How Do Cybercrime Takedowns Work? Inside Global Scam Raids

WarBrief Live | October 22, 2026 | Cybersecurity

In the past two weeks, law enforcement on two continents has announced two of the largest anti-scam operations ever run. The FBI says its global Operation Blackout has seized more than $17 billion in assets and cryptocurrency from overseas scam centres. And the United Arab Emirates says its Operation Confrontation Ghost — run with 30 countries, Interpol and 13 private-sector partners — identified more than $39 billion linked to fraud and thwarted 123.71 million fraud attempts in three months.

So how do cybercrime takedowns work — and why do the scam calls keep coming anyway? This article explains the four-part playbook investigators use. What agencies have confirmed is separated from what they have only claimed: several headline figures come from single-source announcements, and two directly contradict each other.

How do agencies actually take down a scam network?

A scam network is a business with four dependencies: people, infrastructure, money and victims — a takedown tries to break all four at once. Intelligence fusion comes first: OSINT, blockchain analytics, victim reports and private-sector telemetry. Meta, TikTok, Mastercard and Crypto.com fed data into the UAE-led effort; the FBI says Meta, Google, Microsoft and IBM helped its own campaign; the bureau warned 10,000+ Americans during Operation Blackout, mapping active compounds.

Infrastructure disruption is the technical core. On October 8, 2026, the Justice Department seized seven domains of the Chinese firm Integrity Technology Group — linked to the Flax Typhoon hacking network — under a court-approved warrant, pointing them at FBI-controlled servers. Days later, Brooklyn prosecutors and the FBI seized 241 crypto-scam websites and 112 servers after a three-year investigation tracing on-chain transactions to infrastructure in Ukraine and neighboring states. Microsoft’s disruption of billion-message phishing networks and the KillSec ransomware takedown ran the same playbook earlier this month.

The quietest weapon is the sinkhole: agencies intercept DNS requests for malicious domains and return a controlled IP, redirecting bot traffic to a law-enforcement server. That severs infected devices from their operators and logs infected hosts for victim notification — ENISA lists sinkholing as standard practice; the FBI’s 2012 GameOver Zeus operation is the classic example.

Financial disruption targets the money: crypto tracing, asset seizure and bank-account blocks (4,126 in Confrontation Ghost alone). Physical raids and arrests are the final pillar, synchronized across borders — coordinated through mutual legal assistance channels and, in Europe, the Joint Cybercrime Action Taskforce at Europol’s headquarters in The Hague.

How do investigators follow the money?

The FBI’s Virtual Assets Unit (operational since February 2022) does blockchain analysis and seizure support, while firms such as Chainalysis, TRM Labs and Elliptic trace funds for law enforcement: follow transactions across the public ledger until they touch an identifiable wallet or exchange account, then use that link to justify seizures.

The largest example: roughly 127,271 bitcoin — about $15 billion — seized from Chen Zhi and the Prince Group after an October 2025 indictment, the largest forfeiture in Justice Department history; the US and UK designated the group a transnational criminal organization. On October 21, 2026, Cambodia announced Chen Zhi’s extradition to China — although some earlier reports placed his arrest in January 2026.

The single most misunderstood number in this month’s headlines belongs to Confrontation Ghost: the $39 billion was identified, not seized. The official release says partners are “working towards the recovery of these assets.” Headlines saying the money was seized are wrong.

What happened in Operation Blackout?

Operation Blackout is the FBI’s global campaign against overseas scam centres. It surfaced with a Ghana raid announced October 8, 2026: 130+ people arrested or detained — including trafficking victims slated for repatriation — 89 victims identified, about $10 million in losses identified and 300+ devices seized, per Ghana’s state news agency and the FBI.

The $17 billion in “assets and crypto” seized was first reported October 13, then restated at a White House roundtable chaired by President Trump on October 21, where FBI Director Patel said 20+ compounds had been “destroyed and demolished” across Southeast Asia, Africa and the Middle East. “Announced on October 21” is shorthand: the operation predates the roundtable.

Other roundtable claims are agency statements, not verified facts: Trump said ~$1 billion in “cyber currency” was frozen and 500+ fraudulent websites shut down; Attorney General Todd Blanche said the FBI and Dubai Police arrested 276+ people and dismantled nine scam centres in April. Two footnotes: Patel said $670 million in losses was prevented (October 13) while Trump said “at least” $1.6 billion saved this year — likely different scopes, do not merge them; and on West Africa arrests, Patel cited ~300 individuals while a Justice Department account put it at 28 — contradictory, treat both as claimed.

What happened in Operation Confrontation Ghost?

Operation Confrontation Ghost is the UAE-led counterpart — and by the official numbers, the larger operation. The UAE Ministry of Interior ran it for three months, July 1 to September 30, 2026, targeting AI-enabled fraud, financial fraud through digital platforms and online sextortion. Results were announced October 21 at a UN anti-organized-crime conference in Vienna.

The coalition is the story: 30 countries plus Interpol, the Global Anti-Scam Alliance and 13 private-sector partners (including Meta, TikTok, Mastercard and Crypto.com). In three months it thwarted 123.71 million fraud attempts, identified $39B+ linked to fraud, arrested 960+ defendants, identified 3,500+ suspects and 15,500 victims, blocked 4,126 bank accounts, closed 570+ social media accounts and raided 29 fraud centres. UNODC Executive Director Monica Kathina Juma praised it as a model of international cooperation.

WarBrief covered the announcement in “Operation Confrontation Ghost: Inside the UAE’s $39B Fraud Crackdown.”

Operation Blackout vs Operation Confrontation Ghost: by the numbers

Caveat: CONFIRMED figures are backed by two or more independent sources; REPORTED figures rest on a single source — usually an agency announcement — and should be read as claims, not independently verified totals.

Why don’t police just shut down the scam call centres?

First, the physical problem is enormous and often beyond easy jurisdiction: the UN estimated at least 120,000 people trapped in scam operations in Myanmar and about 100,000 in Cambodia, while the International Organization for Migration put it as high as 300,000 across the two plus Laos. The UN Office on Drugs and Crime estimates Southeast Asian cyber-fraud revenue at $27.4–$36.5 billion a year. Myanmar raided the KK Park compound in October 2025 and about 1,500 workers fled into Thailand — one raid against an industry.

Second, many “workers” are trafficking victims — Ghana detained people who turned out to be victims slated for repatriation. Third, cross-border prosecution is slow: the FBI shares data with Indian authorities so call-centre cases can be tried locally, but foreign police need formal complaints and victim statements — a 2017 Kolkata raid collapsed without victim testimony.

Fourth, networks adapt. Operation Endgame — the rolling European botnet takedown — hit SocGholish, StealC and Amadey infrastructure in June 2026 with six countries coordinated by Europol and Eurojust; earlier waves in 2024–2025 took down hundreds of servers tied to Bumblebee, Qakbot and Trickbot. Yet criminals keep shifting to backup forums, encrypted apps and harder-to-trace payments. Takedowns raise the cost of crime — real damage — but rarely end a business model. Cambodia’s first cybercrime law and a reported 800-arrest casino raid on October 20 suggest the physical-compound phase is accelerating.

What this means for US/UK/EU readers

The operations keep getting bigger because the victim pool does. The US Federal Trade Commission told Congress that Americans reported $15.9 billion in fraud losses in 2025 — up from $12.5 billion in 2024 — with investment scams the top category at $7.9 billion. Reported losses are up roughly 430% since 2020.

In the UK, UK Finance’s 2026 report put 2025 payment fraud at £1.28 billion across 4.06 million cases; authorized push payment fraud hit £576.4 million, up 19%, with two-thirds originating online. Europol’s April 2026 threat assessment projected global cybercrime costs exceeding $10.5 trillion in 2026 — a projection, not a measured figure — warning of a “velocity gap” as AI lets criminals outpace investigators.

What helps: the FBI’s Internet Crime Complaint Center says to type www.ic3.gov directly into your browser — IC3 has no social media, never contacts victims, and never asks for payment to recover funds. Never send money, gift cards or crypto to someone you have only met online. In the UK, the Take Five campaign’s advice is Stop, Challenge, Protect: stop before parting with money, challenge pressure to act fast, and report to your bank and Action Fraud.

What to watch next in the fight against scam networks

October’s announcements face three tests: whether Cambodia’s crackdown survives the political economy that let the compounds grow; how the Chen Zhi extradition case proceeds; and whether the $39 billion identified by Confrontation Ghost ever reaches victims.

The deeper trend is AI: Europol warns the velocity gap is widening as scam operations deploy AI-generated voices and lures at scale. October’s operations show what the playbook can do at its best; whether it keeps up with an adversary that automates is the question the next takedown must answer. See “AI Cyber Warfare: Could Artificial Intelligence Make Cyber Attacks Faster?” — and WarBrief’s intelligence reporting for updates.

Frequently asked questions

Can seized scam assets be returned to victims?
In principle, yes: US forfeiture law allows remission and victim petitions. In practice, recovery is slow and partial — the money must be found, seized and forfeited first, which is why investigators stress reporting quickly at ic3.gov or to Action Fraud in the UK.

Is it possible to legally recover money lost to international scams?
Rarely, and almost never in full — jurisdiction problems, mule networks and crypto mixers stand in the way. Act fast: bank recall windows close in hours.

How do I stop tech-support scam calls?
Do not engage: hang up, block the number and report it. Scammers rotate numbers constantly, so blocking is damage control. Use your carrier’s spam filters and never let an unsolicited caller guide you to install remote-access software.

What is a DNS sinkhole?
A law-enforcement-controlled server that answers DNS requests for a criminal domain. Infected devices connect to the sinkhole instead of the criminals’ command server, cutting operators off and letting investigators log infected machines for victim notification.

How much money do scammers steal each year?
Americans reported $15.9 billion in fraud losses in 2025 (true cost possibly $195.9 billion, per the FTC). The UNODC estimates Southeast Asian cyber-fraud revenue at $27.4–$36.5 billion a year. Europol projects global cybercrime costs above $10.5 trillion for 2026 — a projection, not a measured total.

Sources

• Gulf News: Operation Confrontation Ghost thwarted 123M+ online scam attempts
• PR Newswire (via Morningstar): UAE leads landmark global operation with 30 countries
• IANS: FBI chief says $17B seized as US widens war on foreign scam centres
• Ghana News Agency: FBI, Ghanaian authorities arrest 130+ in scam centre raids
• US FTC: Testimony on the rising scam economy (March 2026)
• UK Finance: Annual Fraud Report 2026
• BleepingComputer: Operation Endgame nukes SocGholish malware from ~15,000 sites
• Europol: Joint Cybercrime Action Taskforce
• Al Jazeera: Philippines arrests 244 in online scam crackdown
• FBI IC3: Public service announcement on scam reporting