware, business email compromise, online scams, digital extortion, investment fraud, malicious lending applications and cryptocurrency related criminal activity. How important is artificial intelligence to cybercrime in Africa? INTERPOL’s African Cyberthreat Assessment 2026 says AI is involved in approximately 55 percent of reported cybercrime across the continent and is increasingly used for phishing, reconnaissance, social engineering, extortion and evasion. How large are cybercrime losses in Africa? INTERPOL estimates reported cybercrime related losses increased from approximately US$192 million in 2024 to US$484 million, although the actual economic cost is likely broader because not all cybercrime is detected or reported.