The Operation
Operation Jackal IV, coordinated by INTERPOL between November 2025 and June 2026, brought together 22 countries across six continents to target West African organised crime groups engaged in cyber-enabled financial fraud.
The results were announced in August 2026: 58 arrests and 263 persons of interest identified, linked to online scams, money laundering and associated offences.
The country-level detail shows what these networks actually look like on the ground:
- South Africa: 39 arrests. Authorities raided seven locations in Johannesburg tied to romance and investment scams, seized $2.67 million and froze 257 bank accounts.
- Romania: 11 arrests, with €330,000 in cash and cryptocurrency recovered along with six properties and luxury watches. INTERPOL estimates roughly €143 million has been stolen and laundered through Romanian-run investment scams worldwide.
- Argentina: 17 arrests in what investigators described as a Crime-as-a-Service operation.
- Italy: a single laundering account was found to have moved €845,000.
INTERPOL links much of this activity to groups including Black Axe, which it describes as connected to a large share of the world’s cyber-enabled fraud.
What 257 Frozen Accounts Tells You
The South African figures deserve a second look, because the ratio between them is the story.
Thirty-nine people. Two hundred and fifty-seven accounts.
That is not thirty-nine people with a bank account each. It is an infrastructure — a managed inventory of receiving accounts, opened in recruited or stolen names, rotated as they are flagged, distributed across institutions so no single bank sees a pattern.
This is the laundering layer, and it is the part of fraud that cannot be automated. Someone has to open the accounts, hold the identity documents, service the compliance calls, and physically move funds. It is also, consistently, the layer where arrests happen, for the same reason: the money has to be somewhere real, and so does the person moving it.
The Crime-as-a-Service characterisation in Argentina points at the same industrialisation from another angle. These networks no longer require each cell to build its own capability. Account access, laundering routes, scripts, phishing kits and lead lists are bought and sold between groups. A romance scam operator does not need to know how to launder money; they need to know who does.
The Trend INTERPOL Chose to Highlight
Alongside the arrest figures, INTERPOL flagged something described as a troubling new development: these syndicates are increasingly targeting minors — some as young as 14 — through sextortion schemes.
The mechanic is described plainly. Offenders contact minors through social media, build trust over a period, coerce them into sharing explicit images or video, and then demand ransom payments under threat of distributing the material to family, classmates and followers.
It is worth being precise about why a fraud network diversifies into this. It is not a departure from their existing business. It is an efficiency.
The infrastructure is already built: fake profiles at scale, social engineering scripts, an established rapport-building methodology honed on romance fraud, and a laundering pipeline waiting to receive proceeds. Retargeting from lonely adults to teenagers requires new scripts, not new capability.
And the conversion economics are, from the criminal’s perspective, better. Romance fraud takes months to reach a payment. Sextortion of a frightened 15-year-old reaches a payment demand within hours of the first image, and the coercion is more reliable than persuasion because the victim’s motivation is terror rather than affection.
The consequences are correspondingly worse. Financial sextortion of minors has been linked to suicides in multiple countries, and it is now one of the fastest-growing crimes against children reported by law enforcement worldwide.
Protecting Yourself
For adults facing romance and investment approaches:
An unsolicited contact who moves quickly to a private channel is running a script. The migration from a dating app or social platform to WhatsApp or Telegram happens early because it escapes platform moderation.
Reverse image search every profile photograph, and insist on an unscheduled live video call with an unusual request. This is not conclusive against deepfakes, but it still defeats most operations.
Any investment introduced by a romantic interest is fraud. There is no exception to this. The frozen accounts in Johannesburg were fed by exactly this pipeline.
For parents, and for the teenagers themselves:
Say the crucial thing out loud, in advance, before it is needed: if this happens, you are not in trouble and I will help you. Sextortion works on the certainty that the young person cannot tell an adult. Removing that certainty in advance is the most effective single intervention available to a parent.
If it has already happened: do not pay, and do not delete anything. Paying reliably produces further demands — this is documented in overwhelming numbers of cases. Block the account, preserve screenshots, usernames and the full conversation, and report immediately.
Report to the platform and to law enforcement the same day. In the US, report to the FBI at ic3.gov and to NCMEC’s CyberTipline; NCMEC’s Take It Down service can help remove images of minors from participating platforms. In the UK, report to the IWF and CEOP. Elsewhere, national police cybercrime units and INTERPOL member channels.
Know that content removal is possible. The threat “this will be online forever” is part of the coercion, and it is frequently untrue for reported material involving a minor.
Talk about it as a crime committed by an organised business, not as a personal failure. Jackal IV is the evidence for that framing: the person on the other end was not a peer who took advantage. It was a syndicate with a laundering department in Johannesburg and 257 bank accounts.
Fifty-eight arrests against a global fraud economy is not a solved problem. But the operational picture is now much clearer — and the warning about minors was published for a reason.
