450 Employees, an HR Department, and €50 Million Stolen: Inside the Fraud Call Centre That Ran Like a Company

The Detail That Should Change How You Read a Scam

Buried in the Europol and Eurojust announcement of a €50 million online fraud takedown is a sentence that deserves more attention than the money figure.

The criminal network operated several call centres in Tirana, Albania, where up to 450 employees worked across organised departments — teams dedicated to customer acquisition, customer service, management, finance, IT, human resources, and back-office support.

Read that list again. It is an org chart. Not a metaphorical one — an actual division of labour with an HR function, meaning the enterprise had hiring, onboarding, scheduling and payroll problems significant enough to require dedicated staff.

The coordinated action day took place on 17 April 2026, following a joint investigation spanning more than two years. Ten people were arrested in Tirana, three call centres and nine private homes were searched, and authorities seized nearly EUR 900,000 in cash along with substantial IT infrastructure.

How the Case Was Built

The investigation began where the victims were, not where the criminals were.

Austrian authorities opened it around June 2023 because of the sheer number of victims identified in Vienna. In April 2024, working through Europol, they approached Albanian authorities with a request for information on an IP address the perpetrators were suspected of using — and it resolved to Albania.

Victims were eventually identified across Italy, Germany, Greece, Spain, Canada and the United Kingdom as well as Austria. That distribution is not incidental. It reflects a business making deliberate market choices: which countries to sell into, in which languages, with which regulatory stories.

What the Departments Actually Do

The corporate structure is not decoration. Each function maps to a specific stage of extracting money from a person, and knowing the map tells you what you are looking at.

Customer acquisition is the advertising and cold-contact layer — social media ads, sponsored investment “news” articles, lead lists purchased from other criminals, and the first call. This is where the polished trading platform screenshots and the celebrity-adjacent branding originate.

Customer service is the part that catches people out, because it is genuinely good. Once you have deposited, someone attentive and competent answers your questions, walks you through the dashboard, and returns your calls. This is the single most disorienting feature of modern investment fraud: the service is better than your actual bank’s.

Finance manages the flow of victim money and, critically, the small early withdrawals. Letting you take €500 out of a €5,000 “gain” is a deliberate expense — it converts scepticism into confidence and typically precedes the request for a much larger deposit.

IT builds and maintains the fake trading platform: real-time-looking price feeds, portfolio balances, tax statements, and a login that works from your phone. None of the numbers correspond to any market activity.

Back office handles the endgame — the fees. Withdrawal fees, “liquidity” fees, tax clearance, anti-money-laundering compliance charges. Each one is a fresh extraction from a victim who has already concluded they must pay to recover what they believe they own.

HR recruits and manages the 450 people who sit in these seats.

The Uncomfortable Question About Those 450 People

Ten arrests against up to 450 employees is a ratio worth sitting with, and it reflects a real distinction rather than an enforcement failure.

A significant share of staff in operations like this answered ordinary job advertisements for sales or customer support roles. Some understood what they were doing quickly. Some were told they were selling legitimate financial products for an offshore brokerage. Prosecutions concentrate on organisers, controllers of the money, and those who can be shown to have known.

This is also the point at which European boiler-room fraud differs sharply from Southeast Asian scam compounds. The Tirana workforce was, as far as the case describes, employed rather than trafficked — people who came to work and went home. The compounds in Myanmar and Cambodia run on forced labour behind fences. Same industry, very different human cost, and very different enforcement problems.

Why Professionalism Is the Warning Sign

The instinctive model of a scam is amateurish: bad spelling, an urgent stranger, an obvious lie. That model actively endangers people now, because it teaches them that competence equals legitimacy.

An operation with 450 staff and an IT department produces materials that are indistinguishable from a real financial services firm on every surface a consumer can inspect. The website is professional. The documents are formatted. The person on the phone is patient, knowledgeable and calls when they say they will.

None of that is evidence of anything. The only things that separate a regulated firm from a criminal one are structural, and they are all checkable — which is what makes them the right place to look.

Protecting Yourself

Verify the licence before the pitch, not after. Every legitimate investment firm in Europe is on a national regulator’s public register — the FCA in the UK, BaFin in Germany, CONSOB in Italy, CNMV in Spain, the FMA in Austria. Search the register yourself. Do not follow a link the firm gives you; clone websites of licensed firms are standard practice.

Treat an unsolicited investment contact as disqualifying, whatever it is. No legitimate brokerage finds you through a social media ad, a WhatsApp group, or a cold call and then asks for a deposit. Acquisition departments exist precisely because the pipeline starts with a stranger.

Understand that a successful small withdrawal proves nothing. It is a marketing cost with a line item. The pattern — deposit, gain, small withdrawal succeeds, large deposit encouraged — is close to diagnostic.

Any fee required to release your own money is fraud. Withdrawal fees, tax clearance, AML compliance charges, “liquidity releases.” Real brokerages deduct costs from the balance; they never require an inbound payment to let funds out.

Check where the money is actually going. If the account name on the transfer does not match the firm’s name, or funds are routed to a personal account, a payment processor in a third country, or a crypto address, stop there.

If you are already in, stop paying immediately and report. Contact your bank the same day — recovery is possible while funds are still in the first receiving account — and file with your national police and with Europol’s national reporting channels.

Expect the recovery scam. Victim lists are traded, and the follow-up call offering to retrieve your losses for an upfront fee is a second business built on the first.

The Tirana case is a reminder that the question “does this feel like a scam?” has stopped being useful. The relevant question is narrower and far more answerable: is this firm on the register, and can I confirm that myself?