The criminal group had set up a technically sophisticated infrastructure for a series of fraud schemes, which they offered as a service to other perpetrators. Their online service provided telephone numbers from over 80 countries for criminal activities. The entire infrastructure allowed fraudsters to set up fake accounts on social media and other communication platforms to perpetrate the scams. They set up close to 50 million fake accounts for this purpose. 

The frauds perpetrated or enabled by the network included:

• Fraud involving the sale of second-hand goods online: Perpetrators used fake or hacked accounts to pretend to be interested in buying goods, luring victims away from secure platforms and circumventing monitoring mechanisms. Victims were then sent phishing links to professionally looking fake sites in order to obtain personal data or bank account information and steal money from accounts.
• Daughter-and-son scam via WhatsApp: Perpetrators pretended to be the daughter or son of individuals, stating they had to use a new phone number due to an emergency. Parents were then asked to make urgent payments.
• Investment fraud: Fake investment websites were set up, and once serious investors showed interest, they were encouraged to pay considerable sums for alleged good business opportunities.
• Fake online shops and bank websites: Rented phone numbers of suspects and other perpetrators were often used in legal notices and as contact details for fake shops and counterfeit bank web pages.
• Posing as fake police officers over the phone: Perpetrators used the phone numbers obtained through the criminal infrastructure to call mainly Russian-speaking victims under the pretence of being police officers to establish contact. Subsequently, victims were approached in person with forged police identification in order to collect money. 

In Austria, over 1 700 customers fell victim to the fraud, as did at least 1 500 in Latvia. To tackle the criminal network, Eurojust supported and financed a joint investigation team (JIT) between the Austrian, Estonian and Latvian authorities. Further assistance was provided by the Finnish authorities.

Eurojust also coordinated a joint action day, during which arrests were made and 26 places were searched. Authorities seized 1 200 SIM box devices used for the scams, as well as 40 000 SIM cards and 4 luxury cars. Over EUR 700 000 was frozen, 5 servers were seized and 2 websites were taken over by law enforcement. Europol deployed a team of specialists to Riga to assist the Latvian authorities, facilitating cooperation with the ShadowServer Foundation. It also provided analytical support. 

The actions were carried out at the request of and by the following authorities:

• Austria: Public Prosecutor’s Office (PPO) Vienna; Federal Criminal Intelligence Service; Criminal Investigation Department Salzburg
• Estonia: Estonian Police; Northern District Prosecutor’s Office
• Latvia: Riga Judicial Region Prosecution Office; Riga Northern Prosecution Office; Latvian State Police
• Finland: National Cyber-Enabled Crimes Units (NCCU Finland); National Bureau of Investigations (Keskusrikospoliisi)